Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'NscAuth' = '%ProgramFiles%\Authenticate Client\NscAuth.exe'
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\NscAuthService] 'ImagePath' = '%ProgramFiles%\Authenticate Client\NscAuthService.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\NscAuthService] 'Start' = '00000002'
Malicious functions:
To bypass firewall, removes or modifies the following registry keys:
- [<HKLM>\SYSTEM\ControlSet002\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List] '%ProgramFiles%\Authenticate Client\uninstall.exe' = '%ProgramFiles%\Auth...
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%ProgramFiles%\Authenticate Client\uninstall.exe' = '%ProgramFiles%\Au...
- [<HKLM>\SYSTEM\ControlSet002\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%ProgramFiles%\Authenticate Client\uninstall.exe' = '%ProgramFiles%\Au...
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List] '%ProgramFiles%\Authenticate Client\uninstall.exe' = '%ProgramFiles%\Auth...
- [<HKLM>\SYSTEM\ControlSet002\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List] '%ProgramFiles%\Authenticate Client\NscAuth.exe' = '%ProgramFiles%\Authen...
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%ProgramFiles%\Authenticate Client\NscAuth.exe' = '%ProgramFiles%\Auth...
- [<HKLM>\SYSTEM\ControlSet002\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%ProgramFiles%\Authenticate Client\NscAuth.exe' = '%ProgramFiles%\Auth...
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List] '%ProgramFiles%\Authenticate Client\NscAuth.exe' = '%ProgramFiles%\Authen...
Executes the following:
- '<SYSTEM32>\netsh.exe' advfirewall firewall add rule name=\"їН»§¶ЛР¶ФШ\" program=\"%ProgramFiles%\Authenticate Client\uninstall.exe\" dir=out action=allow
- '<SYSTEM32>\taskkill.exe' /F /IM install.exe
- '<SYSTEM32>\netsh.exe' advfirewall firewall add rule name=\"їН»§¶ЛР¶ФШ\" program=\"%ProgramFiles%\Authenticate Client\uninstall.exe\" dir=in action=allow
- '<SYSTEM32>\netsh.exe' advfirewall firewall add rule name=\"ИПЦ¤їН»§¶Л\" program=\"%ProgramFiles%\Authenticate Client\NscAuth.exe\" dir=in action=allow
- '<SYSTEM32>\netsh.exe' advfirewall firewall add rule name=\"ИПЦ¤їН»§¶Л\" program=\"%ProgramFiles%\Authenticate Client\NscAuth.exe\" dir=out action=allow
Searches for windows to
detect programs and games:
- ClassName: 'MSBLWindowClass', WindowName: ''
- ClassName: 'TXGuiFoundation', WindowName: ''
Modifies file system:
Creates the following files:
- %ALLUSERSPROFILE%\Start Menu\Programs\Authenticate Client\Р¶ФШ.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\Authenticate Client\ИПЦ¤їН»§¶Л.lnk
- %ALLUSERSPROFILE%\Desktop\ИПЦ¤їН»§¶Л.lnk
- %ProgramFiles%\Authenticate Client\IcgAuthClient.conf
- %ALLUSERSPROFILE%\Application Data\Authenticate Client\IcgAuthClient.conf
- %ALLUSERSPROFILE%\Application Data\Authenticate Client\AdAuth.log
- %ProgramFiles%\nsc\del.bat
- %ALLUSERSPROFILE%\Application Data\ins.log
- %ProgramFiles%\nsc\nscmk.dll
- %ProgramFiles%\nsc\IcgAuthClient.conf
- %ProgramFiles%\nsc\uninstall.exe
- %ProgramFiles%\nsc\RealLog.dll
- %ProgramFiles%\nsc\NscAuthService.exe
- %ProgramFiles%\nsc\NscAuth.exe
- %ProgramFiles%\nsc\install.exe
Moves the following files:
- from %ProgramFiles%\nsc\RealLog.dll to %ProgramFiles%\Authenticate Client\RealLog.dll
- from %ProgramFiles%\nsc\IcgAuthClient.conf to %ALLUSERSPROFILE%\Application Data\Authenticate Client\IcgAuthClient.conf
- from %ProgramFiles%\nsc\uninstall.exe to %ProgramFiles%\Authenticate Client\uninstall.exe
- from %ProgramFiles%\nsc\NscAuth.exe to %ProgramFiles%\Authenticate Client\NscAuth.exe
- from %ProgramFiles%\nsc\NscAuthService.exe to %ProgramFiles%\Authenticate Client\NscAuthService.exe
- from %ProgramFiles%\nsc\nscmk.dll to %ProgramFiles%\Authenticate Client\nscmk.dll
Network activity:
Connects to:
- '21#.#00.26.34':2223
Miscellaneous:
Searches for the following windows:
- ClassName: 'tSkMainForm.UnicodeClass' WindowName: ''
- ClassName: '' WindowName: ''
- ClassName: 'EDIT' WindowName: ''
Creates and executes the following:
- '%ProgramFiles%\Authenticate Client\NscAuth.exe'
- '%ProgramFiles%\Authenticate Client\NscAuthService.exe'
- '%ProgramFiles%\nsc\install.exe'
Executes the following:
- '<SYSTEM32>\cmd.exe' /s /c "netsh advfirewall firewall add rule name=\"їН»§¶ЛР¶ФШ\" program=\"%ProgramFiles%\Authenticate Client\uninstall.exe\" dir=out action=allow"
- '<SYSTEM32>\cmd.exe' /c del.bat
- '<SYSTEM32>\cmd.exe' /s /c "netsh advfirewall firewall add rule name=\"їН»§¶ЛР¶ФШ\" program=\"%ProgramFiles%\Authenticate Client\uninstall.exe\" dir=in action=allow"
- '<SYSTEM32>\cmd.exe' /s /c "netsh advfirewall firewall add rule name=\"ИПЦ¤їН»§¶Л\" program=\"%ProgramFiles%\Authenticate Client\NscAuth.exe\" dir=in action=allow"
- '<SYSTEM32>\cmd.exe' /s /c "netsh advfirewall firewall add rule name=\"ИПЦ¤їН»§¶Л\" program=\"%ProgramFiles%\Authenticate Client\NscAuth.exe\" dir=out action=allow"
