Technical Information
Modifies file system
Creates the following files
- %LOCALAPPDATA%\microsoft\internet explorer\msimgsiz.dat
- %LOCALAPPDATA%\microsoft\internet explorer\domstore\index.dat
- %LOCALAPPDATA%\microsoft\internet explorer\domstore\lip6vbh6\www.xf5701[1].xml
Network activity
Connects to
- 'xf##01.com':80
- '31##9.cc':443
- 'jt.##a01.com':443
- 'ma###066.top':443
- 's2.#oli.net':443
- 'ma###118.top':443
- 'kv##e.com':443
- '79#######.##s-ap-southeast-1.aliyuncs.com':443
- 'li###icture.com':443
- 'im#.#379a.xyz':443
- 'tu###.####accelerate.aliyuncs.com':443
- 'rs##9.com':443
- 'im#.#377a.xyz':443
- 'co####t-v6.51.la':80
- 'sd#.51.la':80
- 'hm.##idu.com':443
- 'hu###omains.com':443
- 'tt##6.com':80
- 'at.##icdn.com':80
- 'cd#.#ootcss.com':443
- 're###001.com':443
- 'x1.#.lencr.org':80
TCP
HTTP GET requests
- http://www.xf##01.com/
- http://www.xf##01.com/1688/foot.php
- http://www.xf##01.com/1688/links.php
- http://www.xf##01.com/1688/m_piaofu_bottom.html
- http://www.xf##01.com/1688/m_piaofu_top.html
- http://www.xf##01.com/1688/m_top.html
- http://www.xf##01.com/1688/img/logo.gif
- http://co####t-v6.51.la/v6/collect?dt############################################################################################################################################################...
- http://sd#.51.la/js-sdk-pro.min.js
- http://www.xf##01.com/1688/m_shipinkuang.js
- http://www.xf##01.com/1688/m_left_right.php
- http://www.xf##01.com/1688/m_piaofu_bottom.php
- http://www.xf##01.com/1688/m_piaofu_top.php
- http://www.xf##01.com/1688/m_top.php
- http://www.xf##01.com/1688/m_1.php
- http://www.xf##01.com/1688/gundongyuming.js
- http://www.xf##01.com/1688/top3.js
- http://www.xf##01.com/tj/tj1.js
- http://www.xf##01.com/tj/tj.js
- http://www.xf##01.com/statics_yf/js/home.js
- http://www.tt##6.com/
- http://www.xf##01.com/statics_yf/js/jquery.lazyload.min.js
- http://www.xf##01.com/statics_yf/js/jquery.cookie.min.js
- http://www.xf##01.com/statics_yf/js/stui_default.js
- http://at.##icdn.com/t/c/font_3143030_wh3toank53.woff2?t=########################################################################################################################################...
- http://www.xf##01.com/statics_yf/js/index.js
- http://www.xf##01.com/statics_yf/js/jquery.min.js
- http://www.xf##01.com/statics_yf/css/font_3143030_wh3toank53.css
- http://www.xf##01.com/statics_yf/css/mb7.css
- http://www.xf##01.com/statics_yf/font/iconfont.css
- http://www.xf##01.com/statics_yf/img/load.gif
- http://x1.#.lencr.org/
Other
- 'cd#.#ootcss.com':443
- 'hu###omains.com':443
- 'hm.##idu.com':443
- 'rs##9.com':443
- 'tu###.####accelerate.aliyuncs.com':443
- 'im#.#377a.xyz':443
- 'kv##e.com':443
- 'ma###118.top':443
- '79#######.##s-ap-southeast-1.aliyuncs.com':443
- 'ma###066.top':443
- 's2.#oli.net':443
- 'jt.##a01.com':443
- '31##9.cc':443
- 'li###icture.com':443
UDP
- DNS ASK xf##01.com
- DNS ASK 31##9.cc
- DNS ASK li###icture.com
- DNS ASK im#.#379a.xyz
- DNS ASK 79#######.##s-ap-southeast-1.aliyuncs.com
- DNS ASK re###001.com
- DNS ASK tu###.####accelerate.aliyuncs.com
- DNS ASK kv##e.com
- DNS ASK jt.##a01.com
- DNS ASK ma###118.top
- DNS ASK im#.#377a.xyz
- DNS ASK rs##9.com
- DNS ASK ma###066.top
- DNS ASK co####t-v6.51.la
- DNS ASK sd#.51.la
- DNS ASK hm.##idu.com
- DNS ASK hu###omains.com
- DNS ASK tt##6.com
- DNS ASK at.##icdn.com
- DNS ASK cd#.#ootcss.com
- DNS ASK s2.#oli.net
- DNS ASK x1.#.lencr.org
Miscellaneous
Searches for the following windows
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
- ClassName: 'Static' WindowName: ''
Executes the following
- '<SYSTEM32>\rundll32.exe' <SYSTEM32>\FirewallControlPanel.dll,ShowNotificationDialog /configure /ETOnly 0 /OnProfiles 6 /OtherAllowed 0 /OtherBlocked 0 /OtherEdgeAllowed 0 /NewBlocked 4 "<Full path to file>"
- '%ProgramFiles(x86)%\internet explorer\iexplore.exe' www.tt336.com
