Technical Information
Malicious functions
To complicate detection of its presence in the operating system,
modifies the following system settings:
- DNS server to '<DNS_SERVER>'
- DNS server to '114.114.114.114'
Injects code into
the following user processes:
- d1e74b1.exe
Modifies file system
Creates the following files
- %HOMEPATH%\desktop\<File name>.lnk
- <Current directory>\gd7d49\bb37607ea\d42fd7f788\8e06awsfb.exe
- <Current directory>\gd7d49\edf760\46ddcxsez.dll
- <Current directory>\gd7d49\dafc84f\9390wrdyt.dll
- <Current directory>\gd7d49\c9106cf0\dae9rdytf.dll
- <Current directory>\gd7d49\e127214\51e5widyk.dll
- <Current directory>\gd7d49\a38b55881\55e8favhc.dll
- <Current directory>\gd7d49\g0c324\d59cytfav.dll
- <Current directory>\gd7d49\bb37607ea\i7ec52\45cdpbwrd.dll
- <Current directory>\gd7d49\bb37607ea\b42af98dd9\36e9tpbwr.dll
- <Current directory>\gd7d49\bb37607ea\f57df3b50c3\7ed2rm7to.dll
- <Current directory>\gd7d49\bb37607ea\ee8f76e\d1e74b1.ini
- <Current directory>\gd7d49\bb37607ea\b7005a\b7f1h3qm8.dll
- <Current directory>\gd7d49\bb37607ea\fc9d302e\c9aahcxje.dll
- <Current directory>\gd7d49\bb37607ea\e6b16000cab6\3b2ftoavq.dll
- <Current directory>\gd7d49\bb37607ea\eac798\f7d2rdytf.dll
- %LOCALAPPDATA%\microsoft\windows\history\history.ie5\mshist012023020620230207\index.dat
- <Current directory>\gd7d49\bb37607ea\ge50ba490d6\5bfbsfbxk.dll
- <Current directory>\gd7d49\ed0d49
- %ProgramFiles(x86)%\mirc\d1e74b1.exe
- <Current directory>\gd7d49\h854f1b\e7e3hdzmi.dll
- <Current directory>\gd7d49\bb37607ea\h6104504b46a\e8f5ytfav.dll
Deletes the following files
- %LOCALAPPDATA%\microsoft\windows\history\history.ie5\mshist012023020620230207\index.dat
Network activity
Connects to
- '18#.#54.116.116':80
- '11#.#9.29.29':80
UDP
- DNS ASK a.##fz.com
- DNS ASK xi###ufang.com
- DNS ASK yu###ijia.com
- DNS ASK ka##hun.com
- DNS ASK jd##.info
- DNS ASK ku##u.com
- DNS ASK ca##0.com
- DNS ASK ku###i100.com
- DNS ASK em#.com.cn
- DNS ASK hu##ng.com
- DNS ASK x-##l.com
- DNS ASK 64##5.com
- DNS ASK ic.#et.cn
- DNS ASK cl#.im
- DNS ASK qi##u.com
- DNS ASK ju##ng.com
- DNS ASK dc###d.net.cn
- DNS ASK iw##cai.com
- DNS ASK il###gcang.com
- DNS ASK bo##css.com
- DNS ASK w7##0.com
- DNS ASK fi##law.cn
- DNS ASK cr##3.com
- DNS ASK ge###ang.org
- DNS ASK as###.com.cn
- DNS ASK lu###gsong.com
- DNS ASK do##xia.com
- DNS ASK da.##aa.site
- DNS ASK ic###nglan.com
- DNS ASK si###loud.com
- DNS ASK al##un.com
- DNS ASK 7k##.com
- DNS ASK du##e.com
- DNS ASK 11#.com
- DNS ASK i4.cn
- DNS ASK zt#.com
- DNS ASK as##.com.cn
- DNS ASK yi###nzixun.com
- DNS ASK ji###uoyun.com
- DNS ASK du##.com
- DNS ASK ci##ews.com
- DNS ASK hu##ei.com
- DNS ASK 18##3.com
- DNS ASK hi##ina.com
- DNS ASK 17##3.com
- DNS ASK yo##h.cn
- DNS ASK vi##.com.cn
- DNS ASK be##on.com
- DNS ASK ji##lu.cn
- DNS ASK so##dot.org
- DNS ASK el###ans.com
- DNS ASK ka##n.cn
- DNS ASK ix##ua.com
- DNS ASK 9g##e.cn
- DNS ASK yi##e.com
- DNS ASK gu##cha.cn
- DNS ASK mi.com
- DNS ASK tm##l.com
- DNS ASK zh##u.com
- DNS ASK jb##.net
- DNS ASK au###ome.com.cn
- DNS ASK hu##.com
- DNS ASK cc##.com
- DNS ASK te##ent.com
- DNS ASK ea###oney.com
- DNS ASK cd##m.cn
- DNS ASK jm#.com.cn
- DNS ASK fo###ate.net
- DNS ASK bo##118.com
- DNS ASK yo##ao.com
- DNS ASK 16##.com
- DNS ASK jd.com
- DNS ASK ba##u.com
- DNS ASK so.com
- DNS ASK si##.com.cn
- DNS ASK qq.com
- DNS ASK so##u.com
- DNS ASK so##.com
- DNS ASK iq##i.com
- DNS ASK ku###hou.com
- DNS ASK do##in.com
- DNS ASK ha##23.com
- DNS ASK wi###ang.com
- DNS ASK it##52.com
- DNS ASK 10###a.com.cn
- DNS ASK pc###o.com.cn
- DNS ASK xu##ei.com
- DNS ASK wa####reetcn.com
- DNS ASK fo###anghai.com
- DNS ASK 58##u.com
- DNS ASK xi####zhijia.net
- DNS ASK ch###gkit.com
- DNS ASK tu##u.com
- DNS ASK ne##ase.com
- DNS ASK 21##od.cn
- DNS ASK ih#.cn
- DNS ASK to##r.im
- DNS ASK im##er.com
- DNS ASK sa###a1st.com
- DNS ASK xi##man.cn
- DNS ASK ic##font.cn
- DNS ASK ui##c.com
- DNS ASK ct##p.com
- DNS ASK mi###ideo.com
- DNS ASK mo##plus.cn
- DNS ASK ip#.hk
- DNS ASK 58##c.com
- DNS ASK we#t.cn
- DNS ASK hu##u.com
- DNS ASK ip##8.com
- DNS ASK ti###########bkjjdrkcip.cn-hangzhou.fcapp.run
Miscellaneous
Searches for the following windows
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
Creates and executes the following
- '%ProgramFiles(x86)%\mirc\d1e74b1.exe' WfCSKCcwHx8qkoJ2HoEwPHsme04=
