Technical Information
Malicious functions
To bypass firewall, removes or modifies the following registry keys
- [<HKLM>\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%TEMP%\nsg3.tmp\Statistics.exe' = '%TEMP%\nsg3.tmp\Statistics.exe:...
Modifies file system
Creates the following files
- %TEMP%\nsm2.tmp
- %TEMP%\nsg3.tmp\pic\onekey.png
- %TEMP%\nsg3.tmp\pic\shadow_active.png
- %TEMP%\nsg3.tmp\pic\shadow_deactive.png
- %TEMP%\nsg3.tmp\pic\slogan.png
- %TEMP%\nsg3.tmp\pic\logo.png
- %TEMP%\nsg3.tmp\pic\minimize.png
- %TEMP%\nsg3.tmp\iospecial.ini
- %TEMP%\nsg3.tmp\modern-wizard.bmp
- %TEMP%\nsg3.tmp\pic\weakbtn.png
- %TEMP%\nsg3.tmp\pic\strongbtn.png
- %TEMP%\nsg3.tmp\pcmgrdlcore.zip
- %ALLUSERSPROFILE%\application data\mon_pro.ini
- %TEMP%\nsg3.tmp\bugreport.exe
- %TEMP%\nsg3.tmp\dlcore.dll
- %TEMP%\nsg3.tmp\dr.dll
- %HOMEPATH%\local settings\<INETFILES>\content.ie5\etuaii8e\mon_inst[1].ini
- %ALLUSERSPROFILE%\application data\mon_inst.ini
- %HOMEPATH%\local settings\<INETFILES>\content.ie5\ee7gwdg8\ckvcollect[1].gif
- %HOMEPATH%\local settings\<INETFILES>\content.ie5\ee7gwdg8\getomgid[1].1&os=3
- %APPDATA%\tencent\qqlive\config.ini
- %HOMEPATH%\local settings\<INETFILES>\content.ie5\h8mbgrq8\mon_pro[1].ini
- %TEMP%\nsg3.tmp\pic\express.png
- %TEMP%\nsg3.tmp\pic\full_bg.png
- %TEMP%\nsg3.tmp\pic\empty_bg.png
- %APPDATA%\tencent\qqlive\log\qqliveinstall.log
- %TEMP%\nsg3.tmp\procdll.dll
- %APPDATA%\tencent\omgcache\user.ini
- %TEMP%\nsg3.tmp\system.dll
- %APPDATA%\tencent\qqlive\user.ini
- %TEMP%\nsg3.tmp\statistics.exe
- %TEMP%\nsg3.tmp\pic\bg1.png
- %TEMP%\nsg3.tmp\pic\bg2.png
- %TEMP%\nsg3.tmp\pic\bg3.png
- %TEMP%\nsg3.tmp\installhelper.dll
- %TEMP%\nsg3.tmp\pic\bg4.png
- %TEMP%\nsg3.tmp\pic\installingbg02.png
- %TEMP%\nsg3.tmp\pic\installingbg03.png
- %TEMP%\nsg3.tmp\pic\installingbg04.png
- %TEMP%\nsg3.tmp\pic\installingbg05.png
- %TEMP%\nsg3.tmp\pic\installingbg06.png
- %TEMP%\nsg3.tmp\pic\browse.png
- %TEMP%\nsg3.tmp\pic\checkbox.png
- %TEMP%\nsg3.tmp\pic\close.png
- %TEMP%\nsg3.tmp\pic\custom.png
- %TEMP%\nsg3.tmp\pic\installingbg01.png
- %HOMEPATH%\local settings\<INETFILES>\content.ie5\ee7gwdg8\getomgid[1]
- %APPDATA%\tencent\omgcache\hwcfg.ini
Deletes the following files
- %ALLUSERSPROFILE%\application data\mon_pro.ini
- %ALLUSERSPROFILE%\application data\mon_inst.ini
Network activity
TCP
HTTP GET requests
- http://dl###1.qq.com/qqtv/downloader/pcmgrdlcore.zip?ti#############
- http://dl###1.qq.com/qqtv/appdata/config.ini?ti#############
- http://dl###1.qq.com/qqtv/azdk/mon_pro.ini
- http://dl###1.qq.com/qqtv/azdk/mon_inst.ini
HTTP POST requests
UDP
- DNS ASK dl###1.qq.com
- DNS ASK bt###e.qq.com
- DNS ASK om###.qq.com
Miscellaneous
Searches for the following windows
- ClassName: '#32770' WindowName: ''
Creates and executes the following
- '%TEMP%\nsg3.tmp\statistics.exe' -ReportNew "-Step:1 -Result:1 -ModuleName:<File name>.exe -ModuleVer:10.16.3639.0 -ChannelName:qqsoftpcmgrnew -InstallDir:\"%ProgramFiles%\Tencent\QQLive\" -ParentProcessName:explorer.exe -NewI...
- '%TEMP%\nsg3.tmp\statistics.exe' -ReportAntiCheat "-ChannelName:qqsoftpcmgrnew -Version:10.16.3639.0 -ProtocolVersion:0"
- '%TEMP%\nsg3.tmp\statistics.exe' BossId=5069&Pwd=1319681759&first=install&second=&third=&forth=&cmd=exposure&platform=10204&main_login=&uin=&openid=&vuserid=&version=0&guid={F878CDB765B7F0C627A1CF600F34BE72}&exposureComparison...
- '%TEMP%\nsg3.tmp\statistics.exe' BossId=2800&Pwd=1456476441&iSta=2567&ctype=1&itype=11&ver=10.16.3639.0&str1=F878CDB765B7F0C627A1CF600F34BE72&str2=qqsoftpcmgrnew&vid=explorer.exe&url=<File name>.exe&int6=1&protocolver=0&guid2=...
