SHA1:
- d7d7fe73e3288e4b1e7be5a460e55c0925465428
- d8dabb84e4ab75fd1dc0ec806933d60b5c693bd2
- 322c660e644af0930476e6540dce7da6d4b06e39 (work.js)
- 8db6aa47181d8cf2f5f1f60db33b380d8b24ced4 (install.js)
Description
A module of the MonsterInstall trojan.
Operating routine
First, the trojan creates the Global\cortel-install mutex. Then it creates the %WINDIR%\NodeService\0\ folder and unpacks its data in it by calling:
data/7za.exe x data/new-node.bin -o"%WINDIR%\NodeService\0\" –y
Then it launches:
%WINDIR%/NodeService/0/node.exe %WINDIR%/NodeService/0/install.js
%WINDIR%/NodeService/0/node.exe data/work.js
The work.js file reads data.json and opens the link specified in the “link” field.
install.js installs the trojan in autorun using Windows Scheduler.