Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'TNBoxAgent' = '%ProgramFiles%\TNBoxAgent\TLoader.exe /boot'
Modifies file system:
Creates the following files:
- %APPDATA%\TN_client_ver.ini
- %ProgramFiles%\TNBoxAgent\TNBoxClient.ico
- %ProgramFiles%\TNBoxAgent\msvcr71.dll
- %ProgramFiles%\TNBoxAgent\dbghelp.dll
- %ProgramFiles%\TNBoxAgent\TNBoxAgent.exe
- %ProgramFiles%\TNBoxAgent\TLoader.exe
- %ProgramFiles%\TNBoxAgent\kor_res.dll
- %HOMEPATH%\Start Menu\Programs\TNBoxAgent\Uninstall.lnk
- %HOMEPATH%\Start Menu\Programs\TNBoxAgent\TNBoxAgent.lnk
- %HOMEPATH%\Desktop\TNBox.url
- %ProgramFiles%\TNBoxAgent\uninst.exe
- %HOMEPATH%\Desktop\TNBoxAgent.lnk
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\TN_client_ver[1].ini
- %TEMP%\tn\TN_client_ver.ini
Deletes the following files:
- %TEMP%\nsu2.tmp\nsProcess.dll
- %TEMP%\nsu2.tmp\System.dll
- %TEMP%\tn\TN_client_ver.ini
Network activity:
Connects to:
- 'tn##x.net':80
TCP:
HTTP GET requests:
- http://www.tn##x.net/pub/download/TN_client_ver.ini via tn##x.net
UDP:
- DNS ASK www.tn##x.net
Miscellaneous:
Creates and executes the following:
- '%ProgramFiles%\TNBoxAgent\TLoader.exe' /hide
