Technical Information
Malicious functions:
Creates and executes the following:
- '' (downloaded from the Internet)
Modifies file system:
Creates the following files:
- %TEMP%\nsw2.tmp\System.dll
- %TEMP%\nsw2.tmp\2.gif
- %TEMP%\nsw2.tmp\Inetc.dll
- %TEMP%\nsw2.tmp\21.tmp
- %TEMP%\nsw2.tmp\ZipDLL.dll
- %TEMP%\nsw2.tmp\Browser_V5.5.7852.9_r_4640_(Build1512022057).exe
- %TEMP%\nsw2.tmp\1332280.exe
- %TEMP%\nsw2.tmp\24.tmp
- %TEMP%\nsw2.tmp\25.tmp
- %TEMP%\nsw2.tmp\Base64.dll
- %TEMP%\nsw2.tmp\26.tmp
- %TEMP%\nsw2.tmp\Baidu_Setup_2.2.200.1470_ftn_1050123299.exe
- %TEMP%\nsw2.tmp\28.tmp
- %TEMP%\nsw2.tmp\29.tmp
- %TEMP%\nsw2.tmp\31.tmp
Deletes the following files:
- %TEMP%\nsw2.tmp\1332280.exe
- %TEMP%\nsw2.tmp\2.gif
- %TEMP%\nsw2.tmp\21.tmp
- %TEMP%\nsw2.tmp\24.tmp
- %TEMP%\nsw2.tmp\25.tmp
- %TEMP%\nsw2.tmp\26.tmp
- %TEMP%\nsw2.tmp\28.tmp
- %TEMP%\nsw2.tmp\29.tmp
- %TEMP%\nsw2.tmp\31.tmp
- %TEMP%\nsw2.tmp\Baidu_Setup_2.2.200.1470_ftn_1050123299.exe
- %TEMP%\nsw2.tmp\Base64.dll
- %TEMP%\nsw2.tmp\Browser_V5.5.7852.9_r_4640_(Build1512022057).exe
- %TEMP%\nsw2.tmp\Inetc.dll
- %TEMP%\nsw2.tmp\System.dll
- %TEMP%\nsw2.tmp\ZipDLL.dll
Network activity:
Connects to:
- 'ww#.#inaimg.cn':80
- 'do##2.uc.cn':80
- 'dl.#kiki.cn':80
- 'localhost':1043
- '12#.#5.251.148':80
- '12#.#25.114.144':80
- 'r.#####.store.qq.com':80
TCP:
HTTP GET requests:
- http://ww#.#inaimg.cn/large/7185bdf1gw1f05vpdktqrg20go0a5u10.gif
- http://do##2.uc.cn/pcbrowser/down.php?pi######
- http://dl.#kiki.cn/dl/rse/1332280.exe
- http://ww#.#inaimg.cn/large/7185bdf1gw1f1bdh829cwg20rt0m7tpt.gif
- http://ww#.#inaimg.cn/large/7185bdf1gw1f1bdmnkko3g20rs0774qp.gif
- http://12#.#5.251.148/YjY2MmVmNDkuZXhl/40.html
- http://ww#.#inaimg.cn/large/7185bdf1gw1f187rxzjovg20m10f9nmv.gif
- http://dl##.#r.baidu.com/ditui/zujian/Baidu_Setup_2.2.200.1470_ftn_1050123299.exe via 12#.#25.114.144
- http://ww#.#inaimg.cn/large/7185bdf1gw1f0copg2ejkg207o08ce84.gif
- http://r.#####.store.qq.com/psb?/V#########################################################################
UDP:
- DNS ASK ww#.#inaimg.cn
- DNS ASK do##2.uc.cn
- DNS ASK dl.#kiki.cn
- DNS ASK dl##.#r.baidu.com
- DNS ASK r.#####.store.qq.com
Miscellaneous:
Searches for the following windows:
- ClassName: '#32770' WindowName: ''
- ClassName: '' WindowName: ''
- ClassName: 'IEFrame' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebcheckMonitor' WindowName: ''
Creates and executes the following:
- '%TEMP%\nsw2.tmp\Browser_V5.5.7852.9_r_4640_(Build1512022057).exe'
- '%TEMP%\nsw2.tmp\1332280.exe'
- '%TEMP%\nsw2.tmp\Baidu_Setup_2.2.200.1470_ftn_1050123299.exe'
Executes the following:
- '%ProgramFiles%\Internet Explorer\IEXPLORE.EXE' -nohome
