Technical Information
Malicious functions:
To complicate detection of its presence in the operating system,
forces the system hide from view:
- hidden files
- file extensions
Creates and executes the following:
- %TEMP%\nsu5.tmp\ns6.tmp cmd.exe /c regini "<SYSTEM32>\onreg_ok.ini"
- %TEMP%\nsu5.tmp\ns7.tmp cmd.exe /c regini "<SYSTEM32>\offreg_ok.ini"
- %TEMP%\nsm2.tmp\ns3.tmp %TEMP%\init.exe
- %TEMP%\init.exe
Executes the following:
- %PROGRAM_FILES%\Internet Explorer\IEXPLORE.EXE http://%6####.####68%73%69%74%65.%69%6E%66%6F/?i=#########
- %PROGRAM_FILES%\Internet Explorer\IEXPLORE.EXE http://%6####.##4%68%73%69%74%65.info/?i=###########
- %PROGRAM_FILES%\Internet Explorer\IEXPLORE.EXE http://%6####.##4%68%73%69%74%65.info/?i=#############
- <SYSTEM32>\regini.exe "<SYSTEM32>\offreg_ok.ini"
- %PROGRAM_FILES%\Internet Explorer\IEXPLORE.EXE http://%6####.##4%68%73%69%74%65.info/?i=##################################
- %PROGRAM_FILES%\Internet Explorer\IEXPLORE.EXE http://%6####.##4%68%73%69%74%65.info/?i=######
- <SYSTEM32>\regini.exe "<SYSTEM32>\onreg_ok.ini"
Modifies settings of Windows Explorer:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer] 'NoInternetIcon' = '00000000'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoInternetIcon' = '00000000'
Modifies file system :
Creates the following files:
- %HOMEPATH%\Favorites\ЙМТµµјєЅ.url
- %HOMEPATH%\Favorites\ГАЕ®КУЖµ.url
- %HOMEPATH%\Favorites\КЦ»ъЧЈёЈ.url
- %HOMEPATH%\Favorites\НшЦ·ґуИ«.url
- %HOMEPATH%\Favorites\МФ±¦№єОп.url
- %HOMEPATH%\Favorites\»ўДкФЛіМ.url
- %WINDIR%\myfav\Links\Windows.url
- %WINDIR%\myfav\Links\Windows Media.url
- %HOMEPATH%\Favorites\°ЛШФЙ«Нј.url
- %HOMEPATH%\Favorites\ёцРФЗ©Гы.url
- %HOMEPATH%\Favorites\ІШН·К«ґК.url
- %HOMEPATH%\Favorites\Фµ·ЦЕд¶Ф.url
- %HOMEPATH%\Favorites\БґЅУ\МФ±¦№єОп.url
- %HOMEPATH%\Favorites\БґЅУ\КЦ»ъЧЈёЈ.url
- %HOMEPATH%\Favorites\БґЅУ\НшЦ·ґуИ«.url
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\go.dhsite[2]
- %HOMEPATH%\Favorites\БґЅУ\Фµ·ЦЕд¶Ф.url
- %HOMEPATH%\Favorites\БґЅУ\ЙМТµµјєЅ.url
- %HOMEPATH%\Favorites\БґЅУ\ІШН·К«ґК.url
- %HOMEPATH%\Favorites\БґЅУ\°ЛШФЙ«Нј.url
- %HOMEPATH%\Favorites\БґЅУ\ёцРФЗ©Гы.url
- %HOMEPATH%\Favorites\БґЅУ\ГАЕ®КУЖµ.url
- %HOMEPATH%\Favorites\БґЅУ\»ўДкФЛіМ.url
- %WINDIR%\myfav\Links\Windows Marketplace.url
- <SYSTEM32>\onreg_ok.ini
- <SYSTEM32>\cccc.ico
- <SYSTEM32>\offreg_ok.ini
- <SYSTEM32>\tan.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\go.dhsite[1]
- <SYSTEM32>\taobao.ico
- %TEMP%\nsm2.tmp\System.dll
- %TEMP%\nsm2.tmp\time.dll
- %TEMP%\init.exe
- %TEMP%\nsm2.tmp\ns3.tmp
- %TEMP%\nsm2.tmp\nsExec.dll
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\go.dhsite[1]
- %WINDIR%\myfav\MSN.com.url
- %WINDIR%\myfav\Desktop.ini
- %WINDIR%\myfav\Radio Station Guide.url
- %WINDIR%\myfav\Links\Free Hotmail.url
- %WINDIR%\myfav\Links\Customize Links.url
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\go.dhsite[2]
- %TEMP%\nsm2.tmp\Math.dll
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\go.dhsite[1]
- %TEMP%\nsm2.tmp\InetLoad.dll
- %TEMP%\0
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\31recall[1].htm
Deletes the following files:
- %TEMP%\nsm2.tmp\ns3.tmp
- %TEMP%\init.exe
- <SYSTEM32>\onreg_ok.ini
- <SYSTEM32>\offreg_ok.ini
Network activity:
Connects to:
- 'do##.##ayertoday.info':80
- 'localhost':1046
- 'localhost':1048
- 'localhost':1043
- 'localhost':1037
- 'localhost':1038
- 'go.##site.info':80
TCP:
HTTP GET requests:
- go.##site.info/?i=###########
- go.##site.info/?i=#############
- go.##site.info/?i=#########
- go.##site.info/?i=######
- go.##site.info/?i=################################
UDP:
- DNS ASK do##.##ayertoday.info
- DNS ASK go.##site.info
Miscellaneous:
Searches for the following windows:
- ClassName: 'MS_WebcheckMonitor' WindowName: ''
- ClassName: '#32770' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: '' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
