Technical Information
Malicious functions:
Executes the following:
- '%TEMP%\~nsuA.tmp\Un_A.exe' _?=<Current directory>\
Modifies file system:
Creates the following files:
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\cmi.ironbeast[1].htm
- %TEMP%\nsh4.tmp\inetc.dll
- %TEMP%\~nsuA.tmp\Un_A.exe
Deletes the following files:
- %TEMP%\nsh4.tmp\inetc.dll
- %TEMP%\nsr3.tmp
Deletes itself.
Network activity:
Connects to:
- 'cm#.##onbeast.io':80
TCP:
HTTP POST requests:
- http://cm#.##onbeast.io/
UDP:
- DNS ASK cm#.##onbeast.io
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: ''
