Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Userinit' = '<SYSTEM32>\userinit.exe,<SYSTEM32>\nse3tmp\nso2tmp.exe -sa=log'
Malicious functions:
To complicate detection of its presence in the operating system,
forces the system hide from view:
- file extensions
Creates and executes the following:
- '%TEMP%\nsz5.tmp\ns8.tmp' cmd.exe /c wscript.exe "<LS_APPDATA>\Temp\rang.vbs"
- '%TEMP%\nsz5.tmp\ns7.tmp' cmd.exe /c wscript.exe "<LS_APPDATA>\Temp\safeme.js"
- '%TEMP%\nsz5.tmp\ns6.tmp' cmd.exe /c taskkill.exe /f /im zhudongfangyu.exe
Executes the following:
- '<SYSTEM32>\wscript.exe' "<LS_APPDATA>\Temp\rang.vbs"
- '<SYSTEM32>\ping.exe' 127.0.0.1 -n 6
- '<SYSTEM32>\wscript.exe' c:\safelog.js"
- '<SYSTEM32>\taskkill.exe' /f /im zhudongfangyu.exe
- '<SYSTEM32>\wscript.exe' "<LS_APPDATA>\Temp\safeme.js"
Modifies file system :
Creates the following files:
- %HOMEPATH%\Favorites\МФ±¦МШВф.url
- %HOMEPATH%\Favorites\К®Т»ЅЦµҐ»ъУОП·.url
- %HOMEPATH%\Favorites\НЕ№є_ГлЙ±Нш.url
- %TEMP%\nsz5.tmp\ShellLink.dll
- %HOMEPATH%\Favorites\ФЪПЯСФЗйРЎЛµФД¶Б.url
- %HOMEPATH%\Favorites\°¬µПЙо¶ИЛСЛч.url
- %HOMEPATH%\Favorites\БґЅУ\МФ±¦МШВф.url
- %HOMEPATH%\Favorites\БґЅУ\К®Т»ЅЦµҐ»ъУОП·.url
- %HOMEPATH%\Favorites\БґЅУ\НЕ№є_ГлЙ±Нш.url
- %HOMEPATH%\Favorites\88yyФЪПЯРЎУОП·.url
- %HOMEPATH%\Favorites\БґЅУ\ФЪПЯСФЗйРЎЛµФД¶Б.url
- %ALLUSERSPROFILE%\Desktop\Internet Explorer.exe
- %TEMP%\nsz5.tmp\ns7.tmp
- %TEMP%\nsz5.tmp\ns8.tmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\index14[1].htm
- <SYSTEM32>\ShowDisktop.SCF
- %ALLUSERSPROFILE%\Desktop\IESafe.lnk
- %ALLUSERSPROFILE%\Desktop\НшЙПМФ±¦.exe
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.exe
- %ALLUSERSPROFILE%\Desktop\ФЪПЯРЎУОП·.exe
- %TEMP%\nsz5.tmp\ns6.tmp
- %TEMP%\nsz5.tmp\nsExec.dll
- <LS_APPDATA>\Temp\360se.pat
- <LS_APPDATA>\Temp\ff.pat
- <LS_APPDATA>\Temp\sg.pat
- <LS_APPDATA>\Temp\safeme.js
- <LS_APPDATA>\Temp\jia.reg
- <LS_APPDATA>\Temp\tt.pat
- <SYSTEM32>\nsu4tmp\nso2tmp.exe
- %TEMP%\nsz5.tmp\System.dll
- <LS_APPDATA>\Temp\tb.gif
- <LS_APPDATA>\Temp\ie.pat
- <LS_APPDATA>\Temp\xyx.pat
- <LS_APPDATA>\Temp\sg.gif
- <LS_APPDATA>\Temp\360se.gif
- C:\safelog.js
- %HOMEPATH%\Favorites\БґЅУ\°¬µПЙо¶ИЛСЛч.url
- %HOMEPATH%\Favorites\БґЅУ\88yyФЪПЯРЎУОП·.url
- <LS_APPDATA>\Temp\ff.gif
- %TEMP%\nsz5.tmp\VPatch.dll
- <LS_APPDATA>\Temp\rang.vbs
- <LS_APPDATA>\Temp\xyx.gif
- <LS_APPDATA>\Temp\tt.gif
- <LS_APPDATA>\Temp\ie.gif
Deletes the following files:
- %TEMP%\nsz5.tmp\ShellLink.dll
- %TEMP%\nsz5.tmp\nsExec.dll
- %TEMP%\nsz5.tmp\VPatch.dll
- %TEMP%\nsz5.tmp\System.dll
- %TEMP%\nsz5.tmp\ns8.tmp
- %TEMP%\nsz5.tmp\ns7.tmp
- %TEMP%\nsz5.tmp\ns6.tmp
- %ALLUSERSPROFILE%\Desktop\IESafe.lnk
- C:\safelog.js
Deletes itself.
Network activity:
Connects to:
- 'ww#.cz3.net':80
- 'localhost':1036
TCP:
HTTP GET requests:
- ww#.cz3.net/index14.htm
UDP:
- DNS ASK ww#.cz3.net
Miscellaneous:
Searches for the following windows:
- ClassName: 'IEFrame' WindowName: '(null)'
- ClassName: 'MS_AutodialMonitor' WindowName: '(null)'
- ClassName: 'MS_WebcheckMonitor' WindowName: '(null)'
- ClassName: '(null)' WindowName: '(null)'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: '' WindowName: '(null)'
