Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKLM\Software\Classes\exefile\shell\open\command] '' = '%WINDIR%\svchost.com "%1" %*'
Infects the following executable files
- C:\MSOCache\All Users\{90140000-0011-0000-1000-0000000FF1CE}-C\ose.exe
- %ProgramFiles(x86)%\Opera\29.0.1795.47\opera_crashreporter.exe
- %ProgramFiles(x86)%\Opera\29.0.1795.47\wow_helper.exe
- %ProgramFiles(x86)%\Opera\launcher.exe
- %ProgramFiles(x86)%\Steam\bin\SteamService.exe
- %ProgramFiles(x86)%\Steam\Steam.exe
- %ProgramFiles(x86)%\Steam\uninstall.exe
- %ALLUSERSPROFILE%\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe
- %ALLUSERSPROFILE%\Package Cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\vcredist_x64.exe
- %ALLUSERSPROFILE%\Package Cache\{295d1583-fdb9-414b-a4c8-da539362a26b}\VC_redist.x64.exe
- %ProgramFiles(x86)%\Adobe\Acrobat Reader DC\Reader\Eula.exe
- %ALLUSERSPROFILE%\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
- %ALLUSERSPROFILE%\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
- %ALLUSERSPROFILE%\Package Cache\{f65db027-aff3-4070-886a-0d87064aabb1}\vcredist_x86.exe
- %ALLUSERSPROFILE%\Package Cache\{fd9b6070-d13e-45dc-819b-41806bf45b6b}\VC_redist.x64.exe
- %LOCALAPPDATA%\Google\Chrome\Application\42.0.2311.135\delegate_execute.exe
- %LOCALAPPDATA%\Google\Chrome\Application\42.0.2311.135\Installer\setup.exe
- %LOCALAPPDATA%\Google\Chrome\Application\42.0.2311.135\nacl64.exe
- %LOCALAPPDATA%\Google\Chrome\Application\chrome.exe
- %APPDATA%\Telegram Desktop\unins000.exe
- %APPDATA%\Telegram Desktop\Updater.exe
- %ProgramFiles(x86)%\Opera\29.0.1795.47\installer.exe
- %ProgramFiles(x86)%\Opera\29.0.1795.47\opera_autoupdate.exe
- %ProgramFiles(x86)%\Microsoft Office\Office14\MSOHTMED.EXE
- %CommonProgramFiles(x86)%\Steam\steamservice.exe
- %CommonProgramFiles(x86)%\microsoft shared\VSTO\10.0\VSTOInstaller.exe
- C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\DW20.EXE
- C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\dwtrig20.exe
- %ProgramFiles(x86)%\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe
- %ProgramFiles(x86)%\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
- %ProgramFiles(x86)%\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe
- %ProgramFiles(x86)%\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
- %ProgramFiles(x86)%\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe
- %ProgramFiles(x86)%\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe
- %ProgramFiles(x86)%\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe
- %HOMEPATH%\Desktop\jre-7u75-windows-i586-iftw.exe
- %ALLUSERSPROFILE%\Package Cache\{38b2c744-ad08-4d5b-91a2-3fb6f739ff3e}\VC_redist.x86.exe
- %ProgramFiles(x86)%\Adobe\Acrobat Reader DC\Reader\arh.exe
- %ProgramFiles(x86)%\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe
- %ProgramFiles(x86)%\Adobe\Acrobat Reader DC\Reader\reader_sl.exe
- %ProgramFiles(x86)%\Adobe\Acrobat Reader DC\Reader\wow_helper.exe
- %CommonProgramFiles(x86)%\Adobe\ARM\1.0\AdobeARM.exe
- %CommonProgramFiles(x86)%\Adobe\ARM\1.0\AdobeARMHelper.exe
- %CommonProgramFiles(x86)%\Java\Java Update\jaureg.exe
- %CommonProgramFiles(x86)%\Java\Java Update\jucheck.exe
- %CommonProgramFiles(x86)%\Java\Java Update\jusched.exe
- %CommonProgramFiles(x86)%\microsoft shared\TextConv\WksConv\Wkconv.exe
- C:\MSOCache\All Users\{90140000-0011-0000-1000-0000000FF1CE}-C\setup.exe
- %ProgramFiles(x86)%\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe
- %HOMEPATH%\desktop\utorrent.exe
Modifies file system
Creates the following files
- %WINDIR%\modemlogs\csnlog\np.exe
- %WINDIR%\modemlogs\csnlog\rx.bat
- %WINDIR%\syswow64\np.exe
- %TEMP%\3582-490\np.exe
- %WINDIR%\svchost.com
Miscellaneous
Searches for the following windows
- ClassName: 'EDIT' WindowName: ''
Creates and executes the following
- '%WINDIR%\modemlogs\csnlog\np.exe' -pZXasdd
- '%WINDIR%\syswow64\np.exe'
- '%TEMP%\3582-490\np.exe'
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c ""%WINDIR%\ModemLogs\CSNLog\rx.bat" "
- '%WINDIR%\syswow64\timeout.exe' /t 1
