Technical Information
Malicious functions:
Creates and executes the following:
- '%TEMP%\nsi2.tmp\ns4.tmp' wmic /NAMESPACE:\\root\CIMV2 path Win32_Processor get ProcessorId
- '%TEMP%\nsi2.tmp\ns8.tmp' wmic /NAMESPACE:\\root\CIMV2 path Win32_UserAccount.name='andy' get SID
- '<LS_APPDATA>\Google\Chrome\User Data\Default\updPleerInfo.exe' -chrome
- '%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\smilehelp.exe' -firefox
- '%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\updateSm.exe'
Executes the following:
- '<SYSTEM32>\wbem\wmic.exe' /NAMESPACE:\\root\CIMV2 path Win32_UserAccount.name='andy' get SID
- '<SYSTEM32>\wbem\wmic.exe' /NAMESPACE:\\root\CIMV2 path Win32_Processor get ProcessorId
Terminates or attempts to terminate
the following user processes:
- chrome.exe
- firefox.exe
- iexplore.exe
- opera.exe
Modifies file system :
Creates the following files:
- %TEMP%\nsi2.tmp\ns4.tmp
- %TEMP%\tmp5.tmp
- %TEMP%\tmp6.tmp
- %TEMP%\nsi2.tmp\nsExec.dll
- <LS_APPDATA>\Opera\Opera\widgets\widgets.dat
- <LS_APPDATA>\Opera\Opera\widgets\nsj3.tmp
- %TEMP%\nsi2.tmp\System.dll
- %TEMP%\nsi2.tmp\ns8.tmp
- %TEMP%\nsi2.tmp\md5dll.dll
- %TEMP%\nsi2.tmp\inetc.dll
- <LS_APPDATA>\Opera\Opera\widgets\TempWmicBatchFile.bat
- <SYSTEM32>\wbem\AutoRecover\C8463ECBE33BC240263A0B094E46D510.mof
- %TEMP%\tmp7.tmp
- <SYSTEM32>\wbem\AutoRecover\23BDE61F1F4FACE17E9B0C01F2A1FD9B.mof
- <LS_APPDATA>\Opera\Opera\widgets\wuid-c1172790-204a-884c-8cd5-67613e219aa1\prefs.dat
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\{718030f7-c27a-474f-9b0e-17a3a9e97398}\chrome\content\vksmiles.js
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\{718030f7-c27a-474f-9b0e-17a3a9e97398}\chrome\content\style.xul
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\{718030f7-c27a-474f-9b0e-17a3a9e97398}\install.rdf
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\{718030f7-c27a-474f-9b0e-17a3a9e97398}\chrome.manifest
- %TEMP%\nsi2.tmp\nsProcess.dll
- %TEMP%\smiles.xpi
- %TEMP%\nsi2.tmp\nsUnzip.dll
- <LS_APPDATA>\Google\Chrome\User Data\Default\updPleerInfo.exe
- <LS_APPDATA>\Opera\Opera\widgets\smiles.oex
- %TEMP%\opera.patch.txt
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions.json
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\smilehelp.exe
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions.sqlite-journal
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\updateSm.exe
Deletes the following files:
- %TEMP%\tmp6.tmp
- %TEMP%\tmp5.tmp
- %TEMP%\tmp7.tmp
- %TEMP%\nsi2.tmp\ns8.tmp
- %TEMP%\nsi2.tmp\ns4.tmp
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\smilehelp.exe
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions.sqlite-journal
- %APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\updateSm.exe
- <LS_APPDATA>\Opera\Opera\widgets\widgets.dat
- <LS_APPDATA>\Google\Chrome\User Data\Default\updPleerInfo.exe
Moves the following files:
- from <LS_APPDATA>\Opera\Opera\widgets\nsj3.tmp to <LS_APPDATA>\Opera\Opera\widgets\widgets.dat
Network activity:
Connects to:
- 'st###.cpastark.ru':80
TCP:
HTTP GET requests:
- st###.cpastark.ru/630/eydleF9zb2Z0JzonZmFsc2UnLCdleF9yZWZpZCc6NjMwLCdleF9zZXJpYWwnOiczMTg4OTU1ZGE4ZmIzMzEzOWVhNDE1OTQ1N2FlODc1ZF85Mid9
UDP:
- DNS ASK st###.cpastark.ru
Miscellaneous:
Searches for the following windows:
- ClassName: 'Chrome_WidgetWin_0' WindowName: '(null)'
- ClassName: 'Chrome_WidgetWin_1' WindowName: '(null)'
- ClassName: 'OpWindow' WindowName: '(null)'
- ClassName: 'IEFrame' WindowName: '(null)'
- ClassName: 'MozillaUIWindowClass' WindowName: '(null)'
