Technical Information
Malicious functions
Executes the following
- '%ProgramFiles(x86)%\internet explorer\iexplore.exe' http://www.du#t.cn
- '%ProgramFiles(x86)%\internet explorer\iexplore.exe' http://bb#.dult.cn
Modifies file system
Creates the following files
- %TEMP%\e_n60005\krnln.fnr
- %TEMP%\e_n60005\spec.fne
- %TEMP%\e_n60005\game-ec.fne
- %TEMP%\e_n60005\iext.fnr
- %TEMP%\e_n60005\dult.fne
- %TEMP%\e_n60005\eapi.fne
- %TEMP%\e_n60005\shell.fne
- %TEMP%\1776.tmp
- %TEMP%\193b.tmp
- %TEMP%\1a36.tmp
- %WINDIR%\syswow64\ai8vplaydl.dll
- %LOCALAPPDATA%\microsoft\windows\history\history.ie5\mshist012022053120220601\index.dat
Deletes the following files
- %TEMP%\1776.tmp
- %TEMP%\193b.tmp
- %TEMP%\1a36.tmp
Modifies the following files
Network activity
Connects to
- 'du#t.cn':80
- 'bb#.dult.cn':80
- 'bb#.125.la':443
- 'ji####hongyou.net':80
- 'we###an.360.cn':80
- 'du#t.cn':443
- 'oc##.#ectigo.com':80
TCP
HTTP GET requests
- http://www.du#t.cn/
- http://du#t.cn/images/yhhd.png
- http://bb#.dult.cn/data/attachment/forum/202202/19/123807n5bbigvbbft9ll41.jpg
- http://bb#.dult.cn/data/attachment/forum/202202/27/162027wy9epqdiq4hl9vre.png
- http://www.du#t.cn/theme/default/images/online_service.png
- http://du#t.cn/static/image/common/ad_close.gif
- http://du#t.cn/zthtml/shouyel3.png
- http://du#t.cn/zthtml/soft_logo.gif
- http://du#t.cn/zthtml/gongj.png
- http://du#t.cn/zthtml/shouye01.png
- http://du#t.cn/zthtml/shouyel2.png
- http://du#t.cn/zthtml/yuanm.png
- http://bb#.dult.cn/data/attachment/forum/202204/06/112939wllq56leccllhglg.jpg
- http://du#t.cn/home.php?mo##################################
- http://du#t.cn/source/plugin/webtctz/template/js/jquery.js
- http://bb#.dult.cn/data/attachment/forum/202205/08/124834ywgr22w97ntpte1y.png
- http://www.du#t.cn/theme/default/images/slide_loader.gif
- http://www.ji####hongyou.net/jpeg/jzy.gif
- http://du#t.cn/zthtml/ecmo.png
- http://du#t.cn/zthtml/jiaol.jpg
- http://www.du#t.cn/theme/default/images/icon_contact.png
- http://du#t.cn/zthtml/zhidao.png
- http://bb#.dult.cn/data/attachment/block/d3/d3d51d07adc842b18347125537e45528.jpg
- http://bb#.dult.cn/data/attachment/block/d0/d03afacc643a3e0837a0c995cf527865.jpg
- http://du#t.cn/zthtml/h8.png
- http://bb#.dult.cn/data/attachment/block/b7/b7edff92b6135af189f584dfd11bc2df.jpg
- http://du#t.cn/zthtml/ee.png
- http://du#t.cn/zthtml/ruanj.png
- http://www.du#t.cn/theme/default/images/icon_red.gif
- http://bb#.dult.cn/data/attachment/forum/202102/26/125300zgyu9lr9nfrkvf99.gif
- http://du#t.cn/source/plugin/wz_kf/template/js/kefu.js
- http://www.du#t.cn/images/product/24_thumb.jpg
- http://www.du#t.cn/theme/default/images/inactive.png
- http://du#t.cn/static/image/common/nv_a.png
- http://bb#.dult.cn/uc_server/data/avatar/000/00/27/19_avatar_small.jpg
- http://bb#.dult.cn/uc_server/data/avatar/000/00/04/36_avatar_small.jpg
- http://bb#.dult.cn/uc_server/data/avatar/000/00/34/29_avatar_small.jpg
- http://bb#.dult.cn/uc_server/avatar.php?ui################
- http://bb#.dult.cn/data/attachment/block/d4/d4b6f4a17e3ced76e926e268b1c0395d.jpg
- http://bb#.dult.cn/data/attachment/forum/202202/13/165041oiz2fhh7i0n11950.jpg
- http://bb#.dult.cn/zthtml/eyywg7.png
- http://bb#.dult.cn/zthtml/zcb.png
- http://bb#.dult.cn/logo/ghlogo.gif
- http://bb#.dult.cn/logo/dult.gif
- http://bb#.dult.cn/data/zaix.png
- http://bb#.dult.cn/zthtml/mmkf.png
- http://bb#.dult.cn/zthtml/kfxtb.png
- http://bb#.dult.cn/zthtml/eyywg6.png
- http://du#t.cn/static/image/common/site_qq.jpg
- http://www.du#t.cn/favicon.ico
- http://bb#.dult.cn/data/attachment/forum/202101/16/184716ks2zm6bomo5z34y5.gif
- http://bb#.dult.cn/data/attachment/block/bd/bd24c850db7c5cdb1fc6d1e139a9f00e.jpg
- http://bb#.dult.cn/data/attachment/forum/202105/21/155937ybr2rg7y0zy0g89w.png
- http://bb#.dult.cn/data/attachment/forum/202108/08/161937o8ui9ja9u14isssp.png
- http://bb#.dult.cn/data/attachment/forum/202108/18/093251zjqphxtpjtwictct.png
- http://bb#.dult.cn/data/attachment/forum/202109/02/203231j3i43fxetiyigpu3.png
- http://du#t.cn/static/image/common/scrolltop.png
- http://bb#.dult.cn/data/attachment/forum/202110/16/231616rsmf5sieajvjsjlz.png
- http://www.du#t.cn/images/product/23_thumb.png
- http://bb#.dult.cn/data/attachment/forum/202110/21/192157ti2vtl2lj1z6l2cj.png
- http://www.du#t.cn/theme/default/images/active.png
- http://www.du#t.cn/images/product/22_thumb.png
- http://du#t.cn/source/plugin/wz_kf/template/images/right_float_web.png
- http://bb#.dult.cn/uc_server/avatar.php?ui#################
- http://we###an.360.cn/status/pai/hash/0102aabcf0804881e7b8dc994d360bac
- http://www.du#t.cn/data/slide/20130523hiqafl.jpg
- http://bb#.dult.cn/zthtml/eyywg9.png
- http://www.du#t.cn/data/slide/20160920berevf.png
- http://www.du#t.cn/theme/default/images/logo.png
- http://du#t.cn/template/default/style/t5/nv_a.png
- http://du#t.cn/static/image/common/qmenu.png
- http://du#t.cn/static/image/common/search.png
- http://www.du#t.cn/images/product/18_thumb.png
- http://du#t.cn/template/default/style/t5/nv.png
- http://du#t.cn/static/image/common/pn.png
- http://du#t.cn/static/image/common/newarow.gif
- http://du#t.cn/static/image/common/px.png
- http://www.du#t.cn/images/product/16_thumb.png
- http://du#t.cn/template/default/style/t5/bgimg.jpg
- http://du#t.cn/static/image/common/logo.png
- http://www.du#t.cn/images/product/17_thumb.png
- http://www.du#t.cn/images/product/114_thumb.png
- http://oc##.#ectigo.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRDC9IOTxN6GmyRjyTl2n4yTUczyAQUjYxexFStiuF36Zv5mwXhuAGNYeECEQC0Qli9TtLk8iYY9ZFWbo4Y
- http://du#t.cn/static/image/common/mu_bg.png
- http://www.du#t.cn/theme/default/images/btn_search.gif
- http://www.du#t.cn/theme/default/images/new_top_bg.gif
- http://du#t.cn/data/cache/forum.js?hR#
- http://du#t.cn/source/plugin/drk_ledadv/image/drk_marquee1.js
- http://du#t.cn/data/cache/logging.js?hR#
- http://du#t.cn/data/cache/style_1_forum_index.css?hR#
- http://du#t.cn/data/cache/common.js?hR#
- http://du#t.cn/template/default/style/t5/style.css
- http://du#t.cn/data/cache/style_1_common.css?hR#
- http://www.du#t.cn/theme/default/images/global.js
- http://www.du#t.cn/theme/default/images/slide_show.js
- http://www.du#t.cn/theme/default/images/jquery.min.js
- http://www.du#t.cn/theme/default/style.css
- http://bb#.dult.cn/
- http://www.du#t.cn/theme/default/images/daohanlogo.png
- http://bb#.dult.cn/zthtml/mmkf1.png
- http://bb#.dult.cn/zthtml/eyywg1.png
- http://www.du#t.cn/images/product/21_thumb.png
- http://www.du#t.cn/images/product/20_thumb.png
- http://www.du#t.cn/data/slide/20130514rjzqdt.jpg
- http://du#t.cn/zthtml/jizhi.png
- http://du#t.cn/zthtml/3.png
- http://bb#.dult.cn/zthtml/eyywg5.png
- http://bb#.dult.cn/zthtml/eyywg3.png
- http://du#t.cn/zthtml/ship.png
- http://www.du#t.cn/theme/default/images/weixin.png
- http://du#t.cn/zthtml/shiwu.gif
- http://www.du#t.cn/images/product/25_thumb.png
- http://du#t.cn/zthtml/h7.png
- http://du#t.cn/zthtml/gong.gif
- http://www.du#t.cn/images/zaix.png
- http://du#t.cn/zthtml/162222unjmfctbic5e9mue.png
- http://www.du#t.cn/images/product/19_thumb.png
- http://du#t.cn/static/image/common/folder_new.gif
- http://du#t.cn/zthtml/180302.gif
- http://du#t.cn/static/image/common/dot.gif
- http://du#t.cn/static/image/common/title.png
- http://www.du#t.cn/images/lanmu.png
- http://bb#.dult.cn/zthtml/eyywg4.png
- http://bb#.dult.cn/zthtml/eyywg10.png
- http://bb#.dult.cn/zthtml/eyywg11.png
- http://bb#.dult.cn/zthtml/sheji.jpg
- http://bb#.dult.cn/zthtml/eyywg2.png
- http://du#t.cn/static/image/common/chart.png
- http://du#t.cn/data/cache/common_extra.js?hR#
- http://du#t.cn/static/image/common/pt_item.png
- http://du#t.cn/source/plugin/drk_ledadv/image/drk_led.png
- http://du#t.cn/zthtml/180301.png
- http://www.du#t.cn/images/product/115_thumb.png
- http://bb#.dult.cn/favicon.ico
Other
- 'bb#.125.la':443
- 'du#t.cn':443
UDP
- DNS ASK du#t.cn
- DNS ASK bb#.dult.cn
- DNS ASK bb#.125.la
- DNS ASK ji####hongyou.net
- DNS ASK di###z.gtimg.cn
- DNS ASK we###an.360.cn
- DNS ASK microsoft.com
- DNS ASK oc##.#ectigo.com
Miscellaneous
Searches for the following windows
- ClassName: 'Static' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
