Technical Information
Modifies file system
Creates the following files
- <Current directory>\skinh_el.dll
Sets the 'hidden' attribute to the following files
- <Current directory>\skinh_el.dll
Modifies the following files
Substitutes the following executable files
- <Full path to file>
Moves itself
- from <Full path to file> to %TEMP%\[d5c388ef46f98ef7a3877a81f786bd26]
Network activity
Connects to
- '42.#1.7.143':2014
- 'op##.baidu.com':80
- 'ba##u.com':443
TCP
HTTP GET requests
- http://op##.baidu.com/special/time/
Other
- 'ba##u.com':443
UDP
- DNS ASK op##.baidu.com
- DNS ASK ba##u.com
- DNS ASK jj##g.com
Miscellaneous
Searches for the following windows
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
