Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\RunOnce] 'svnhost.exe' = '%APPDATA%\LocalNTData\svnhost.exe'
Modifies file system:
Creates the following files:
- %TEMP%\NS-TJOOT.tmp\NS-FRF3E.tmp
- %TEMP%\NS-6I3S7.tmp\_shfoldr.dll
- %TEMP%\NS-6I3S7.tmp\_iscrypt.dll
- %TEMP%\NS-6I3S7.tmp\UPD\NS-G6T01.tmp
- %TEMP%\NS-6I3S7.tmp\UPD\NS-BJ57D.tmp
- %TEMP%\NS-6I3S7.tmp\UPD\NS-F2BHH.tmp
- %TEMP%\NS-6I3S7.tmp\UPD\NS-RL4UB.tmp
- %TEMP%\NS-6I3S7.tmp\UPD\NS-QND1K.tmp
- %TEMP%\NS-6I3S7.tmp\UPD\NS-N3B2A.tmp
- %APPDATA%\LocalNTData\svnhost.exe
- %APPDATA%\LocalNTData\TeamViewer.ini
- %APPDATA%\LocalNTData\Teamviewer_Resource_en.dll
- %APPDATA%\LocalNTData\tv.dll
- %APPDATA%\LocalNTData\tv.ini
- %APPDATA%\LocalNTData\updatecache.bat
Deletes the following files:
- %TEMP%\NS-6I3S7.tmp\UPD\svnhost.exe
- %TEMP%\NS-6I3S7.tmp\UPD\TeamViewer.ini
- %TEMP%\NS-6I3S7.tmp\UPD\Teamviewer_Resource_en.dll
- %TEMP%\NS-6I3S7.tmp\UPD\tv.dll
- %TEMP%\NS-6I3S7.tmp\UPD\tv.ini
- %TEMP%\NS-6I3S7.tmp\UPD\updatecache.bat
- %TEMP%\NS-6I3S7.tmp\_iscrypt.dll
- %TEMP%\NS-6I3S7.tmp\_shfoldr.dll
- %TEMP%\NS-TJOOT.tmp\NS-FRF3E.tmp
Moves the following files:
- from %TEMP%\NS-6I3S7.tmp\UPD\NS-G6T01.tmp to %TEMP%\NS-6I3S7.tmp\UPD\svnhost.exe
- from %TEMP%\NS-6I3S7.tmp\UPD\NS-BJ57D.tmp to %TEMP%\NS-6I3S7.tmp\UPD\TeamViewer.ini
- from %TEMP%\NS-6I3S7.tmp\UPD\NS-F2BHH.tmp to %TEMP%\NS-6I3S7.tmp\UPD\Teamviewer_Resource_en.dll
- from %TEMP%\NS-6I3S7.tmp\UPD\NS-RL4UB.tmp to %TEMP%\NS-6I3S7.tmp\UPD\tv.dll
- from %TEMP%\NS-6I3S7.tmp\UPD\NS-QND1K.tmp to %TEMP%\NS-6I3S7.tmp\UPD\tv.ini
- from %TEMP%\NS-6I3S7.tmp\UPD\NS-N3B2A.tmp to %TEMP%\NS-6I3S7.tmp\UPD\updatecache.bat
Network activity:
Connects to:
- 'pi###.dyngate.com':5938
- 'ma#####.teamviewer.com':80
- 'ma####.dyngate.com':80
- 'pi###.dyngate.com':80
TCP:
HTTP GET requests:
- http://ma#####.teamviewer.com/din.aspx?s=################################################
- http://ma####.dyngate.com/din.aspx?s=################################################
- http://pi###.dyngate.com/din.aspx?s=################################################
UDP:
- DNS ASK pi###.dyngate.com
- DNS ASK ma#####.teamviewer.com
- DNS ASK ma####.dyngate.com
- DNS ASK ma#####0.teamviewer.com
- DNS ASK ma#####1.teamviewer.com
- DNS ASK ma#####2.teamviewer.com
- DNS ASK ma#####3.teamviewer.com
- DNS ASK ma#####4.teamviewer.com
- DNS ASK ma#####5.teamviewer.com
- DNS ASK ma#####6.teamviewer.com
Miscellaneous:
Searches for the following windows:
- ClassName: 'TrayNotifyWnd' WindowName: ''
Creates and executes the following:
- '%TEMP%\NS-TJOOT.tmp\NS-FRF3E.tmp' /SL4 $30092 <Full path to file> 1639500 332288 /password=password /verysilent
- '%APPDATA%\LocalNTData\svnhost.exe'
Executes the following:
- '<SYSTEM32>\cmd.exe' /C ""%TEMP%\NS-6I3S7.tmp\UPD\updatecache.bat""
- '<SYSTEM32>\xcopy.exe' /Y /I "%TEMP%\NS-6I3S7.tmp\UPD\*" "%APPDATA%\LocalNTData\"
