Technical Information
Malicious functions
Injects code into
the following user processes:
- iexplore.exe
Modifies file system
Substitutes the following executable files
- <Full path to file>
Moves itself
- from <Full path to file> to <Full path to file>.bak
Network activity
Connects to
- 'hi.##idu.com':80
- 'in####ow.baidu.com':443
- '10#.#8.20.226':80
TCP
HTTP GET requests
- http://hi.##idu.com/aegifjftrggluze/item/be185dc989cae4f4984aa0df
- http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?b2##############
Other
- 'hi.##idu.com':443
UDP
- DNS ASK hi.##idu.com
- DNS ASK in####ow.baidu.com
