Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- %HOMEPATH%\start menu\programs\startup\messenger live.lnk
Malicious functions
To complicate detection of its presence in the operating system,
modifies the following system settings:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoSaveSettings' = '00000001'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\LocalUser\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoSaveSettings' = '00000001'
Sets a new unauthorized home page for Windows Internet Explorer.
Modifies file system
Creates the following files
- %TEMP%\nsy2.tmp
- %APPDATA%\adobe\chlogic.exe
- %APPDATA%\adobe\ielogic.exe
- <LS_APPDATA>\google\chrome\user data\default\nsk7.tmp
- %ALLUSERSPROFILE%\application data\google\1.reg
- %ALLUSERSPROFILE%\start menu\programs\google chrome.lnk
- %APPDATA%\microsoft\internet explorer\quick launch\internet explorer tarayГЅcГЅsГЅ'nГЅ baГѕlat.lnk
- %APPDATA%\microsoft\internet explorer\quick launch\internet explorer.lnk
- %ALLUSERSPROFILE%\start menu\programs\internet explorer.lnk
- %ALLUSERSPROFILE%\desktop\internet explorer.lnk
- %TEMP%\nsj6.tmp
- %APPDATA%\adobe\v9.exe
- %TEMP%\nsa3.tmp\ns4.tmp
- %TEMP%\nsa3.tmp\nsexec.dll
- %APPDATA%\adobe\v9.zip
- %APPDATA%\adobe\7za.exe
- %TEMP%\nsb9.tmp\system.dll
- %TEMP%\nsb9.tmp\inetc.dll
Deletes the following files
- %TEMP%\nsa3.tmp\ns4.tmp
- <LS_APPDATA>\google\chrome\user data\default\nsk7.tmp
- %TEMP%\nsb9.tmp\inetc.dll
- %TEMP%\nsb9.tmp\system.dll
Substitutes the following files
- %ALLUSERSPROFILE%\Desktop\Mozilla Firefox.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\Mozilla Firefox.lnk
- %APPDATA%\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
- %ALLUSERSPROFILE%\Desktop\Google Chrome.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\Google Chrome\Google Chrome.lnk
Network activity
Connects to
- 'se######.##olbar.conduit-services.com':80
UDP
- DNS ASK se######.##olbar.conduit-services.com
Miscellaneous
Searches for the following windows
- ClassName: 'RegEdit_RegEdit' WindowName: ''
Creates and executes the following
- '%TEMP%\nsa3.tmp\ns4.tmp' "%APPDATA%\Adobe\7za.exe" e v9.zip -p963852
- '%APPDATA%\adobe\7za.exe' e v9.zip -p963852
- '%APPDATA%\adobe\v9.exe'
- '%APPDATA%\adobe\chlogic.exe' /S
- '%APPDATA%\adobe\ielogic.exe' /s -Silent:TRUE
- '%TEMP%\nsa3.tmp\ns4.tmp' "%APPDATA%\Adobe\7za.exe" e v9.zip -p963852' (with hidden window)
Executes the following
- '%WINDIR%\regedit.exe' /s "%ALLUSERSPROFILE%\Application Data\Google\1.reg"
