Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\nvidianspector
Malicious functions
Searches for windows to
detect analytical utilities:
- ClassName: 'FilemonClass', WindowName: ''
- ClassName: 'PROCMON_WINDOW_CLASS', WindowName: ''
- ClassName: 'RegmonClass', WindowName: ''
Modifies file system
Creates the following files
- %TEMP%\gamehelpers.exe
- %TEMP%\csc95b9.tmp
- %TEMP%\qklh1oly.out
- %TEMP%\qklh1oly.cmdline
- %TEMP%\qklh1oly.0.cs
- %TEMP%\jw3i4gc5.dll
- %TEMP%\resb432.tmp
- %TEMP%\cscb422.tmp
- %TEMP%\jw3i4gc5.out
- %TEMP%\jw3i4gc5.cmdline
- %TEMP%\jw3i4gc5.0.cs
- %TEMP%\mtzdkprm.dll
- %TEMP%\res9953.tmp
- %TEMP%\csc9952.tmp
- %TEMP%\mtzdkprm.out
- %TEMP%\mtzdkprm.cmdline
- %TEMP%\mtzdkprm.0.cs
- %APPDATA%\toexternal\javascriptpipe.exe.config
- %APPDATA%\toexternal\javascriptpipe.exe
- %TEMP%\01wku2pe.dll
- %TEMP%\res7c32.tmp
- %TEMP%\csc7c31.tmp
- %TEMP%\01wku2pe.out
- %TEMP%\01wku2pe.cmdline
- %TEMP%\01wku2pe.0.cs
- <Current directory>\gamehelper.exe
- %TEMP%\res95ba.tmp
- %TEMP%\qklh1oly.dll
Sets the 'hidden' attribute to the following files
- %APPDATA%\toexternal\javascriptpipe.exe
Deletes the following files
- %TEMP%\res7c32.tmp
- %TEMP%\qklh1oly.dll
- %TEMP%\qklh1oly.out
- %TEMP%\csc95b9.tmp
- %TEMP%\res95ba.tmp
- %TEMP%\jw3i4gc5.out
- %TEMP%\jw3i4gc5.0.cs
- %TEMP%\jw3i4gc5.dll
- %TEMP%\jw3i4gc5.cmdline
- %TEMP%\cscb422.tmp
- %TEMP%\resb432.tmp
- %TEMP%\mtzdkprm.cmdline
- %TEMP%\mtzdkprm.out
- %TEMP%\mtzdkprm.dll
- %TEMP%\mtzdkprm.0.cs
- %TEMP%\csc9952.tmp
- %TEMP%\res9953.tmp
- %TEMP%\01wku2pe.out
- %TEMP%\01wku2pe.cmdline
- %TEMP%\01wku2pe.0.cs
- %TEMP%\01wku2pe.dll
- %TEMP%\csc7c31.tmp
- %TEMP%\qklh1oly.0.cs
- %TEMP%\qklh1oly.cmdline
Network activity
Connects to
- 'localhost':1111
- '49###.##ient.sudorat.top':49810
- '12#.#9.46.185':49810
UDP
- DNS ASK 49###.##ient.sudorat.top
- DNS ASK 49###.#lient.sudorat.ru
Miscellaneous
Searches for the following windows
- ClassName: 'File Monitor - Sysinternals: www.sysinternals.com' WindowName: ''
- ClassName: 'Process Monitor - Sysinternals: www.sysinternals.com' WindowName: ''
- ClassName: 'Registry Monitor - Sysinternals: www.sysinternals.com' WindowName: ''
- ClassName: '18467-41' WindowName: ''
Creates and executes the following
- '%TEMP%\gamehelpers.exe'
- '<Current directory>\gamehelper.exe'
- '%APPDATA%\toexternal\javascriptpipe.exe'
- '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\01wku2pe.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES7C32.tmp" "%TEMP%\CSC7C31.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\mtzdkprm.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES9953.tmp" "%TEMP%\CSC9952.tmp"' (with hidden window)
- '%APPDATA%\toexternal\javascriptpipe.exe' ' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\jw3i4gc5.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESB432.tmp" "%TEMP%\CSCB422.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\qklh1oly.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES95BA.tmp" "%TEMP%\CSC95B9.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\3yfv1i0l.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESD5F5.tmp" "%TEMP%\CSCD5F4.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\qmtlfdv1.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES6AE3.tmp" "%TEMP%\CSC6AE2.tmp"' (with hidden window)
Executes the following
- '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\01wku2pe.cmdline"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES7C32.tmp" "%TEMP%\CSC7C31.tmp"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\mtzdkprm.cmdline"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES9953.tmp" "%TEMP%\CSC9952.tmp"
- '<SYSTEM32>\taskeng.exe' {8113B1C8-5116-421A-B931-97C8CF4C2771} S-1-5-21-1238866942-1249195528-555854008-1000:qtvuduivypm\user:Interactive:[1]
- '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\jw3i4gc5.cmdline"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESB432.tmp" "%TEMP%\CSCB422.tmp"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\qklh1oly.cmdline"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES95BA.tmp" "%TEMP%\CSC95B9.tmp"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\3yfv1i0l.cmdline"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESD5F5.tmp" "%TEMP%\CSCD5F4.tmp"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe' /noconfig /fullpaths @"%TEMP%\qmtlfdv1.cmdline"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES6AE3.tmp" "%TEMP%\CSC6AE2.tmp"
