Technical Information
To ensure autorun and distribution:
Creates or modifies the following files:
- %WINDIR%\Tasks\{791AC611-F2FD-40AE-9864-AB0C65F53148}.job
Malicious functions:
Creates and executes the following:
- '%TEMP%\<File name>.exe' /ver 1.1.5.26 e /fi {4328DE60-8A31-4FA1-88AB-F00C66E996BB}.txt
- '%TEMP%\nsv3.tmp\amisid.exe'
- '' (downloaded from the Internet)
Modifies file system:
Creates the following files:
- %TEMP%\taskSched.txt
- %TEMP%\<File name>.exe
- %TEMP%\nsq2.tmp
Deletes the following files:
- %TEMP%\nsv3.tmp\NSIS_TaskScheduler.dll
- %TEMP%\nsv3.tmp\NSIS_AntiVmFraud.dll
- %TEMP%\nsv3.tmp\System.dll
- %TEMP%\nsv3.tmp\registry.dll
- %TEMP%\nsv3.tmp\nsisos.dll
- %TEMP%\nsv3.tmp\amisid.exe
- %WINDIR%\Tasks\{791AC611-F2FD-40AE-9864-AB0C65F53148}.job
- %TEMP%\nsv3.tmp\md5dll.dll
- %TEMP%\nsv3.tmp\inetc.dll
Network activity:
Connects to:
- 'www.eg###dx.tech':80
TCP:
HTTP GET requests:
- http://www.eg###dx.tech/info.php?id######################################
UDP:
- DNS ASK www.eg###dx.tech
