Technical Information
Malicious functions
Executes the following
- '%WINDIR%\syswow64\taskkill.exe' /f /im "Viber.exe"
Modifies file system
Creates the following files
- %TEMP%\nswea1.tmp
- %TEMP%\nsleb1.tmp\system.dll
- %TEMP%\nsleb1.tmp\nsexec.dll
- %TEMP%\nsleb1.tmp\registry.dll
Deletes the following files
- %TEMP%\nsleb1.tmp\nsexec.dll
- %TEMP%\nsleb1.tmp\registry.dll
- %TEMP%\nsleb1.tmp\system.dll
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: ''
- ClassName: 'RegEdit_RegEdit' WindowName: ''
Creates and executes the following
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /f /im "Viber.exe"' (with hidden window)
- '%WINDIR%\regedit.exe' /s "<Current directory>\Data\ID.reg"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c attrib +h "<Current directory>\Data\*.reg"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c attrib +h /D "<Current directory>\Data\Viber Media S.Г r.l-3"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c MKLINK /J "%APPDATA%\ViberPC" "<Current directory>\Data\ViberPC-3"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c MKLINK /J "%HOMEPATH%\Documents\ViberDownloads" "<Current directory>\Data\ViberDownloads-3"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c MKLINK /J "%LOCALAPPDATA%\Viber Media S.Г r.l" "<Current directory>\Data\Viber Media S.Г r.l-3"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c reg copy "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FeatureUsage\AppBadgeUpdated" "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FeatureUsage\AppBadgeUpdated-Backup" ...' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c reg copy "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FeatureUsage\ShowJumpView" "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FeatureUsage\ShowJumpView-Backup" /s /f' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c reg copy "HKCR\Local Settings\Software\Microsoft\Windows\Shell\MuiCache" "HKCR\Local Settings\Software\Microsoft\Windows\Shell\MuiCache-Backup" /s /f' (with hidden window)
- '%WINDIR%\regedit.exe' /s "<Current directory>\Data\MachineGuid.reg"' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /f /im "Viber.exe"
- '%WINDIR%\syswow64\reg.exe' copy "HKCR\Local Settings\Software\Microsoft\Windows\Shell\MuiCache" "HKCR\Local Settings\Software\Microsoft\Windows\Shell\MuiCache-Backup" /s /f
- '%WINDIR%\syswow64\cmd.exe' /c reg copy "HKCR\Local Settings\Software\Microsoft\Windows\Shell\MuiCache" "HKCR\Local Settings\Software\Microsoft\Windows\Shell\MuiCache-Backup" /s /f
- '%WINDIR%\syswow64\reg.exe' copy "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FeatureUsage\ShowJumpView" "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FeatureUsage\ShowJumpView-Backup" /s /f
- '%WINDIR%\syswow64\cmd.exe' /c reg copy "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FeatureUsage\ShowJumpView" "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FeatureUsage\ShowJumpView-Backup" /s /f
- '%WINDIR%\syswow64\reg.exe' copy "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FeatureUsage\AppBadgeUpdated" "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FeatureUsage\AppBadgeUpdated-Backup" /s /f
- '%WINDIR%\syswow64\cmd.exe' /c reg copy "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FeatureUsage\AppBadgeUpdated" "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FeatureUsage\AppBadgeUpdated-Backup" ...
- '%WINDIR%\syswow64\cmd.exe' /c MKLINK /J "%LOCALAPPDATA%\Viber Media S.Г r.l" "<Current directory>\Data\Viber Media S.Г r.l-3"
- '%WINDIR%\syswow64\cmd.exe' /c MKLINK /J "%HOMEPATH%\Documents\ViberDownloads" "<Current directory>\Data\ViberDownloads-3"
- '%WINDIR%\syswow64\cmd.exe' /c MKLINK /J "%APPDATA%\ViberPC" "<Current directory>\Data\ViberPC-3"
- '%WINDIR%\syswow64\attrib.exe' +h /D "<Current directory>\Data\Viber Media S.Г r.l-3"
- '%WINDIR%\syswow64\cmd.exe' /c attrib +h /D "<Current directory>\Data\Viber Media S.Г r.l-3"
- '%WINDIR%\syswow64\attrib.exe' +h "<Current directory>\Data\*.reg"
- '%WINDIR%\syswow64\cmd.exe' /c attrib +h "<Current directory>\Data\*.reg"
- '%WINDIR%\regedit.exe' /s "<Current directory>\Data\ID.reg"
- '<SYSTEM32>\regedt32.exe' /s "<Current directory>\Data\ID.reg"
- '<SYSTEM32>\regedt32.exe' /s "<Current directory>\Data\MachineGuid.reg"
- '%WINDIR%\regedit.exe' /s "<Current directory>\Data\MachineGuid.reg"
