Техническая информация
Вредоносные функции:
Создает и запускает на исполнение:
- '%TEMP%\nsm2.tmp\ef.exe' "%TEMP%\nsm2.tmp\inetc.dll" -111
- '%TEMP%\nsm2.tmp\setup.exe'
- '%TEMP%\nsm2.tmp\ns4.tmp' %TEMP%\nsm2.tmp\ef.exe "%TEMP%\nsm2.tmp\inetc.dll" -111
- '%TEMP%\nsm2.tmp\ns3.tmp' %TEMP%\nsm2.tmp\mf.exe "%TEMP%\nsm2.tmp\inetc.dll"
- '%TEMP%\nsm2.tmp\mf.exe' "%TEMP%\nsm2.tmp\inetc.dll"
- '%TEMP%\nsm2.tmp\setup.exe' (загружен из сети Интернет)
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nsm2.tmp\icons\22.ico
- %TEMP%\nsm2.tmp\icons\21.ico
- %TEMP%\nsm2.tmp\icons\23.ico
- %TEMP%\nsm2.tmp\icons\25.ico
- %TEMP%\nsm2.tmp\icons\24.ico
- %TEMP%\nsm2.tmp\icons\18.ico
- %TEMP%\nsm2.tmp\icons\17.ico
- %TEMP%\nsm2.tmp\icons\19.ico
- %TEMP%\nsm2.tmp\icons\20.ico
- %TEMP%\nsm2.tmp\icons\2.ico
- %TEMP%\nsm2.tmp\icons\26.ico
- %TEMP%\nsm2.tmp\icons\36.ico
- %TEMP%\nsm2.tmp\icons\34.ico
- %TEMP%\nsm2.tmp\icons\37.ico
- %TEMP%\nsm2.tmp\icons\39.ico
- %TEMP%\nsm2.tmp\icons\38.ico
- %TEMP%\nsm2.tmp\icons\3.ico
- %TEMP%\nsm2.tmp\icons\29.ico
- %TEMP%\nsm2.tmp\icons\30.ico
- %TEMP%\nsm2.tmp\icons\33.ico
- %TEMP%\nsm2.tmp\icons\31.ico
- %TEMP%\nsm2.tmp\icons\11.ico
- %TEMP%\nsm2.tmp\icons\108.ico
- %TEMP%\nsm2.tmp\icons\110.ico
- %TEMP%\nsm2.tmp\icons\112.ico
- %TEMP%\nsm2.tmp\icons\111.ico
- %TEMP%\nsm2.tmp\icons\102.ico
- %TEMP%\nsm2.tmp\icons\101.ico
- %TEMP%\nsm2.tmp\icons\103.ico
- %TEMP%\nsm2.tmp\icons\107.ico
- %TEMP%\nsm2.tmp\icons\104.ico
- %TEMP%\nsm2.tmp\icons\119.ico
- %TEMP%\nsm2.tmp\icons\13.ico
- %TEMP%\nsm2.tmp\icons\125.ico
- %TEMP%\nsm2.tmp\icons\14.ico
- %TEMP%\nsm2.tmp\icons\16.ico
- %TEMP%\nsm2.tmp\icons\15.ico
- %TEMP%\nsm2.tmp\icons\120.ico
- %TEMP%\nsm2.tmp\icons\12.ico
- %TEMP%\nsm2.tmp\icons\121.ico
- %TEMP%\nsm2.tmp\icons\123.ico
- %TEMP%\nsm2.tmp\icons\122.ico
- %TEMP%\nsm2.tmp\icons\4.ico
- %TEMP%\nsm2.tmp\icons\75.ico
- %TEMP%\nsm2.tmp\icons\73.ico
- %TEMP%\nsm2.tmp\icons\76.ico
- %TEMP%\nsm2.tmp\icons\78.ico
- %TEMP%\nsm2.tmp\icons\77.ico
- %TEMP%\nsm2.tmp\icons\66.ico
- %TEMP%\nsm2.tmp\icons\65.ico
- %TEMP%\nsm2.tmp\icons\68.ico
- %TEMP%\nsm2.tmp\icons\72.ico
- %TEMP%\nsm2.tmp\icons\69.ico
- %TEMP%\nsm2.tmp\icons\79.ico
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\update[1].1
- %TEMP%\nsm2.tmp\nsDialogs.dll
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\update[1].1
- %TEMP%\nsm2.tmp\setup.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\dd469652ebee1cad3a90c1275c4555c4[1]
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\icons[1].dat
- %TEMP%\nsm2.tmp\icons\8.ico
- %TEMP%\nsm2.tmp\icons\data_2.dat
- %TEMP%\nsm2.tmp\modern-wizard.bmp
- %TEMP%\nsm2.tmp\icons\default.ico
- %TEMP%\nsm2.tmp\icons\46.ico
- %TEMP%\nsm2.tmp\icons\45.ico
- %TEMP%\nsm2.tmp\icons\47.ico
- %TEMP%\nsm2.tmp\icons\5.ico
- %TEMP%\nsm2.tmp\icons\48.ico
- %TEMP%\nsm2.tmp\icons\41.ico
- %TEMP%\nsm2.tmp\icons\40.ico
- %TEMP%\nsm2.tmp\icons\42.ico
- %TEMP%\nsm2.tmp\icons\44.ico
- %TEMP%\nsm2.tmp\icons\43.ico
- %TEMP%\nsm2.tmp\icons\52.ico
- %TEMP%\nsm2.tmp\icons\61.ico
- %TEMP%\nsm2.tmp\icons\6.ico
- %TEMP%\nsm2.tmp\icons\62.ico
- %TEMP%\nsm2.tmp\icons\64.ico
- %TEMP%\nsm2.tmp\icons\63.ico
- %TEMP%\nsm2.tmp\icons\54.ico
- %TEMP%\nsm2.tmp\icons\53.ico
- %TEMP%\nsm2.tmp\icons\55.ico
- %TEMP%\nsm2.tmp\icons\59.ico
- %TEMP%\nsm2.tmp\icons\57.ico
- %TEMP%\nsm2.tmp\icons\10059.ico
- %TEMP%\nsm2.tmp\icons\10001.ico
- %TEMP%\nsm2.tmp\icons\10000.ico
- %TEMP%\nsm2.tmp\icons\10002.ico
- %TEMP%\nsm2.tmp\icons\10004.ico
- %TEMP%\nsm2.tmp\icons\10003.ico
- %TEMP%\nsm2.tmp\nsisunz.dll
- %TEMP%\nsm2.tmp\icons\data_1.dat
- %TEMP%\nsm2.tmp\icons\1.ico
- %TEMP%\nsm2.tmp\icons\100.ico
- %TEMP%\nsm2.tmp\icons\10.ico
- %TEMP%\nsm2.tmp\icons\10005.ico
- %TEMP%\nsm2.tmp\icons\10012.ico
- %TEMP%\nsm2.tmp\icons\10011.ico
- %TEMP%\nsm2.tmp\icons\10013.ico
- %TEMP%\nsm2.tmp\icons\10015.ico
- %TEMP%\nsm2.tmp\icons\10014.ico
- %TEMP%\nsm2.tmp\icons\10007.ico
- %TEMP%\nsm2.tmp\icons\10006.ico
- %TEMP%\nsm2.tmp\icons\10008.ico
- %TEMP%\nsm2.tmp\icons\10010.ico
- %TEMP%\nsm2.tmp\icons\10009.ico
- %TEMP%\nsm2.tmp\inetc.dll.out
- %TEMP%\nsm2.tmp\ns3.tmp
- %TEMP%\nsm2.tmp\ef.exe
- %TEMP%\nsm2.tmp\SimpleInstaller.exe
- %TEMP%\nsm2.tmp\ns4.tmp
- %TEMP%\nsm2.tmp\mf.exe
- %TEMP%\nsm2.tmp\System.dll
- %TEMP%\nsm2.tmp\inetc.dll.out0
- %TEMP%\nsm2.tmp\nsExec.dll
- %TEMP%\nsm2.tmp\inetc.dll.out1
- %TEMP%\nsm2.tmp\icons\no_toolbar.ico
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\success[1].1
- %TEMP%\nsm2.tmp\dummyres
- %TEMP%\nsm2.tmp\Dialer.dll
- %TEMP%\nsm2.tmp\list.ini
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\software[1].1698
- %TEMP%\nsm2.tmp\GetVersion.dll
- %TEMP%\nsm2.tmp\main.ico
- %TEMP%\nsm2.tmp\BaseConvert.dll
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\success[1].1
- %TEMP%\nsm2.tmp\Math.dll
- %TEMP%\nsm2.tmp\icons\10016.ico
- %TEMP%\nsm2.tmp\icons\10044.ico
- %TEMP%\nsm2.tmp\icons\10043.ico
- %TEMP%\nsm2.tmp\icons\10045.ico
- %TEMP%\nsm2.tmp\icons\10047.ico
- %TEMP%\nsm2.tmp\icons\10046.ico
- %TEMP%\nsm2.tmp\icons\10039.ico
- %TEMP%\nsm2.tmp\icons\10038.ico
- %TEMP%\nsm2.tmp\icons\10040.ico
- %TEMP%\nsm2.tmp\icons\10042.ico
- %TEMP%\nsm2.tmp\icons\10041.ico
- %TEMP%\nsm2.tmp\icons\10048.ico
- %TEMP%\nsm2.tmp\icons\10055.ico
- %TEMP%\nsm2.tmp\icons\10054.ico
- %TEMP%\nsm2.tmp\icons\10056.ico
- %TEMP%\nsm2.tmp\icons\10058.ico
- %TEMP%\nsm2.tmp\icons\10057.ico
- %TEMP%\nsm2.tmp\icons\10050.ico
- %TEMP%\nsm2.tmp\icons\10049.ico
- %TEMP%\nsm2.tmp\icons\10051.ico
- %TEMP%\nsm2.tmp\icons\10053.ico
- %TEMP%\nsm2.tmp\icons\10052.ico
- %TEMP%\nsm2.tmp\icons\10023.ico
- %TEMP%\nsm2.tmp\icons\10022.ico
- %TEMP%\nsm2.tmp\icons\10024.ico
- %TEMP%\nsm2.tmp\icons\10026.ico
- %TEMP%\nsm2.tmp\icons\10025.ico
- %TEMP%\nsm2.tmp\icons\10018.ico
- %TEMP%\nsm2.tmp\icons\10017.ico
- %TEMP%\nsm2.tmp\icons\10019.ico
- %TEMP%\nsm2.tmp\icons\10021.ico
- %TEMP%\nsm2.tmp\icons\10020.ico
- %TEMP%\nsm2.tmp\icons\10027.ico
- %TEMP%\nsm2.tmp\icons\10034.ico
- %TEMP%\nsm2.tmp\icons\10033.ico
- %TEMP%\nsm2.tmp\icons\10035.ico
- %TEMP%\nsm2.tmp\icons\10037.ico
- %TEMP%\nsm2.tmp\icons\10036.ico
- %TEMP%\nsm2.tmp\icons\10029.ico
- %TEMP%\nsm2.tmp\icons\10028.ico
- %TEMP%\nsm2.tmp\icons\10030.ico
- %TEMP%\nsm2.tmp\icons\10032.ico
- %TEMP%\nsm2.tmp\icons\10031.ico
Удаляет следующие файлы:
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\success[1].1
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\success[1].1
- %TEMP%\nsm2.tmp\list.ini
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\update[1].1
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\update[1].1
- %TEMP%\nsm2.tmp\mf.exe
- %TEMP%\nsm2.tmp\ns3.tmp
- %TEMP%\nsm2.tmp\ns4.tmp
- %TEMP%\nsm2.tmp\ef.exe
- %TEMP%\nsm2.tmp\inetc.dll
Перемещает следующие файлы:
- %TEMP%\nsm2.tmp\inetc.dll.out в %TEMP%\nsm2.tmp\inetc.dll
Сетевая активность:
Подключается к:
- 'do#####d-instantly.com':80
- 'www.pp##stro.us':80
TCP:
Запросы HTTP GET:
- www.pp##stro.us/api/update/?s=###########################################################
- do#####d-instantly.com/dl/dd469652ebee1cad3a90c1275c4555c4
- www.pp##stro.us/downloads/icons.dat
- www.pp##stro.us/api/success/?s=###########################################################
- www.pp##stro.us/api/software/?s=##########################################################################################
UDP:
- DNS ASK do#####d-instantly.com
- DNS ASK www.pp##stro.us
Другое:
Ищет следующие окна:
- ClassName: '#32770' WindowName: '(null)'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
