Technical Information
Malicious functions:
Creates and executes the following:
- '%TEMP%\nso3.tmp\SecurityScan_release_small.exe'
- '%TEMP%\nso3.tmp\checker.exe'
- '%TEMP%\nso3.tmp\SecurityScan_release_small.exe' (downloaded from the Internet)
Modifies file system :
Creates the following files:
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\SecurityScan_release_small[1].exe
- %TEMP%\nso3.tmp\SecurityScan_release_small.exe
- %TEMP%\nso3.tmp\inetc.dll
- %TEMP%\nso2.tmp
- %TEMP%\nso3.tmp\checker.exe
Deletes the following files:
- %TEMP%\nso3.tmp\SecurityScan_release_small.exe
- %TEMP%\nso3.tmp\inetc.dll
- %TEMP%\nso3.tmp\checker.exe
Network activity:
Connects to:
- 'dc###.4shared.com':80
- 'www.up###esrv.com':80
TCP:
HTTP GET requests:
- dc###.4shared.com/download/Tfu7lKJV/SecurityScan_release_small.exe
HTTP POST requests:
- www.up###esrv.com/c/r/0/347778/
UDP:
- DNS ASK dc###.4shared.com
- DNS ASK www.up###esrv.com
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
