Win32.HLLP.Neshta.31

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[<HKLM>\Software\Classes\exefile\shell\open\command] '' = '%WINDIR%\svchost.com "%1" %*'

Infects the following executable files

C:\far2\far.exe
%ProgramFiles(x86)%\Steam\bin\x86launcher.exe
%ProgramFiles(x86)%\Steam\GameOverlayUI.exe
%ProgramFiles(x86)%\Steam\steam\games\appid_10540.exe
%ProgramFiles(x86)%\Steam\steam\games\appid_10560.exe
%ProgramFiles(x86)%\Steam\steam\games\appid_17300.exe
%ProgramFiles(x86)%\Steam\steam\games\appid_17330.exe
%ProgramFiles(x86)%\Steam\steam\games\appid_17340.exe
%ProgramFiles(x86)%\Steam\bin\steamservice.exe
%ProgramFiles(x86)%\Steam\steam\games\appid_6510.exe
%ProgramFiles(x86)%\Steam\Steam.exe
%ProgramFiles(x86)%\Steam\steamerrorreporter.exe
%ProgramFiles(x86)%\Steam\steamerrorreporter64.exe
%ProgramFiles(x86)%\Steam\streaming_client.exe
%ProgramFiles(x86)%\Steam\uninstall.exe
%ProgramFiles(x86)%\Steam\WriteMiniDump.exe
%ProgramFiles(x86)%\Winamp\Elevator.exe
%ProgramFiles(x86)%\Steam\bin\wow_helper.exe
%ProgramFiles(x86)%\Steam\bin\x64launcher.exe
%ProgramFiles(x86)%\Steam\bin\steamwebhelper.exe
%ProgramFiles(x86)%\Steam\bin\html5app_steam.exe
%ProgramFiles(x86)%\Winamp\UninstWA.exe
%ProgramFiles(x86)%\Mozilla Firefox\wow_helper.exe
%ProgramFiles(x86)%\Mozilla Thunderbird\crashreporter.exe
%ProgramFiles(x86)%\Mozilla Thunderbird\maintenanceservice.exe
%ProgramFiles(x86)%\Mozilla Thunderbird\maintenanceservice_installer.exe
%ProgramFiles(x86)%\Mozilla Thunderbird\thunderbird.exe
%ProgramFiles(x86)%\Mozilla Thunderbird\uninstall\helper.exe
%ProgramFiles(x86)%\Winamp\Plugins\reporter.exe
%ProgramFiles(x86)%\Mozilla Firefox\webapp-uninstaller.exe
%ProgramFiles(x86)%\Steam\steam\games\appid_6520.exe
%ProgramFiles(x86)%\Mozilla Thunderbird\updater.exe
%ProgramFiles(x86)%\Opera\29.0.1795.47\wow_helper.exe
%ProgramFiles(x86)%\Opera\launcher.exe
%ProgramFiles(x86)%\Pidgin\pidgin-uninst.exe
%ProgramFiles(x86)%\Pidgin\pidgin.exe
%ProgramFiles(x86)%\QIP 2012\qip.exe
%ProgramFiles(x86)%\QIP 2012\unins000.exe
%ProgramFiles(x86)%\Opera\29.0.1795.47\installer.exe
%ProgramFiles(x86)%\Opera\29.0.1795.47\opera_autoupdate.exe
%ProgramFiles(x86)%\Opera\29.0.1795.47\opera_crashreporter.exe
%ProgramFiles(x86)%\K-Lite Codec Pack\Tools\mediainfo.exe
%ProgramFiles(x86)%\Winamp\winamp.exe
C:\totalcmd\tcusbrun.exe
C:\totalcmd\TOTALCMD64.EXE
%APPDATA%\ICQM\ICQ\dll\mailrusputnik.exe
%APPDATA%\Mail.Ru\Agent\Mra\dll\mailrusputnik.exe
%APPDATA%\qipguard\qipguard.exe
%APPDATA%\QipGuard\QipGuard_upd.exe
%APPDATA%\Telegram Desktop\unins000.exe
%APPDATA%\Telegram Desktop\Updater.exe
C:\totalcmd\tcunin64.exe
%ProgramFiles(x86)%\Mozilla Firefox\updater.exe
C:\totalcmd\tcmdx32.exe
%HOMEPATH%\Desktop\tcm851ax32.exe
%HOMEPATH%\desktop\wrar520.exe
%HOMEPATH%\Downloads\ChromeSetup.exe
%HOMEPATH%\Downloads\K-Lite_Codec_Pack_1110_Mega_dlm.exe
%HOMEPATH%\Downloads\mirc741.exe
%HOMEPATH%\Downloads\Opera_NI_stable.exe
%HOMEPATH%\Downloads\pidgin-2.10.11.exe
%HOMEPATH%\Desktop\chromesetup.exe
%HOMEPATH%\desktop\calc.exe
%ProgramFiles(x86)%\Mozilla Firefox\webapprt-stub.exe
C:\totalcmd\NOCLOSE64.EXE
%PROGRAMDATA%\Package Cache\{74d0e5db-b326-4dae-a6b2-445b9de1836e}\VC_redist.x86.exe
%PROGRAMDATA%\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe
%PROGRAMDATA%\Package Cache\{01db25f3-1b76-4d97-88c8-1c90634d88fb}\vcredist_x86.exe
%PROGRAMDATA%\Package Cache\{0f12c81f-93ef-46ec-bc94-d952c1a775d4}\vcredist_x64.exe
%PROGRAMDATA%\Package Cache\{2af972c7-13b0-4978-92a8-fee26a4fb4e9}\vcredist_x86.exe
%PROGRAMDATA%\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
%PROGRAMDATA%\Package Cache\{35459b22-19a6-44ec-8d34-27eb3131acac}\vcredist_x64.exe
%PROGRAMDATA%\Package Cache\{51adbf11-493f-431c-a862-967a0fae2944}\vcredist_x64.exe
C:\totalcmd\tcmadm64.exe
%ProgramFiles(x86)%\Winamp\winampa.exe
%PROGRAMDATA%\Adobe\ARM\S\10428\AdobeARMHelper.exe
%PROGRAMDATA%\Package Cache\{a2199617-3609-410f-a8e8-e8806c73545b}\vcredist_x64.exe
%PROGRAMDATA%\Package Cache\{b55f7208-e02b-4828-ac78-59c73ddf5bc7}\vcredist_x86.exe
%PROGRAMDATA%\Package Cache\{ce085a78-074e-4823-8dc1-8a721b94b76d}\vcredist_x86.exe
%PROGRAMDATA%\Package Cache\{dde2682b-961a-41ea-8d44-6005991b7947}\vcredist_x64.exe
%PROGRAMDATA%\Package Cache\{e46eca4f-393b-40df-9f49-076faf788d83}\VC_redist.x64.exe
%PROGRAMDATA%\Package Cache\{f0080ca2-80ae-4958-b6eb-e8fa916d744a}\vcredist_x86.exe
%PROGRAMDATA%\Package Cache\{f65db027-aff3-4070-886a-0d87064aabb1}\vcredist_x86.exe
%PROGRAMDATA%\Package Cache\{6c95b50e-cb5a-4a1f-a7b4-8a6004f8dd6a}\vcredist_x86.exe
%PROGRAMDATA%\Package Cache\{615bc16d-60f5-482e-91b3-b51d8130963b}\vcredist_x86.exe
%ProgramFiles(x86)%\Mozilla Firefox\uninstall\helper.exe
%ProgramFiles(x86)%\Mozilla Firefox\plugin-hang-ui.exe
%ProgramFiles(x86)%\Mozilla Firefox\plugin-container.exe
%CommonProgramFiles(x86)%\microsoft shared\TextConv\WksConv\Wkconv.exe
%CommonProgramFiles(x86)%\microsoft shared\VS7Debug\vs7jit.exe
%CommonProgramFiles(x86)%\microsoft shared\VSTO\10.0\VSTOInstaller.exe
%CommonProgramFiles(x86)%\PX Storage Engine\pxcpya64.exe
%CommonProgramFiles(x86)%\PX Storage Engine\pxcpyi64.exe
%CommonProgramFiles(x86)%\PX Storage Engine\pxhpinst.exe
%CommonProgramFiles(x86)%\Java\Java Update\jucheck.exe
%ProgramFiles(x86)%\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe
%CommonProgramFiles(x86)%\microsoft shared\Help\dexplore.exe
%CommonProgramFiles(x86)%\PX Storage Engine\pxinsa64.exe
%ProgramFiles(x86)%\Google\Chrome\Application\42.0.2311.135\Installer\chrmstp.exe
%ProgramFiles(x86)%\Google\Chrome\Application\42.0.2311.135\Installer\setup.exe
%ProgramFiles(x86)%\Google\Chrome\Application\42.0.2311.135\nacl64.exe
%ProgramFiles(x86)%\Google\Chrome\Application\chrome.exe
%ProgramFiles(x86)%\Google\Update\1.3.26.9\GoogleCrashHandler.exe
%ProgramFiles(x86)%\Google\Update\1.3.26.9\GoogleCrashHandler64.exe
%CommonProgramFiles(x86)%\PX Storage Engine\pxinsi64.exe
%CommonProgramFiles(x86)%\Steam\SteamService.exe
%ProgramFiles(x86)%\Google\Chrome\Application\42.0.2311.135\delegate_execute.exe
%HOMEPATH%\Downloads\SteamSetup.exe
%ProgramFiles(x86)%\Google\Update\1.3.26.9\GoogleUpdate.exe
%CommonProgramFiles(x86)%\Adobe\ARM\1.0\AdobeARMHelper.exe
C:\MSOCache\All Users\{90140000-0011-0000-1000-0000000FF1CE}-C\setup.exe
C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\DW20.EXE
C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\dwtrig20.exe
%ProgramFiles(x86)%\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe
%ProgramFiles(x86)%\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
%ProgramFiles(x86)%\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe
%ProgramFiles(x86)%\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
%CommonProgramFiles(x86)%\Adobe\ARM\1.0\armsvc.exe
%CommonProgramFiles(x86)%\Java\Java Update\jaureg.exe
%ProgramFiles(x86)%\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe
%ProgramFiles(x86)%\Adobe\Acrobat Reader DC\Reader\arh.exe
%ProgramFiles(x86)%\Adobe\Acrobat Reader DC\Reader\Eula.exe
%ProgramFiles(x86)%\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe
%ProgramFiles(x86)%\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe
%ProgramFiles(x86)%\Adobe\Acrobat Reader DC\Reader\reader_sl.exe
%ProgramFiles(x86)%\Adobe\Acrobat Reader DC\Reader\wow_helper.exe
%CommonProgramFiles(x86)%\Adobe\ARM\1.0\AdobeARM.exe
C:\MSOCache\All Users\{90140000-0011-0000-1000-0000000FF1CE}-C\ose.exe
%ProgramFiles(x86)%\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe
%HOMEPATH%\desktop\notepad.exe
%ProgramFiles(x86)%\Google\Update\1.3.26.9\GoogleUpdateBroker.exe
%ProgramFiles(x86)%\Google\Update\1.3.26.9\GoogleUpdateSetup.exe
%ProgramFiles(x86)%\Microsoft.NET\SDK\v1.1\Bin\Jbimp.exe
%ProgramFiles(x86)%\Microsoft.NET\SDK\v1.1\Bin\mscordmp.exe
%ProgramFiles(x86)%\Microsoft.NET\SDK\v1.1\Bin\nmake.exe
%ProgramFiles(x86)%\Microsoft.NET\SDK\v1.1\Bin\PermView.exe
%ProgramFiles(x86)%\Microsoft.NET\SDK\v1.1\Bin\PEVerify.exe
%ProgramFiles(x86)%\Microsoft.NET\SDK\v1.1\Bin\setreg.exe
%ProgramFiles(x86)%\Microsoft.NET\SDK\v1.1\Bin\sn.exe
%ProgramFiles(x86)%\Google\Update\1.3.26.9\GoogleUpdateComRegisterShell64.exe
%ProgramFiles(x86)%\Microsoft.NET\SDK\v1.1\Bin\ildasm.exe
%ProgramFiles(x86)%\Microsoft.NET\SDK\v1.1\Bin\gacutil.exe
%ProgramFiles(x86)%\Microsoft.NET\SDK\v1.1\Bin\xsd.exe
%ProgramFiles(x86)%\Microsoft.NET\SDK\v1.1\GuiDebug\DbgCLR.exe
%ProgramFiles(x86)%\mIRC\mirc.exe
%ProgramFiles(x86)%\mIRC\uninstall.exe
%ProgramFiles(x86)%\Mozilla Firefox\crashreporter.exe
%ProgramFiles(x86)%\Mozilla Firefox\maintenanceservice.exe
%ProgramFiles(x86)%\Mozilla Firefox\maintenanceservice_installer.exe
%ProgramFiles(x86)%\Microsoft.NET\SDK\v1.1\Bin\WinCV.exe
%ProgramFiles(x86)%\Microsoft.NET\SDK\v1.1\Bin\wsdl.exe
%ProgramFiles(x86)%\Google\Update\1.3.26.9\GoogleUpdateOnDemand.exe
%ProgramFiles(x86)%\Microsoft.NET\SDK\v1.1\Bin\WinRes.exe
%CommonProgramFiles(x86)%\Java\Java Update\jusched.exe
%ProgramFiles(x86)%\Google\Update\1.3.26.9\GoogleUpdateWebPlugin.exe
%ProgramFiles(x86)%\Google\Update\GoogleUpdate.exe
%ProgramFiles(x86)%\K-Lite Codec Pack\Filters\Haali\dsmux.exe
%ProgramFiles(x86)%\K-Lite Codec Pack\Filters\Haali\gdsmux.exe
%ProgramFiles(x86)%\K-Lite Codec Pack\MPC-HC64\mpc-hc64.exe
%ProgramFiles(x86)%\K-Lite Codec Pack\Tools\CodecTweakTool.exe
%ProgramFiles(x86)%\K-Lite Codec Pack\Tools\GraphStudioNext.exe
%ProgramFiles(x86)%\Microsoft.NET\SDK\v1.1\Bin\certmgr.exe
%ProgramFiles(x86)%\Microsoft.NET\SDK\v1.1\Bin\disco.exe
%ProgramFiles(x86)%\Microsoft.NET\SDK\v1.1\Bin\cordbg.exe
%ProgramFiles(x86)%\K-Lite Codec Pack\Tools\SetACL_x86.exe
%ProgramFiles(x86)%\K-Lite Codec Pack\unins000.exe
%ProgramFiles(x86)%\Microsoft Office\Office14\MSOHTMED.EXE
%ProgramFiles(x86)%\Microsoft Visual Studio .NET 2003\Common7\Packages\Debugger\ManagedDbgCA.exe
%ProgramFiles(x86)%\Microsoft Visual Studio .NET 2003\Vc7\bin\cl.exe
%ProgramFiles(x86)%\Microsoft Visual Studio .NET 2003\Vc7\bin\link.exe
%ProgramFiles(x86)%\Microsoft.NET\SDK\v1.1\Bin\AxImp.exe
%ProgramFiles(x86)%\K-Lite Codec Pack\Tools\GraphStudioNext64.exe
%ProgramFiles(x86)%\K-Lite Codec Pack\Tools\SetACL_x64.exe
%HOMEPATH%\Downloads\tcmd851ax64.exe

Modifies file system

Creates the following files

%TEMP%\3582-490\<File name>.exe
%WINDIR%\svchost.com
%TEMP%\nstb2d8.tmp
%TEMP%\~nsu.tmp\au_.exe
%TEMP%\nszb51a.tmp
%TEMP%\nszb569.tmp\modern-header.bmp

Miscellaneous

Searches for the following windows

ClassName: '#32770' WindowName: ''

Creates and executes the following

'%TEMP%\3582-490\<File name>.exe'
'%TEMP%\~nsu.tmp\au_.exe' _?=%TEMP%\3582-490\

Technologies

Terminology

Training and education

Myths

Technical Information