Technical Information
Modifies file system
Creates the following files
- <PATH_SAMPLE>.bak
- %LOCALAPPDATA%\microsoft\internet explorer\msimgsiz.dat
Deletes the following files
- <Full path to file>
Substitutes the following executable files
- <Full path to file>
Substitutes the following files
- <PATH_SAMPLE>.bak
- <Full path to file>
Deletes itself.
Network activity
Connects to
- 'li###anqj.com':88
- 'localhost':9960
TCP
HTTP GET requests
- http://www.li####nqj.com:88/update/Init.txt via li###anqj.com
- http://www.li####nqj.com:88/update/up.exe via li###anqj.com
- http://www.li####nqj.com:88/gg.htm via li###anqj.com
- http://www.li####nqj.com:88/gg_files/mu.css via li###anqj.com
- http://www.li####nqj.com:88/gg_files/bg.gif via li###anqj.com
UDP
- DNS ASK li###anqj.com
Miscellaneous
Searches for the following windows
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
Creates and executes the following
- '<Full path to file>'
Restarts the analyzed sample
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c del <File name>.exe & ping 127.0.0.1 & ren <File name>.BAK <File name>.exe & start <File name>.exe
- '%WINDIR%\syswow64\ping.exe' 127.0.0.1
- '%WINDIR%\syswow64\cmd.exe' /c del <File name>.exe & ping 127.0.0.1 & ren <File name>.BAK <File name>.exe & start <File name>.exe' (with hidden window)
