Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKCU\software\microsoft\windows\currentversion\run] '<File name>' = 'WScript.exe //B "%APPDATA%\<File name>.js"'
- [HKLM\software\microsoft\windows\currentversion\run] '<File name>' = 'WScript.exe //B "%APPDATA%\<File name>.js"'
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\<File name>.js
Creates the following files on removable media
- <Drive name for removable media>:\<File name>.js
Modifies file system
Creates the following files
- %APPDATA%\<File name>.js
Sets the 'hidden' attribute to the following files
- <Drive name for removable media>:\<File name>.js
Network activity
Connects to
- 'ip##pi.com':80
- 'my##.#nsomatic.com':80
- 'pa###bin.com':443
- 'pk#.goog':80
TCP
HTTP GET requests
- http://ip##pi.com/json/
- http://my##.#nsomatic.com/
- http://pk#.goog/gsr1/gsr1.crt
Other
- 'pa###bin.com':443
UDP
- DNS ASK ip##pi.com
- DNS ASK my##.#nsomatic.com
- DNS ASK pa###bin.com
- DNS ASK pk#.goog
- DNS ASK bb##.live
