Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] '' = '%PROGRAM_FILES%\shayan-cracker\Nhspy Server.exe'
Malicious functions:
Creates and executes the following:
- %PROGRAM_FILES%\shayan-cracker\Nhspy Server.exe
Terminates or attempts to terminate
the following user processes:
- YahooMessenger.exe
- firefox.exe
Modifies file system :
Creates the following files:
- %PROGRAM_FILES%\shayan-cracker\msvbvm60.dll
- %PROGRAM_FILES%\shayan-cracker\msado20.tlb
- %PROGRAM_FILES%\shayan-cracker\Comdlg32.ocx
- %PROGRAM_FILES%\shayan-cracker\oleaut32.dll
- %PROGRAM_FILES%\shayan-cracker\SETUP1.EXE
- %PROGRAM_FILES%\shayan-cracker\password.txt
- %PROGRAM_FILES%\shayan-cracker\olepro32.dll
- %PROGRAM_FILES%\shayan-cracker\COMCAT.DLL
- %PROGRAM_FILES%\shayan-cracker\stdole2.tlb
- %PROGRAM_FILES%\shayan-cracker\ST6UNST.EXE
- %PROGRAM_FILES%\shayan-cracker\shayan-cracker.exe
- %PROGRAM_FILES%\shayan-cracker\VB6STKIT.DLL
- %PROGRAM_FILES%\shayan-cracker\asycfilt.dll
- %PROGRAM_FILES%\shayan-cracker\PDataBass.xml
- %PROGRAM_FILES%\shayan-cracker\Nhspy Server.exe
Network activity:
Connects to:
- 'op#####e.nimbuzz.com':5222
UDP:
- DNS ASK op#####e.nimbuzz.com
Miscellaneous:
Searches for the following windows:
- ClassName: 'Indicator' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'EDIT' WindowName: ''
