Technical Information
Malicious functions:
Creates and executes the following:
- '%ALLUSERSPROFILE%\Application Data\AMMYY\wmihost.exe' -outid
- '%TEMP%\nsc3.tmp\nsD.tmp' taskkill /f /t /im wmihost.exe
- '%TEMP%\tmp2.exe' x %TEMP%\tmp1 -p1234554321 -o"%ALLUSERSPROFILE%\Application Data\AMMYY" -aoa
- '%ALLUSERSPROFILE%\Application Data\AMMYY\wmihost.exe' -getid -nogui
- '%TEMP%\nsc3.tmp\nsE.tmp' tskill wmihost
- '%TEMP%\nsc3.tmp\ns11.tmp' taskkill /f /t /im wmihost.exe
- '%TEMP%\nsc3.tmp\ns12.tmp' tskill wmihost
- '%TEMP%\nsc3.tmp\nsF.tmp' taskkill /f /t /im wmihost.exe
- '%TEMP%\nsc3.tmp\ns10.tmp' tskill wmihost
- '%TEMP%\nsc3.tmp\ns6.tmp' "net.exe" stop ammyy /y
- '%TEMP%\nsc3.tmp\ns7.tmp' "sc.exe" delete ammyy /y
- '%TEMP%\nsc3.tmp\ns4.tmp' taskkill /f /t /im wmihost.exe
- '%TEMP%\nsc3.tmp\ns5.tmp' tskill wmihost
- '%TEMP%\nsc3.tmp\ns8.tmp' "net.exe" stop ammyyadmin /y
- '%TEMP%\nsc3.tmp\nsB.tmp' "reg.exe" delete HKCU\Software\Ammyy /f
- '%TEMP%\nsc3.tmp\nsC.tmp' %TEMP%\tmp2.exe x %TEMP%\tmp1 -p1234554321 -o"%ALLUSERSPROFILE%\Application Data\AMMYY" -aoa
- '%TEMP%\nsc3.tmp\ns9.tmp' "sc.exe" delete ammyyadmin /y
- '%TEMP%\nsc3.tmp\nsA.tmp' "reg.exe" delete HKLM\Software\Ammyy /f
Executes the following:
- '<SYSTEM32>\net1.exe' stop ammyyadmin /y
- '<SYSTEM32>\net.exe' stop ammyyadmin /y
- '<SYSTEM32>\sc.exe' delete ammyyadmin /y
- '<SYSTEM32>\reg.exe' delete HKCU\Software\Ammyy /f
- '<SYSTEM32>\reg.exe' delete HKLM\Software\Ammyy /f
- '<SYSTEM32>\tskill.exe' wmihost
- '<SYSTEM32>\taskkill.exe' /f /t /im wmihost.exe
- '<SYSTEM32>\net.exe' stop ammyy /y
- '<SYSTEM32>\sc.exe' delete ammyy /y
- '<SYSTEM32>\net1.exe' stop ammyy /y
Modifies file system :
Creates the following files:
- %ALLUSERSPROFILE%\Application Data\AMMYY\hr
- %ALLUSERSPROFILE%\Application Data\AMMYY\hr3
- %ALLUSERSPROFILE%\Application Data\AMMYY\ammyy_id.log
- %TEMP%\nsc3.tmp\nsC.tmp
- %ALLUSERSPROFILE%\Application Data\AMMYY\settings3.bin
- %ALLUSERSPROFILE%\Application Data\AMMYY\wmihost.exe
- %ALLUSERSPROFILE%\Application Data\AMMYY\wmihost.log
- %TEMP%\nsc3.tmp\ns10.tmp
- %TEMP%\nsc3.tmp\ns11.tmp
- %TEMP%\nsc3.tmp\ns12.tmp
- %TEMP%\nsc3.tmp\nsD.tmp
- %TEMP%\nsc3.tmp\nsE.tmp
- %TEMP%\nsc3.tmp\nsF.tmp
- %TEMP%\tmp2
- %TEMP%\nsc3.tmp\ns4.tmp
- %TEMP%\nsc3.tmp\ns5.tmp
- %TEMP%\nsx2.tmp
- %TEMP%\nsc3.tmp\System.dll
- %TEMP%\nsc3.tmp\nsExec.dll
- %TEMP%\nsc3.tmp\ns6.tmp
- %TEMP%\nsc3.tmp\nsA.tmp
- %TEMP%\nsc3.tmp\nsB.tmp
- %TEMP%\tmp1
- %TEMP%\nsc3.tmp\ns7.tmp
- %TEMP%\nsc3.tmp\ns8.tmp
- %TEMP%\nsc3.tmp\ns9.tmp
Deletes the following files:
- %TEMP%\nsc3.tmp\nsE.tmp
- %TEMP%\nsc3.tmp\nsD.tmp
- %TEMP%\nsc3.tmp\nsC.tmp
- %TEMP%\nsc3.tmp\nsF.tmp
- %TEMP%\nsc3.tmp\ns12.tmp
- %TEMP%\nsc3.tmp\ns11.tmp
- %TEMP%\nsc3.tmp\ns10.tmp
- %TEMP%\nsc3.tmp\nsB.tmp
- %TEMP%\nsc3.tmp\ns6.tmp
- %TEMP%\nsc3.tmp\ns5.tmp
- %TEMP%\nsc3.tmp\ns4.tmp
- %TEMP%\nsc3.tmp\ns7.tmp
- %TEMP%\nsc3.tmp\nsA.tmp
- %TEMP%\nsc3.tmp\ns9.tmp
- %TEMP%\nsc3.tmp\ns8.tmp
Moves the following files:
- from %TEMP%\tmp2 to %TEMP%\tmp2.exe
Network activity:
Connects to:
- 'rl.##myy.com':80
TCP:
HTTP POST requests:
- rl.##myy.com/
UDP:
- DNS ASK rl.##myy.com
Miscellaneous:
Searches for the following windows:
- ClassName: '' WindowName: ''
