Technical Information
Malicious functions
Searches for windows to
detect analytical utilities:
- ClassName: 'OLLYDBG', WindowName: ''
- ClassName: 'GBDYLLO', WindowName: ''
- ClassName: 'pediy06', WindowName: ''
- ClassName: 'FilemonClass', WindowName: ''
- ClassName: '', WindowName: 'File Monitor - Sysinternals: www.sysinternals.com'
- ClassName: 'PROCMON_WINDOW_CLASS', WindowName: ''
- ClassName: '', WindowName: 'Process Monitor - Sysinternals: www.sysinternals.com'
- ClassName: 'RegmonClass', WindowName: ''
- ClassName: '', WindowName: 'Registry Monitor - Sysinternals: www.sysinternals.com'
Sets a new unauthorized home page for Windows Internet Explorer.
Modifies file system
Creates the following files
- %LOCALAPPDATA%\microsoft\windows\history\history.ie5\mshist012021042320210424\index.dat
Modifies the following files
Network activity
Connects to
- '23##.com':80
- '23##.com':443
- 'oc##.#igicert.cn':80
- 'cr#.#igicert.cn':80
- 'h.###5cdn.net':80
- 'h.###5cdn.net':443
- 'cp##.##idustatic.com':80
- 'cp##.##idustatic.com':443
- 'cb##.baidu.com':443
- 'ww#####eam.2345cdn.net':443
- 'un####.50bang.org':443
- 'st####.mediav.com':443
- 'un####.50bang.org':80
- 'sh####.mediav.com':443
- 'lu###.#dn.bcebos.com':443
- 's3##.fenxi.com':443
TCP
HTTP GET requests
- http://oc##.#igicert.cn/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQhnxEBNL9LgIhfSsTcHsrTt204QgQURNnISjOO01KNp5KUYR%2BayKW37MsCEAmXA3BU1Hq4%2BXERYZqPmak%3D
- http://h.###5cdn.net/js/index/performance_20200811-d7895022f0.js
- http://h.###5cdn.net/js/index/module_20201210_abtest-fb8d33f14c.js
- http://h.###5cdn.net/js/index/cnxh/index_v3-4b03e0eb76.js
- http://h.###5cdn.net/js/index/ui_v3-62d0b124bb.js
- http://h.###5cdn.net/js/index/tianqi-d48b443420.js
- http://h.###5cdn.net/js/index/cnxh/common-4cf944f56c.js
- http://h.###5cdn.net/js/index/func_v3-0db0bea0cd.js
- http://h.###5cdn.net/js/index/bd_words-3c58c6a97b.js
- http://h.###5cdn.net/js/index/statistics_report-3348f951ec.js
- http://h.###5cdn.net/js/index/abtest_js-7a7017a86d.js
- http://un####.50bang.org/web/ajax25?uI###########################################################################################################################################################...
- http://h.###5cdn.net/js/index/report-78677e5cc9.js
- http://h.###5cdn.net/js/moment-6e68074f83.min.js
- http://h.###5cdn.net/js/jquery-1.8-dd39d1759b.3.min.js
- http://www.23##.com/resource/i/2019/02/21/c8408e3a45257ca8530470007bc619fc.png
- http://www.23##.com/resource/i/2020/08/12/5ede2fb44d4fcd86897d37380fb18719.png
- http://www.23##.com/resource/i/2020/03/17/19e3500cc7cf9c03f9e2847cdcb8f3a6.png
- http://h.###5cdn.net/i/search20200812/idx-1.png
- http://h.###5cdn.net/i/blank.png
- http://h.###5cdn.net/css/index_v1-81a7229b32.2_20201210.css
- http://h.###5cdn.net/right/homepage/zjsVer2.js?t=########
- http://cr#.#igicert.cn/DigiCertSecureSiteCNCAG3.crl
- http://h.###5cdn.net/js/base64-5bca38624a.min.js
- http://oc##.#igicert.cn/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSs4qvpyL%2F1h8IM3CR%2F4ZfFi8oOlAQUe6P6%2F%2FXVCV0e%2BSr%2FhVPtr0eo13oCEAyltihVcu6ZXs7Z2HbAqCY%3D
UDP
- DNS ASK 23##.com
- DNS ASK f1#.#aidu.com
- DNS ASK t1#.#aidu.com
- DNS ASK lu###.#dn.bcebos.com
- DNS ASK wn.###.baidu.com
- DNS ASK bd###e.2345.com
- DNS ASK ec####.baidu.com
- DNS ASK sh####.mediav.com
- DNS ASK po#.#aidu.com
- DNS ASK hm.##idu.com
- DNS ASK st####.mediav.com
- DNS ASK gu###.#nion2.50bang.org
- DNS ASK ss#.#aidu.com
- DNS ASK ba##u.com
- DNS ASK dh###t.2345.com
- DNS ASK un####.50bang.org
- DNS ASK ww#####eam.2345cdn.net
- DNS ASK cb##.baidu.com
- DNS ASK ti###i.2345.com
- DNS ASK cp##.##idustatic.com
- DNS ASK h.###5cdn.net
- DNS ASK microsoft.com
- DNS ASK oc##.#igicert.cn
- DNS ASK cr#.#igicert.cn
- DNS ASK s3##.fenxi.com
- DNS ASK public-trust.com
Miscellaneous
Searches for the following windows
- ClassName: '18467-41' WindowName: ''
- ClassName: '' WindowName: 'Microsoft Internet Explorer'
- ClassName: 'DDEMLMom' WindowName: ''
- ClassName: 'IEFrame' WindowName: ''
- ClassName: 'Static' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
