Technical Information
Malicious functions
Executes the following
- '%ProgramFiles(x86)%\internet explorer\iexplore.exe' http://sqsj.web.35123.net
Modifies file system
Creates the following files
- %WINDIR%\syswow64\yytmp\óñòæîäêé.exe
- %WINDIR%\syswow64\yytmp\ywsfiletmp.tmp
- %WINDIR%\syswow64\yytmp\yadverser.tmp
- %WINDIR%\syswow64\syys5.2.2.syw
- %WINDIR%\syswow64\yytmp\1\temphtm1.htm
- %APPDATA%\microsoft\windows\privacie\index.dat
- %LOCALAPPDATA%\microsoft\windows\history\history.ie5\mshist012024012720240128\index.dat
Deletes the following files
- %WINDIR%\syswow64\yytmp\ywsfiletmp.tmp
- %WINDIR%\syswow64\yytmp\yadverser.tmp
- %WINDIR%\syswow64\yytmp\óñòæîäêé.exe
- %WINDIR%\syswow64\yytmp\1\temphtm1.htm
Substitutes the following files
- %WINDIR%\syswow64\yytmp\yadverser.tmp
Network activity
Connects to
- 'sw###163.com':80
- 'js.##ers.51.la':443
- 'kv##g.com':443
- '55###666ww.com':443
- 'po###ossv6.xyz':443
- 'yy###.berc66.xyz':2188
- 'x1.#.lencr.org':80
- 'r3.#.lencr.org':80
TCP
HTTP GET requests
- http://www.sw###163.com/
- http://www.sw###163.com/template/m1938pc/static/js/jquery.lazyload.min.js
- http://www.sw###163.com/template/m1938pc/static/css/bootstrap.min.css
- http://www.sw###163.com/template/m1938pc/static/css/style.css
- http://www.sw###163.com/template/m1938pc/static/css/swiper.min.css
- http://www.sw###163.com/template/m1938pc/static/css/common.css
- http://www.sw###163.com/template/m1938pc/static/js/jquery.min.js
- http://www.sw###163.com/template/m1938pc/static/fonts/glyphicons-halflings-regular.eot)%20format(%22embedded-opentype%22),%20url(../fonts/glyphicons-halflings-regular.woff2)%20format(%22woff2%2...
- http://www.sw###163.com/template/m1938pc/static/fonts/voltaire.eot
- http://www.sw###163.com/template/m1938pc/ads/960.gif
- http://www.sw###163.com/template/m1938pc/static/fonts/iconfont.eot
- http://www.sw###163.com/template/m1938pc/ads/250.gif
- http://www.sw###163.com/template/m1938pc/static/images/touch_app.png
- http://x1.#.lencr.org/
- http://r3.#.lencr.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBRI2smg%2ByvTLU%2Fw3mjS9We3NfmzxAQUFC6zF7dYVsuuUAlA5h%2BvnYsUwsYCEgTDshDFP9i%2B0hMilnQwJRJY0w%3D%3D
- http://www.sw###163.com/favicon.ico
Other
- 'js.##ers.51.la':443
- 'kv##g.com':443
- 'po###ossv6.xyz':443
- 'yy###.berc66.xyz':2188
- '55###666ww.com':443
UDP
- DNS ASK sw###163.com
- DNS ASK sq##.#eb.35123.net
- DNS ASK js.##ers.51.la
- DNS ASK yy###.berc66.xyz
- DNS ASK 55###666ww.com
- DNS ASK kv##g.com
- DNS ASK po###ossv6.xyz
- DNS ASK x1.#.lencr.org
- DNS ASK r3.#.lencr.org
Miscellaneous
Searches for the following windows
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
- ClassName: 'Static' WindowName: ''
Executes the following
- '%ProgramFiles(x86)%\internet explorer\iexplore.exe' www.sword163.com
