Technical Information
To ensure autorun and distribution
Sets the following service settings
- [HKLM\System\CurrentControlSet\Services\nvSoftHelpEx] 'Start' = '00000002'
- [HKLM\System\CurrentControlSet\Services\nvSoftHelpEx] 'ImagePath' = '%APPDATA%\nvSoftHelpEx\nvSoftHelpEx.exe'
- [HKLM\System\CurrentControlSet\Services\LcScience] 'Start' = '00000001'
- [HKLM\System\CurrentControlSet\Services\LcScience] 'ImagePath' = '<DRIVERS>\LcScience64.sys'
- [HKLM\System\CurrentControlSet\Services\DxHgFilter] 'Start' = '00000001'
- [HKLM\System\CurrentControlSet\Services\DxHgFilter] 'ImagePath' = '<DRIVERS>\DxHgFilter64.sys'
Creates the following services
- 'nvSoftHelpEx' %APPDATA%\nvSoftHelpEx\nvSoftHelpEx.exe
- 'LcScience' <DRIVERS>\LcScience64.sys
- 'DxHgFilter' <DRIVERS>\DxHgFilter64.sys
Modifies file system
Creates the following files
- %TEMP%\{1bb303c3-68e6-456e-b529-201ff55285f2}\dtmp.zd
- %APPDATA%\nvsofthelpex\bime.dll
- %APPDATA%\nvsofthelpex\nvsofthelpex.exe
- <DRIVERS>\lcscience64.sys
- <DRIVERS>\dxhgfilter64.sys
- %TEMP%\nvmultitasking\lcscience64.sys
- %TEMP%\nvmultitasking\lcscience.sys
- %TEMP%\nvmultitasking\dxhgfilter64.sys
- %TEMP%\nvmultitasking\dxhgfilter.sys
- %APPDATA%\nvsofthelpex\countly.sqlite-journal
- %TEMP%\nvmultitasking\bime.dll
- %TEMP%\nvmultitasking\decrypt.7z
- %TEMP%\nvmultitasking\encrypt.7z
- %LOCALAPPDATA%low\juziplugin\1.0.0.1020\npjuziplugin.dll
- %TEMP%\{1bb303c3-68e6-456e-b529-201ff55285f2}\nvmultitask.exe
- <Current directory>\countly.sqlite
- %TEMP%\{1bb303c3-68e6-456e-b529-201ff55285f2}\npjuziplugin.dll
- <Current directory>\countly.sqlite-journal
- %TEMP%\{1bb303c3-68e6-456e-b529-201ff55285f2}\dtmp.z
- %TEMP%\nvmultitasking\nvsofthelpex.exe
- %APPDATA%\nvsofthelpex\countly.sqlite
Deletes the following files
- %TEMP%\{1bb303c3-68e6-456e-b529-201ff55285f2}\dtmp.zd
- %TEMP%\{1bb303c3-68e6-456e-b529-201ff55285f2}\dtmp.z
- <Current directory>\countly.sqlite-journal
- %TEMP%\nvmultitasking\bime.dll
- %TEMP%\nvmultitasking\decrypt.7z
- %TEMP%\nvmultitasking\dxhgfilter.sys
- %TEMP%\nvmultitasking\dxhgfilter64.sys
- %TEMP%\nvmultitasking\encrypt.7z
- %TEMP%\nvmultitasking\lcscience.sys
- %TEMP%\nvmultitasking\lcscience64.sys
- %TEMP%\nvmultitasking\nvsofthelpex.exe
- %APPDATA%\nvsofthelpex\countly.sqlite-journal
- %TEMP%\{1bb303c3-68e6-456e-b529-201ff55285f2}\npjuziplugin.dll
- %TEMP%\{1bb303c3-68e6-456e-b529-201ff55285f2}\nvmultitask.exe
Substitutes the following files
- <Current directory>\countly.sqlite-journal
- %APPDATA%\nvsofthelpex\countly.sqlite-journal
Network activity
Connects to
- 'lo#.#23juzi.net':80
- 'up####.123juzi.net':80
- 'op####ft.hao123.com':80
- 'sk##n.com':80
- 'sk##n.com':443
- 'or####.hao123.com':80
- 'im#.#ao123.com':443
TCP
HTTP GET requests
- http://lo#.#23juzi.net/log.php?ty################################################################################################################################################################...
- http://up####.123juzi.net/ntflp.php
- http://op####ft.hao123.com/uploads/member/2014/0609/2014060915002953955b8d41210.jpg
- http://www.sk##n.com/
- http://up####.123juzi.net/update.php?ge##########################################################################################################################################################...
- http://or####.hao123.com/common/cmsone?cm##############################
Other
- 'sk##n.com':443
- 'im#.#ao123.com':443
UDP
- DNS ASK se####e.123juzi.com
- DNS ASK lo#.#23juzi.net
- DNS ASK up####.123juzi.net
- DNS ASK op####ft.hao123.com
- DNS ASK sk##n.com
- DNS ASK or####.hao123.com
- DNS ASK im#.#ao123.com
- DNS ASK to####.juzi1234567.com
Miscellaneous
Creates and executes the following
- '%TEMP%\{1bb303c3-68e6-456e-b529-201ff55285f2}\nvmultitask.exe' --cid=
- '%APPDATA%\nvsofthelpex\nvsofthelpex.exe' -install
- '%APPDATA%\nvsofthelpex\nvsofthelpex.exe'
Executes the following
- '<SYSTEM32>\cmd.exe' /c del /q /f "%TEMP%\{1BB303C3-68E6-456E-B529-201FF55285F2}\nvMultitask.exe"
- '<SYSTEM32>\cmd.exe' /c move "%TEMP%\{1BB303C3-68E6-456E-B529-201FF55285F2}\nvMultitask.exe" %TEMP%\E36B.tmp
- '%APPDATA%\nvsofthelpex\nvsofthelpex.exe' -install' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c del /q /f "%TEMP%\{1BB303C3-68E6-456E-B529-201FF55285F2}\nvMultitask.exe"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c move "%TEMP%\{1BB303C3-68E6-456E-B529-201FF55285F2}\nvMultitask.exe" %TEMP%\E36B.tmp' (with hidden window)
