Technical Information
Malicious functions
To complicate detection of its presence in the operating system,
modifies the following system settings:
- DNS server to '<DNS_SERVER>'
- DNS server to '114.114.114.114'
Injects code into
the following user processes:
- c3a579797.exe
Modifies file system
Creates the following files
- %HOMEPATH%\desktop\<File name>.lnk
- <Current directory>\a26fa1c5\f183e71\eefbbwrdy.dll
- <Current directory>\a26fa1c5\ce0fe3\b77didykf.dll
- <Current directory>\a26fa1c5\ea045b\c93bwrdyt.dll
- <Current directory>\a26fa1c5\fa4efb9e05\997etoavq.dll
- <Current directory>\a26fa1c5\ha591938b28\f590mh2o.dll
- <Current directory>\a26fa1c5\e85960d\52d6pbwrd.dll
- <Current directory>\a26fa1c5\b7861f\cd36582dc\e194wrdyt.dll
- <Current directory>\a26fa1c5\b7861f\g97e99ad\ed895rm7t.dll
- <Current directory>\a26fa1c5\b7861f\b77c62\ab30rdytf.dll
- <Current directory>\a26fa1c5\b7861f\ga77e3\c5411ni3p.dll
- <Current directory>\a26fa1c5\b7861f\a3d76f627\a6b5qcxse.dll
- <Current directory>\a26fa1c5\b7861f\d77506\884dlavhc.dll
- <Current directory>\a26fa1c5\b7861f\b8d07af\ce6ah2oj4.dll
- %LOCALAPPDATA%\microsoft\windows\history\history.ie5\mshist012020111220201113\index.dat
- <Current directory>\a26fa1c5\b7861f\g6474de9f2de\89b9upbwr.dll
- <Current directory>\a26fa1c5\a6b03c34c148
- %ProgramFiles(x86)%\google\c3a579797.exe
- <Current directory>\a26fa1c5\b7861f\fb52e321a01\34azlg1n.exe
- %LOCALAPPDATA%\microsoft\internet explorer\domstore\w37zlxnl\www.pianyifz[1].xml
Deletes the following files
- %LOCALAPPDATA%\microsoft\windows\history\history.ie5\mshist012020111220201113\index.dat
- <Current directory>\a26fa1c5\a6b03c34c148
Substitutes the following files
- %LOCALAPPDATA%\microsoft\windows\history\history.ie5\mshist012020111220201113\index.dat
Network activity
TCP
HTTP GET requests
- http://t.##.com/asa1215351
- http://11###.92pk.com/cache/114sf.com/top.jpg
- http://11###.92pk.com/cache/114sf.com/foot.js
- http://11###.92pk.com/cache/114sf.com/bg3.jpg
- http://11###.92pk.com/cache/114sf.com/style.css
- http://cn##.mmstat.com/9.gif?ab##################
- http://z7.#nzz.com/stat.htm?id###################################################################################################################################################################...
- http://c.##zz.com/core.php?we###################
- http://11###.92pk.com/cache/114sf.com/banner.js
- http://11###.92pk.com/cache/114sf.com/list.css
- http://co####5.51yes.com/sa.htm?id###############################################################################################################################################################...
- http://11###.92pk.com/?=w##
- http://s1#.#nzz.com/z_stat.php?id#############################
- http://pc####e.cnzz.com/app.gif?&c###########################
- http://co####5.51yes.com/click.aspx?id##################
- http://www.so##.com/
- http://www.si##.com.cn/
- http://www.so.com/
- http://www.pi####fz.com:9998/images/news.gif via pi###ifz.com
- http://www.so##u.com/
- http://www.qq.com/
- http://si###torage.cn/question/data.txt
- http://www.pi####fz.com:9998/yidao.html via pi###ifz.com
- http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt
- http://oc##.dcocsp.cn/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHv1Dj%2BciPJEWH5JNtwL5Y07mRqwQUxBF%2BiECGwkG%2FZfMa4bRTQKOr7H0CEAn0urHLhvvhimvHSa0KYk4%3D
- http://oc##.dcocsp.cn/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAh%2BGPuPqpJ%2B6HYKDYmC9RI%3D
- http://cr#.##gicert-cn.com/DigiCertGlobalRootCA.crl
- http://da#####.yaotongji.com:8080/ via da#####.yaotongji.com
- http://cq###.appchizi.com/time.php
UDP
- DNS ASK t.##.com
- DNS ASK z6.#nzz.com
- DNS ASK v1.#nzz.com
- DNS ASK pc####e.cnzz.com
- DNS ASK cn##.mmstat.com
- DNS ASK c.##zz.com
- DNS ASK z7.#nzz.com
- DNS ASK s1#.#nzz.com
- DNS ASK co####5.51yes.com
- DNS ASK 11###.92pk.com
- DNS ASK hm.##idu.com
- DNS ASK so.com
- DNS ASK so##u.com
- DNS ASK si##.com.cn
- DNS ASK qq.com
- DNS ASK so##.com
- DNS ASK da#####.yaotongji.com
- DNS ASK pi###ifz.com
- DNS ASK si###torage.cn
- DNS ASK microsoft.com
- DNS ASK cr#.##gicert-cn.com
- DNS ASK oc##.dcocsp.cn
- DNS ASK cq###.appchizi.com
- DNS ASK si###torage.com
Miscellaneous
Searches for the following windows
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
- ClassName: 'Static' WindowName: ''
Creates and executes the following
- '%ProgramFiles(x86)%\google\c3a579797.exe' WfCSK319Knh8kiQvfXkqeTx7JntO