Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'QQ¶Ь' = '%PROGRAM_FILES%\NetMeeting\v32\TXOCInstallUserConfigOE.exe -s'
Malicious functions:
To complicate detection of its presence in the operating system,
forces the system hide from view:
- file extensions
Creates and executes the following:
- %TEMP%\nsd2.tmp\ns9.tmp cmd.exe /c copy /b "%PROGRAM_FILES%\winrar\v32\\sg2.gif"+"%PROGRAM_FILES%\winrar\v32\\shf.dat" "%PROGRAM_FILES%\winrar\v32\\sg.gif" /Y
- %TEMP%\nsd2.tmp\ns8.tmp cmd.exe /c copy /b "%PROGRAM_FILES%\winrar\v32\\360se2.gif"+"%PROGRAM_FILES%\winrar\v32\\shf.dat" "%PROGRAM_FILES%\winrar\v32\\360se.gif" /Y
- %TEMP%\nsd2.tmp\nsA.tmp cmd.exe /c copy /b "%PROGRAM_FILES%\winrar\v32\\tg2.gif"+"%PROGRAM_FILES%\winrar\v32\\shf.dat" "%PROGRAM_FILES%\winrar\v32\\tg.gif" /Y
- %PROGRAM_FILES%\NetMeeting\v32\TXOCInstallUserConfigOE.exe
- %TEMP%\nsd2.tmp\nsB.tmp %PROGRAM_FILES%\NetMeeting\v32\TXOCInstallUserConfigOE.exe
- %TEMP%\nsd2.tmp\ns4.tmp cmd.exe /c copy /b "%PROGRAM_FILES%\winrar\v32\\tb2.gif"+"%PROGRAM_FILES%\winrar\v32\\shf.dat" "%PROGRAM_FILES%\winrar\v32\\tb.gif" /Y
- %TEMP%\nsd2.tmp\ns3.tmp cmd.exe /c time /T > "%PROGRAM_FILES%\winrar\v32\\shf.dat"
- %TEMP%\nsd2.tmp\ns5.tmp cmd.exe /c copy /b "%PROGRAM_FILES%\winrar\v32\\xyx2.gif"+"%PROGRAM_FILES%\winrar\v32\\shf.dat" "%PROGRAM_FILES%\winrar\v32\\xyx.gif" /Y
- %TEMP%\nsd2.tmp\ns7.tmp cmd.exe /c copy /b "%PROGRAM_FILES%\winrar\v32\\ff2.gif"+"%PROGRAM_FILES%\winrar\v32\\shf.dat" "%PROGRAM_FILES%\winrar\v32\\ff.gif" /Y
- %TEMP%\nsd2.tmp\ns6.tmp cmd.exe /c copy /b "%PROGRAM_FILES%\winrar\v32\\ie2.gif"+"%PROGRAM_FILES%\winrar\v32\\shf.dat" "%PROGRAM_FILES%\winrar\v32\\ie.gif" /Y
Executes the following:
- <SYSTEM32>\wscript.exe c:\t163.js
Modifies file system :
Creates the following files:
- %TEMP%\nsd2.tmp\ns4.tmp
- %PROGRAM_FILES%\winrar\v32\shf.dat
- %TEMP%\nsd2.tmp\ns6.tmp
- %TEMP%\nsd2.tmp\ns5.tmp
- %PROGRAM_FILES%\winrar\v32\sg.gif
- %PROGRAM_FILES%\winrar\v32\360se.gif
- %TEMP%\nsd2.tmp\ns3.tmp
- %TEMP%\nsd2.tmp\nsExec.dll
- %TEMP%\nsd2.tmp\ns7.tmp
- %TEMP%\nsd2.tmp\System.dll
- %PROGRAM_FILES%\NetMeeting\v32\Factory.dll
- C:\t163.js
- %TEMP%\nsd2.tmp\nsB.tmp
- %TEMP%\nsd2.tmp\ns9.tmp
- %TEMP%\nsd2.tmp\ns8.tmp
- %PROGRAM_FILES%\NetMeeting\v32\TXOCInstallUserConfigOE.exe
- %TEMP%\nsd2.tmp\nsA.tmp
- %PROGRAM_FILES%\winrar\v32\ff.gif
- %PROGRAM_FILES%\winrar\v32\ФЪПЯСФЗйРЎЛµФД¶Б.url
- %PROGRAM_FILES%\winrar\v32\НЕ№є_ГлЙ±Нш.url
- %PROGRAM_FILES%\winrar\v32\xyx.pat
- %PROGRAM_FILES%\winrar\v32\tb.gif
- %PROGRAM_FILES%\winrar\v32\°¬µПЙо¶ИЛСЛч.url
- %PROGRAM_FILES%\winrar\v32\88yyФЪПЯРЎУОП·.url
- %PROGRAM_FILES%\winrar\v32\МФ±¦МШВф.url
- %PROGRAM_FILES%\winrar\v32\К®Т»ЅЦµҐ»ъУОП·.url
- %PROGRAM_FILES%\winrar\v32\ie.pat
- %PROGRAM_FILES%\winrar\v32\xyx.gif
- %TEMP%\nsd2.tmp\VPatch.dll
- %PROGRAM_FILES%\winrar\v32\tt.gif
- %PROGRAM_FILES%\winrar\v32\ie.gif
- %PROGRAM_FILES%\winrar\v32\ff.pat
- %PROGRAM_FILES%\winrar\v32\tt.pat
- %PROGRAM_FILES%\winrar\v32\sg.pat
- %PROGRAM_FILES%\winrar\v32\360se.pat
Deletes the following files:
- %TEMP%\nsd2.tmp\ns9.tmp
- %TEMP%\nsd2.tmp\ns8.tmp
- %TEMP%\nsd2.tmp\nsA.tmp
- C:\t163.js
- %TEMP%\nsd2.tmp\nsB.tmp
- %TEMP%\nsd2.tmp\ns4.tmp
- %TEMP%\nsd2.tmp\ns3.tmp
- %TEMP%\nsd2.tmp\ns5.tmp
- %TEMP%\nsd2.tmp\ns7.tmp
- %TEMP%\nsd2.tmp\ns6.tmp
Moves the following files:
- from %PROGRAM_FILES%\winrar\v32\ff.gif to %PROGRAM_FILES%\winrar\v32\ff2.gif
- from %PROGRAM_FILES%\winrar\v32\360se.gif to %PROGRAM_FILES%\winrar\v32\360se2.gif
- from %PROGRAM_FILES%\winrar\v32\sg.gif to %PROGRAM_FILES%\winrar\v32\sg2.gif
- from %PROGRAM_FILES%\winrar\v32\tb.gif to %PROGRAM_FILES%\winrar\v32\tb2.gif
- from %PROGRAM_FILES%\winrar\v32\xyx.gif to %PROGRAM_FILES%\winrar\v32\xyx2.gif
- from %PROGRAM_FILES%\winrar\v32\ie.gif to %PROGRAM_FILES%\winrar\v32\ie2.gif
Miscellaneous:
Searches for the following windows:
- ClassName: 'Indicator' WindowName: ''
