Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\nvngxupdatecheckdaily_{48237f1a-7f1a-7f1a-7f1a-48237f1a7f1a}
Malicious functions
Creates and executes the following
- '%APPDATA%\microsoft\windows\templates\695852.exe'
Modifies file system
Creates the following files
- %APPDATA%\microsoft\windows\templates\695852.exe
- %TEMP%\9419.tmp
- %APPDATA%\eewvvvj
Sets the 'hidden' attribute to the following files
- %APPDATA%\eewvvvj
Deletes the following files
- %APPDATA%\microsoft\windows\templates\695852.exe
Network activity
Connects to
- 'in#####tioshopname.ru':80
- 'gm##hop.ru':80
- 'uc#r.ug':80
- 'wo###perty.xyz':80
- 'sm####ouseforyou.ru':80
- 'ma####farmllc.ru':80
TCP
HTTP GET requests
- http://uk##net.ru/image/cabinet.exe
HTTP POST requests
- http://in#####tioshopname.ru/
- http://uk##net.ru/
- http://gm##hop.ru/
- http://uc#r.ug/
- http://sm####ouseforyou.ru/
- http://ma####farmllc.ru/
UDP
- DNS ASK uk##net.ru
- DNS ASK in#####tioshopname.ru
- DNS ASK gm##hop.ru
- DNS ASK uc#r.ug
- DNS ASK wo###perty.xyz
- DNS ASK sm####ouseforyou.ru
- DNS ASK ma####farmllc.ru
