Technical Information
Modifies file system
Creates the following files
- <Current directory>\exuikrnln_win32.lib
- C:\users\public\thunder network\mini_downloadlib\odawmdawntu=\version_3_2_1_40\profiles\error.dat
- %ALLUSERSPROFILE%\thunder network\downloadlib\pub_store.dat
- %TEMP%\zlibwapi.dll
- %TEMP%\download\zlib1.dll
- %TEMP%\download\xlbughandler.dll
- %TEMP%\download\msvcr71.dll
- %TEMP%\download\msvcp71.dll
- %TEMP%\download\minizip.dll
- %TEMP%\download\minithunderplatform.exe
- %TEMP%\download\download_engine.dll
- %TEMP%\download\dl_peer_id.dll
- %TEMP%\download\atl71.dll
- %TEMP%\xldl.dll
- %ProgramFiles(x86)%\skins\config.dat
- <Current directory>\iac.base.dat
- <Current directory>\api-ms-win-crt-stdio-l1-1-0.dll
- <Current directory>\api-ms-win-crt-runtime-l1-1-0.dll
- <Current directory>\api-ms-win-crt-math-l1-1-0.dll
- <Current directory>\api-ms-win-crt-heap-l1-1-0.dll
- <Current directory>\vcruntime140.dll
- <Current directory>\msvcp140_codecvt_ids.dll
- <Current directory>\msvcp140_atomic_wait.dll
- <Current directory>\msvcp140.dll
- <Current directory>\concrt140.dll
- <Current directory>\api-ms-win-crt-string-l1-1-0.dll
- <Current directory>\iac.zip
- <Current directory>\anticheat.dll
- <Current directory>\1b0d0d0c120f156a155e15f0a0d160d0e160f.exe
- <Current directory>\exuikrnln_win64.lib
- C:\users\public\thunder network\mini_downloadlib\odawmdawntu=\version_3_2_1_40\profiles\asyn_frame.dat
- C:\users\public\thunder network\mini_downloadlib\odawmdawntu=\version_3_2_1_40\profiles\download.cfg
Sets the 'hidden' attribute to the following files
- <Current directory>\exuikrnln_win32.lib
- <Current directory>\exuikrnln_win64.lib
- <Current directory>\1b0d0d0c120f156a155e15f0a0d160d0e160f.exe
- <Current directory>\anticheat.dll
- <Current directory>\iac.zip
Network activity
Connects to
- 'os.##q520.top':32520
- 'sl.##skins.com':80
- 'sk###.x1.lolgezi.cc':80
- 'hu#####.shub.hz.sandai.net':80
- 'hu####.#hub.hz.sandai.net':80
- 'hu#####.hz.sandai.net':80
- 'localhost':80
- 'hu####.hz.sandai.net':80
TCP
HTTP GET requests
- http://sl.##skins.com/
- http://sl.##skins.com/SLVersionConfig.json
- http://sl.##skins.com/SLServerConfig.json
- http://sk###.x1.lolgezi.cc/d/Pa###istPhoto/SLBox241115_1.webm
HTTP POST requests
- http://11#.##2.219.184:80/
- http://14#.##6.225.136:80/
- http://14#.##6.220.33:80/
- http://11#.##.218.40:80/
Other
- 'os.##q520.top':32520
UDP
- DNS ASK os.##q520.top
- DNS ASK sl.##skins.com
- DNS ASK hu#####.hz.sandai.net
- DNS ASK hu####.hz.sandai.net
- DNS ASK hu###.hz.sandai.net
- DNS ASK pm##.#z.sandai.net
- DNS ASK sk###.x1.lolgezi.cc
- DNS ASK hu#####.shub.hz.sandai.net
- DNS ASK im#####r.hz.sandai.net
- DNS ASK sc###.##ub.hz.sandai.net
- DNS ASK hu####.#hub.hz.sandai.net
- DNS ASK bj#####.baidupcs.com
- 'hu#####.hz.sandai.net':8000
Miscellaneous
Searches for the following windows
- ClassName: 'RiotWindowClass' WindowName: 'League of Legends (TM) Client'
Creates and executes the following
- '<Current directory>\1b0d0d0c120f156a155e15f0a0d160d0e160f.exe'
- '%TEMP%\download\minithunderplatform.exe' -StartTP
Executes the following
- '%WINDIR%\syswow64\wbem\wmic.exe' BaseBoard get SerialNumber
- '<SYSTEM32>\rundll32.exe' <SYSTEM32>\FirewallControlPanel.dll,ShowNotificationDialog /configure /ETOnly 0 /OnProfiles 6 /OtherAllowed 0 /OtherBlocked 0 /OtherEdgeAllowed 0 /NewBlocked 4 "%TEMP%\download\minithunderplatf...
- '%WINDIR%\syswow64\wbem\wmic.exe' BaseBoard get SerialNumber' (with hidden window)