Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\Software\Microsoft\Windows\CurrentVersion\RunOnce] '' = '"%APPDATA%\\.exe" /MODE=RUNONCE /DYNAMIC='
Modifies file system
Creates the following files
- %TEMP%\nsm4f49.tmp\ipconfig.dll
- %TEMP%\nsm4f49.tmp\av.vbs
- %TEMP%\nsmc83f.tmp\request.txt
- %TEMP%\nsmc83f.tmp\inetc.dll
- %TEMP%\nsmc83f.tmp\threadtimer.dll
- %TEMP%\nsmc83f.tmp\userinfo.dll
- %TEMP%\nsmc83f.tmp\system.dll
- %TEMP%\nsm4f49.tmp\nsweb.dll
- %TEMP%\nsmc83f.tmp\ipconfig.dll
- %TEMP%\nsm4f49.tmp\registry.dll
- %APPDATA%\.exe
- %TEMP%\nsm4f49.tmp\tmp_13242.txt
- %TEMP%\nsm4f49.tmp\inetc.dll
- %TEMP%\nsm4f49.tmp\userinfo.dll
- %TEMP%\nsm4f49.tmp\system.dll
- %TEMP%\nsm4f49.tmp\nsexec.dll
- %LOCALAPPDATA%\microsoft\internet explorer\domstore\w37zlxnl\www.amazon[1].xml
Deletes the following files
- %TEMP%\nsmc83f.tmp\request.txt
Substitutes the following files
- %TEMP%\nsmc83f.tmp\request.txt
Network activity
TCP
HTTP GET requests
- http://ht##.###dyhddownload.com/installer/requestid.php?ui#######
- http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt
- http://ht##.###dyhddownload.com/harvester.php?ap################################################################################
- http://ht##.###dyhddownload.com/installer/pop_request.php?dy###############################
- http://ht##.###dyhddownload.com/harvester.php?ap#########################################################################################
- http://ht##.###dyhddownload.com/harvester.php?ap############################################################################################
- http://ht##.###dyhddownload.com/installer/installer.php?dy#######################################################################################################################################...
- http://x.##2.us/x.cer
- http://ht##.###dyhddownload.com/installer/pop_request.php?dy################################
- http://o.##2.us//MEowSDBGMEQwQjAJBgUrDgMCGgUABBSLwZ6EW5gdYc9UaSEaaLjjETNtkAQUv1%2B30c7dH4b0W1Ws3NcQwg6piOcCCQCnDkpMNIK3fw%3D%3D
UDP
- DNS ASK ht##.###dyhddownload.com
- DNS ASK am##on.com
- DNS ASK microsoft.com
- DNS ASK im#######.ssl-images-amazon.com
- DNS ASK m.####a-amazon.com
- DNS ASK fl####.amazon.com
- DNS ASK x.##2.us
- DNS ASK st####.rapidssl.com
- DNS ASK o.##2.us
Miscellaneous
Searches for the following windows
- ClassName: '#32770' WindowName: ''
- ClassName: 'SysListView32' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
Creates and executes the following
- '%WINDIR%\syswow64\cscript.exe' //NoLogo "%TEMP%\nsm4F49.tmp\av.vbs"
- '%WINDIR%\syswow64\wbem\wmic.exe' OS Get SerialNumber /FORMAT:textvaluelist.xsl' (with hidden window)
- '%WINDIR%\syswow64\wbem\wmic.exe' OS Get Caption /FORMAT:textvaluelist.xsl' (with hidden window)
- '%WINDIR%\syswow64\wbem\wmic.exe' OS Get CSName /FORMAT:textvaluelist.xsl' (with hidden window)
- '%WINDIR%\syswow64\wbem\wmic.exe' OS Get InstallDate /FORMAT:textvaluelist.xsl' (with hidden window)
- '%WINDIR%\syswow64\wbem\wmic.exe' OS Get OsArchitecture /FORMAT:textvaluelist.xsl' (with hidden window)
- '%WINDIR%\syswow64\wbem\wmic.exe' OS Get OsLanguage /FORMAT:textvaluelist.xsl' (with hidden window)
- '%WINDIR%\syswow64\wbem\wmic.exe' OS Get Version /FORMAT:textvaluelist.xsl' (with hidden window)
- '%WINDIR%\syswow64\wbem\wmic.exe' OS Get WindowsDirectory /FORMAT:textvaluelist.xsl' (with hidden window)
- '%WINDIR%\syswow64\cscript.exe' //NoLogo "%TEMP%\nsm4F49.tmp\av.vbs"' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\wbem\wmic.exe' OS Get SerialNumber /FORMAT:textvaluelist.xsl
- '%WINDIR%\syswow64\wbem\wmic.exe' OS Get Caption /FORMAT:textvaluelist.xsl
- '%WINDIR%\syswow64\wbem\wmic.exe' OS Get CSName /FORMAT:textvaluelist.xsl
- '%WINDIR%\syswow64\wbem\wmic.exe' OS Get InstallDate /FORMAT:textvaluelist.xsl
- '%WINDIR%\syswow64\wbem\wmic.exe' OS Get OsArchitecture /FORMAT:textvaluelist.xsl
- '%WINDIR%\syswow64\wbem\wmic.exe' OS Get OsLanguage /FORMAT:textvaluelist.xsl
- '%WINDIR%\syswow64\wbem\wmic.exe' OS Get Version /FORMAT:textvaluelist.xsl
- '%WINDIR%\syswow64\wbem\wmic.exe' OS Get WindowsDirectory /FORMAT:textvaluelist.xsl
