Trojan.Click3.32429

Техническая информация

Вредоносные функции

Запускает на исполнение

'%ProgramFiles%\internet explorer\iexplore.exe' http://www.2345.com/?33772

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе

Создает следующие файлы

%APPDATA%\microsoft\windows\privacie\index.dat
%LOCALAPPDATA%\microsoft\windows\history\history.ie5\mshist012024082620240827\index.dat

Сетевая активность

Подключается к

'23##.com':80
'pa######-plugin.hao184.com':443
'cb##.baidu.com':443
'cp##.##idustatic.com':443
'cp##.##idustatic.com':80
'ww####n.2345cdn.net':443
'ww#####eam.2345cdn.net':443
'pa######-plugin.hao184.com':80
'ww#####eam.2345cdn.net':80
'we#.##bangzh.com':443
'we#.##bangzh.com':80
'oc##.##ust-provider.cn':80
'h.###5cdn.net':443
'h.###5cdn.net':80
'23##.com':443
'ww####n.2345cdn.net':80
'oc##.##ctigochina.com':80

TCP

Запросы HTTP GET

http://www.23##.com/?33###
http://cp##.##idustatic.com/cpro/ui/cm.js
http://pa######-plugin.hao184.com/statistics-report/v2.1.js
http://oc##.##ust-provider.cn/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBQIzuhSh8YGNy3SuMUAiCzbrW1YlAQUQDAii40qMin4ECENAGNeRdMs4CUCEQD68KlP3dYU%2B0EiScUwc%2FUy
http://oc##.##ctigochina.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBThTYZNoiHf%2FXYqfP6k4PpIrh4zowQUM2pQsuzMQCwNrLVVQi%2FRH9O5ybACEQDeSX1gluhwqsnZFQ77GYeX
http://h.###5cdn.net/js/index/statistics_report-279b5e61c3.js
http://h.###5cdn.net/js/index/input_20210414_v3-f458576dfc.js?v=########
http://h.###5cdn.net/js/index/baidu_20201208_v3-dcc6817889.js?v=########
http://ww#####eam.2345cdn.net/backStageImg/upload/2021/5ce1aef23046814cf16fe5cffbb4ad45.gif
http://h.###5cdn.net/js/index/bd_words_v3_20210817-3ede4333c5.js?v=########
http://h.###5cdn.net/js/index/report360-971b38479a.js
http://h.###5cdn.net/js/index/func_abtest-20fae1dfa9.js?v=########
http://h.###5cdn.net/js/index/cnxh/common-ff3bb58d30.js
http://h.###5cdn.net/js/index/tianqi-cd7b30bea8.js?v=########
http://h.###5cdn.net/js/index/ui_v3-aeebe1f000.js?v=########
http://h.###5cdn.net/js/index/cnxh/index_v3-07aa61ca88.js
http://h.###5cdn.net/js/index/module_20201210_abtest-2b4e6cbc80.js?v=########
http://h.###5cdn.net/js/base64-5bca38624a.min.js
http://h.###5cdn.net/js/index/report-78677e5cc9.js
http://h.###5cdn.net/js/moment-6e68074f83.min.js
http://h.###5cdn.net/js/index/common_js-70843daa51.js?v=###
http://h.###5cdn.net/js/index/public-db6736da96.js?v=########
http://oc##.##ust-provider.cn/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTRK6%2BKMEm7xEAA7oRlXypSzGx%2FAgQUyPPFCRszol%2BmEquQ1gC2XPyNHAYCEGEnzfGySRQDCduSYeFU5Bg%3D
http://h.###5cdn.net/right/homepage/zjsVer2.js?t=########
http://h.###5cdn.net/css/index_v1-18509e6dbb.2_20210817_v3.css?v=###
http://h.###5cdn.net/resource/api/zjsVer2.js?t=########
http://h.###5cdn.net/i/blank.png
http://we#.##bangzh.com/web/ajax25?uI############################################################################################################################################################...
http://h.###5cdn.net/i/search20200812/idx-1.png
http://h.###5cdn.net/js/index/performance_20200811-c38e87f786.js
http://h.###5cdn.net/js/index/zoom-4d59d24260.js
http://www.23##.com/resource/i/2020/03/17/19e3500cc7cf9c03f9e2847cdcb8f3a6.png
http://h.###5cdn.net/images/logo.png
http://h.###5cdn.net/js/jquery-1.8-dd39d1759b.3.min.js
http://ww####n.2345cdn.net/dhrest/upload/2022/e0af0b4365b83c8fdf16475766116d29.jpg
http://ww####n.2345cdn.net/dhrest/upload/2022/45dff259d046032205cad480f6b7912c.png
http://ww####n.2345cdn.net/dhrest/upload/2022/1fdda329753f9a6490040a38fccf81f0.jpg
http://h.###5cdn.net/js/jquery-287fd3cff5.xdomainrequest.min.js
http://h.###5cdn.net/js/index/config_js-ab3ffdf9d2.js
http://h.###5cdn.net/js/lib/js-a93551cfaf.cookie.js
http://ww#####eam.2345cdn.net/backStageImg/upload/2021/a4da7793eb103d4536581b8523a802dc.png
http://ww####n.2345cdn.net/dhrest/upload/2022/ea9d8504a045ed5408176b901cc4e524.png