Technical Information
Malicious functions
Executes the following
- '%ProgramFiles%\internet explorer\iexplore.exe' http://www.ji##nla.com
- '%ProgramFiles%\internet explorer\iexplore.exe' http://www.12#4.la/an.htm?dn##
- '%ProgramFiles(x86)%\internet explorer\iexplore.exe' http://www.qi##ee.com/act/ConfigDownLoadList.html
- '%WINDIR%\syswow64\taskkill.exe' /f /pid 2508
- '%WINDIR%\syswow64\taskkill.exe' /f /pid 0
Modifies file system
Creates the following files
- %TEMP%\aut3a51.tmp
- C:\games.exe
- %TEMP%\aut3a62.tmp
- C:\hahagames.exe
- %TEMP%\aut3a63.tmp
- C:\maxthon2.0.exe
- %ProgramFiles(x86)%\outlook expres2\quicktime.com
- %ProgramFiles(x86)%\outlook expres2\hijack.exe
- %ProgramFiles(x86)%\microsoft.kuailekuangben\hijack.bat
- %ProgramFiles(x86)%\microsoft.kuailekuangben\hijack.exe
- %TEMP%\copyanddelete.bat
- %LOCALAPPDATA%\microsoft\windows\history\history.ie5\mshist012022041520220416\index.dat
- %TEMP%\todeletetif.bat
Deletes the following files
- %TEMP%\aut3a51.tmp
- %TEMP%\aut3a62.tmp
- %TEMP%\aut3a63.tmp
Modifies the following files
Network activity
Connects to
- 'ji##nla.com':80
- '12#4.la':80
- 'we#t.cn':443
- 'wa####g.aliyun.com':443
- 'st#####.##gitalcertvalidation.com':80
- 'g.###cdn.com':443
- 'at.##icdn.com':443
- 're####e.alicdn.com':443
- 'yn##.alipay.com':443
- 'yn##.aliapp.org':443
- 'oc##.dcocsp.cn':80
TCP
HTTP GET requests
- http://www.ji##nla.com/
- http://www.12#4.la/an.htm?dn##
- http://st#####.##gitalcertvalidation.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRJrF0xYA49jC3D83fgDGesaUkzIQQUf9OZ86BHDjEAVlYijrfMnt3KAYoCEAp%2Bw9%2FoM%2BPcFj4uEzg2cAY%3D
- http://www.ji##nla.com/favicon.ico
- http://oc##.dcocsp.cn/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAh%2BGPuPqpJ%2B6HYKDYmC9RI%3D
- http://oc##.dcocsp.cn/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHv1Dj%2BciPJEWH5JNtwL5Y07mRqwQUxBF%2BiECGwkG%2FZfMa4bRTQKOr7H0CEA1LOHFAOXb2Avx89rKy6PI%3D
- http://www.qi##ee.com/act/ConfigDownLoadList.html
Other
- 'we#t.cn':443
- 'wa####g.aliyun.com':443
- 'g.###cdn.com':443
- 'al##un.com':443
- 'cn.##iyun.com':443
- 'do#####pi.aliyun.com':443
- 'yn##.aliapp.org':443
- 'yn##.alipay.com':443
UDP
- DNS ASK 12#4.la
- DNS ASK yn##.aliapp.org
- DNS ASK yn##.alipay.com
- DNS ASK do#####pi.aliyun.com
- DNS ASK im#.#licdn.com
- DNS ASK re####e.alicdn.com
- DNS ASK al###.alicdn.com
- DNS ASK at.##icdn.com
- DNS ASK cn.##iyun.com
- DNS ASK g.###cdn.com
- DNS ASK al##un.com
- DNS ASK microsoft.com
- DNS ASK st#####.##gitalcertvalidation.com
- DNS ASK wa####g.aliyun.com
- DNS ASK we#t.cn
- DNS ASK ji##nla.com
- DNS ASK oc##.dcocsp.cn
- DNS ASK qi##ee.com
Miscellaneous
Searches for the following windows
- ClassName: 'EDIT' WindowName: ''
- ClassName: 'Static' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
- ClassName: '' WindowName: ''
Creates and executes the following
- 'C:\hahagames.exe'
- 'C:\games.exe'
- 'C:\maxthon2.0.exe'
- '%ProgramFiles(x86)%\outlook expres2\hijack.exe'
- '%ProgramFiles(x86)%\microsoft.kuailekuangben\hijack.exe'
- '%WINDIR%\syswow64\cmd.exe' /c %TEMP%\\CopyAndDelete.bat' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c %TEMP%\todeletetif.bat' (with hidden window)
- '%ProgramFiles(x86)%\internet explorer\iexplore.exe' http://www.qi##ee.com/act/ConfigDownLoadList.html' (with hidden window)
- '%WINDIR%\syswow64\taskkill.exe' /f /pid 2508' (with hidden window)
- '%WINDIR%\syswow64\taskkill.exe' /f /pid 0' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c %TEMP%\\CopyAndDelete.bat
- '%WINDIR%\syswow64\ping.exe' -a 127.1
- '%WINDIR%\syswow64\ping.exe' 127.1
- '%WINDIR%\syswow64\cmd.exe' /c %TEMP%\todeletetif.bat
