Benign Download

Trojan.Win32.Qhost.knd

Bulk hosts block of security domainsSecurity domain points at attacker IP

SHA-256e12b90f6af5937ebabefa498ee8773d2e6cf0af05d00450ef1255aa6a3b1fda2

Evidence

Loopback hosts redirect entry lines 1–19

0.0.1       v.onondown.com.cn
0.0.2       ymsdasdw1.cn
0.0.3       h96b.info
0.0.1       va9sdhun23.cn
0.0.2       bnasnd83nd.cn
0.0.3       adlaji.cn
0.0.1       858656.com
1.1.1       bnasnd83nd.cn
0.0.1       my123.com
0.0.0       user1.12-27.net
0.0.1       8749.com
0.0.0       fengent.cn
0.0.1       4199.com
0.0.1       user1.16-22.net
0.0.1       7379.com
0.0.1       2be37c5f.3f6e2cc5f0b.com
0.0.1       7255.com
0.0.1       user1.23-12.net
0.0.1       3448.com
 …

Chinese AV domain redirect target lines 2517–2554

⋯5 lines
2522
2523127.0.0.1       www.cnooo.com
2524219.235.3.16    search.114.vnet.cn
2525219.235.3.16    keyword.vnet.cn
2526219.235.3.16    www.360safe.com
2527219.235.3.16    www.k369.com
2528219.235.3.16    www.5566.net
2529219.235.3.16    360safe.com
2530202.165.102.243    update.360safe.com
2531219.235.3.16    dl.360safe.com
2532219.235.3.16    down.360safe.com
2533219.235.3.16    bbs.360safe.com
2534219.235.3.16    kaba.360safe.com
2535219.235.3.16    baike.360safe.com
2536219.235.3.16    www.360.cn
2537219.235.3.16    360.cn
2538219.235.3.16    wopti.360.cn
⋯6 lines
2545219.235.3.16    360.qihoo.com
2546219.235.3.16    360safe.qihoo.com
2547219.235.3.16    forum.ikaka.com
2548219.235.3.16    www.ikaka.com
2549202.165.102.243 update.ikaka.com
⋯5 lines