Technical Information
Malicious functions:
Creates and executes the following:
- '%TEMP%\INSTALL.EXE'
- '%TEMP%\nsy3.tmp\ns4.tmp' "CMD.EXE" /c %TEMP%\INSTALL.EXE"
- '%TEMP%\INSTALL.EXE' (downloaded from the Internet)
Executes the following:
- '<SYSTEM32>\chcp.com' 1251
- '<SYSTEM32>\cmd.exe' /c 1.bat
Modifies file system :
Creates the following files:
- %TEMP%\nsy3.tmp\ns4.tmp
- %TEMP%\nsy3.tmp\System.dll
- <Current directory>\1.bat
- %TEMP%\nsy3.tmp\nsExec.dll
- %TEMP%\nsy2.tmp
- %TEMP%\nsy3.tmp\nsisdl.dll
- %TEMP%\INSTALL.CAB
Deletes the following files:
- %TEMP%\nsy3.tmp\nsisdl.dll
- %TEMP%\nsy3.tmp\System.dll
- %TEMP%\nsy3.tmp\ns4.tmp
- %TEMP%\nsy3.tmp\nsExec.dll
Moves the following files:
- from %TEMP%\INSTALL.CAB to %TEMP%\INSTALL.EXE
Deletes itself.
Network activity:
Connects to:
- 'so####900098900.com':80
TCP:
HTTP GET requests:
- so####900098900.com/files/install.cab
UDP:
- DNS ASK so####900098900.com
