Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run] 'InfoNote' = '"%ProgramFiles(x86)%\InfoNote\InfoNote.exe"-informal'
Creates or modifies the following files
- <SYSTEM32>\tasks\inotek
Sets the following service settings
- [<HKLM>\System\CurrentControlSet\Services\nationwide] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\nationwide] 'ImagePath' = '%ProgramFiles(x86)%\nationwide\nationwide.exe'
Creates the following services
- 'nationwide' %ProgramFiles(x86)%\nationwide\nationwide.exe
Modifies file system
Creates the following files
- %ProgramFiles(x86)%\infonotemain.7z
- %ProgramFiles(x86)%\infonote\plugins\apis\xml.xml
- %ProgramFiles(x86)%\infonote\themes\vim dark blue.xml
- %ProgramFiles(x86)%\infonote\themes\vibrant ink.xml
- %ProgramFiles(x86)%\infonote\plugins\apis\vhdl.xml
- %ProgramFiles(x86)%\infonote\plugins\apis\vb.xml
- %ProgramFiles(x86)%\infonote\themes\twilight.xml
- %ProgramFiles(x86)%\infonote\plugins\apis\tex.xml
- %ProgramFiles(x86)%\infonote\stylers.xml
- %ProgramFiles(x86)%\infonote\stylers.model.xml
- %ProgramFiles(x86)%\infonote\plugins\apis\sql.xml
- %ProgramFiles(x86)%\infonote\themes\solarized.xml
- %ProgramFiles(x86)%\infonote\themes\solarized-light.xml
- %ProgramFiles(x86)%\infonote\shortcuts.xml
- %ProgramFiles(x86)%\infonote\session.xml
- %ProgramFiles(x86)%\infonote\themes\ruby blue.xml
- %ProgramFiles(x86)%\infonote\themes\zenburn.xml
- %ProgramFiles(x86)%\infonote\plugins\config\pluginmanager.ini
- %APPDATA%\eliminating\config.ini
- %ProgramFiles(x86)%\infonote\infonote.exe
- %TEMP%\1136404
- %ProgramFiles(x86)%\nationwide\nationwide.exe
- %TEMP%\updates.exe
- %ProgramFiles(x86)%\infonote\shellext64.dll
- %ProgramFiles(x86)%\infonote\shellext.dll
- %ProgramFiles(x86)%\infonote\rcclickt
- %ProgramFiles(x86)%\infonote\config.ini
- %ProgramFiles(x86)%\infonote\uninstall.exe
- %ProgramFiles(x86)%\infonote\inoteservice.exe
- %ProgramFiles(x86)%\infonote\inotehost.exe
- %ProgramFiles(x86)%\infonote\scilexer.dll
- %ProgramFiles(x86)%\infonote\plugins\pluginmanager.dll
- %ProgramFiles(x86)%\infonote\plugins\nppexport.dll
- %ProgramFiles(x86)%\infonote\plugins\nppconverter.dll
- %ProgramFiles(x86)%\infonote\plugins\mimetools.dll
- %ProgramFiles(x86)%\infonote\plugins\apis\rc.xml
- %ProgramFiles(x86)%\infonote\plugins\config\converter.ini
- %ProgramFiles(x86)%\infonote\plugins\apis\python.xml
- %ProgramFiles(x86)%\infonote\themes\hello kitty.xml
- %ProgramFiles(x86)%\infonote\themes\deep black.xml
- %ProgramFiles(x86)%\infonote\plugins\apis\css.xml
- %ProgramFiles(x86)%\infonote\plugins\apis\cs.xml
- %ProgramFiles(x86)%\infonote\plugins\apis\cpp.xml
- %ProgramFiles(x86)%\infonote\contextmenu.xml
- %ProgramFiles(x86)%\infonote\config.xml
- %ProgramFiles(x86)%\infonote\config.model.xml
- %ProgramFiles(x86)%\infonote\plugins\apis\cmake.xml
- %ProgramFiles(x86)%\infonote\themes\choco.xml
- %ProgramFiles(x86)%\infonote\localization\chinesesimplified.xml
- %ProgramFiles(x86)%\infonote\plugins\apis\c.xml
- %ProgramFiles(x86)%\infonote\themes\black board.xml
- %ProgramFiles(x86)%\infonote\themes\bespin.xml
- %ProgramFiles(x86)%\infonote\plugins\apis\actionscript.xml
- %ProgramFiles(x86)%\infonote\plugins\config\pluginmanagerplugins.zip
- %ProgramFiles(x86)%\infonote\functionlist.xml
- %ProgramFiles(x86)%\infonote\themes\hotfudgesundae.xml
- %ProgramFiles(x86)%\infonote\themes\plastic code wrap.xml
- %ProgramFiles(x86)%\infonote\plugins\apis\html.xml
- %ProgramFiles(x86)%\infonote\plugins\apis\php.xml
- %ProgramFiles(x86)%\infonote\plugins\apis\perl.xml
- %ProgramFiles(x86)%\infonote\themes\obsidian.xml
- %ProgramFiles(x86)%\infonote\plugins\apis\nsis.xml
- %ProgramFiles(x86)%\infonote\themes\navajo.xml
- %ProgramFiles(x86)%\infonote\nativelang.xml
- %ProgramFiles(x86)%\infonote\themes\mossylawn.xml
- %ProgramFiles(x86)%\infonote\themes\monokai.xml
- %ProgramFiles(x86)%\infonote\themes\mono industrial.xml
- %ProgramFiles(x86)%\infonote\plugins\apis\lisp.xml
- %ProgramFiles(x86)%\infonote\langs.xml
- %ProgramFiles(x86)%\infonote\langs.model.xml
- %ProgramFiles(x86)%\infonote\themes\khaki.xml
- %ProgramFiles(x86)%\infonote\plugins\apis\javascript.xml
- %ProgramFiles(x86)%\infonote\plugins\apis\java.xml
- %ProgramFiles(x86)%\infonote\plugins\config\pluginmanagerplugins.xml
- %APPDATA%\assembling\config.ini
Deletes the following files
- %ProgramFiles(x86)%\infonotemain.7z
- %TEMP%\1136404
Network activity
Connects to
- 'no##.##w.moji520.com':80
- 'no##.##sit.moji520.com':80
- 'no##.#z.moji520.com':80
TCP
HTTP GET requests
- http://no##.##w.moji520.com/essaynote/inforessay.ini
- http://no##.##sit.moji520.com/api/tempip.ashx?ac#################
- http://no##.#z.moji520.com/peaceworld.do?31######################################################################################################################################################...
- http://no##.#z.moji520.com/peaceworld.do?%3######################################################################################################################################################...
UDP
- DNS ASK no##.##w.moji520.com
- DNS ASK ba##u.com
- DNS ASK no##.##sit.moji520.com
- DNS ASK no##.#z.moji520.com
Miscellaneous
Searches for the following windows
- ClassName: 'MS_WINHELP' WindowName: ''
Creates and executes the following
- '%TEMP%\updates.exe'
- '%ProgramFiles(x86)%\infonote\infonote.exe' -informal
- '%ProgramFiles(x86)%\infonote\inotehost.exe' -informal
- '%ProgramFiles(x86)%\infonote\inoteservice.exe' -n 1036
- '%WINDIR%\syswow64\regsvr32.exe' /s /u "%ProgramFiles(x86)%\InfoNote\shellext64.dll"' (with hidden window)
- '%WINDIR%\syswow64\regsvr32.exe' /s "%ProgramFiles(x86)%\InfoNote\shellext64.dll"' (with hidden window)
- '%TEMP%\updates.exe' ' (with hidden window)
- '%WINDIR%\syswow64\sc.exe' create nationwide binpath= "%ProgramFiles(x86)%\nationwide\nationwide.exe" start= auto' (with hidden window)
- '%ProgramFiles(x86)%\infonote\infonote.exe' -informal' (with hidden window)
- '%ProgramFiles(x86)%\infonote\inotehost.exe' -informal' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\regsvr32.exe' /s /u "%ProgramFiles(x86)%\InfoNote\shellext64.dll"
- '<SYSTEM32>\regsvr32.exe' /s /u "%ProgramFiles(x86)%\InfoNote\shellext64.dll"
- '%WINDIR%\syswow64\regsvr32.exe' /s "%ProgramFiles(x86)%\InfoNote\shellext64.dll"
- '<SYSTEM32>\regsvr32.exe' /s "%ProgramFiles(x86)%\InfoNote\shellext64.dll"
- '%WINDIR%\syswow64\sc.exe' create nationwide binpath= "%ProgramFiles(x86)%\nationwide\nationwide.exe" start= auto
