Technical Information
Malicious functions:
Creates and executes the following:
- '%CommonProgramFiles%\Microsoft Shared\MSInfo\Nuoyun.exe'
Executes the following:
- '<SYSTEM32>\cmd.exe' /c "%CommonProgramFiles%\Microsoft Shared\MSINFO\Nuoyun.bat"
Modifies file system:
Creates the following files:
- %CommonProgramFiles%\Microsoft Shared\MSInfo\Nuoyun.bat
- %CommonProgramFiles%\Microsoft Shared\MSInfo\Nuoyun.exe
Sets the 'hidden' attribute to the following files:
- %CommonProgramFiles%\Microsoft Shared\MSInfo\Nuoyun.exe
Deletes itself.
Network activity:
Connects to:
- '21#.#33.160.130':8010
UDP:
- DNS ASK .#.
Miscellaneous:
Searches for the following windows:
- ClassName: 'MS_WINHELP' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
