Technical Information
To ensure autorun and distribution:
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\srvBrowserProtect] 'Start' = '00000002'
Malicious functions:
Creates and executes the following:
- '%PROGRAM_FILES%\BrowserProtect\srvBrowserProtect.exe'
- '%TEMP%\nsr2.tmp\ns4.tmp' taskkill /f /im myproxy.exe
- '%TEMP%\nsr2.tmp\ns3.tmp' taskkill /f /im BrowserProtectIU.exe
Executes the following:
- '<SYSTEM32>\taskkill.exe' /f /im myproxy.exe
- '<SYSTEM32>\taskkill.exe' /f /im BrowserProtectIU.exe
Modifies file system :
Creates the following files:
- %TEMP%\nsp10.tmp
- %TEMP%\nsnF.tmp
- %TEMP%\nslE.tmp
- %TEMP%\nsp13.tmp
- %TEMP%\nsc12.tmp
- %TEMP%\nsl11.tmp
- %TEMP%\nsfA.tmp
- %TEMP%\nsd9.tmp
- %TEMP%\nsx8.tmp
- %TEMP%\nszD.tmp
- %TEMP%\nssC.tmp
- %TEMP%\nshB.tmp
- %TEMP%\nst1C.tmp
- %TEMP%\nso1B.tmp
- %TEMP%\nsd1A.tmp
- %PROGRAM_FILES%\BrowserProtect\versionBPSrvSw
- %PROGRAM_FILES%\BrowserProtect\updateSrv\updateBPSrv.zip
- %PROGRAM_FILES%\BrowserProtect\uninstall.exe
- %TEMP%\nsv16.tmp
- %TEMP%\nsi15.tmp
- %TEMP%\nsl14.tmp
- %TEMP%\nsr19.tmp
- %TEMP%\nse18.tmp
- %TEMP%\nsm17.tmp
- %TEMP%\nsq7.tmp
- %PROGRAM_FILES%\BrowserProtect\proxy\exclusions
- %PROGRAM_FILES%\BrowserProtect\proxy\config
- %TEMP%\nsr2.tmp\tkDecript.dll
- %PROGRAM_FILES%\BrowserProtect\proxy\zlibwapi.dll
- %PROGRAM_FILES%\BrowserProtect\proxy\myproxy.exe
- %PROGRAM_FILES%\BrowserProtect\proxy\matches
- %TEMP%\nsr2.tmp\ns3.tmp
- %TEMP%\nsr2.tmp\nsExec.dll
- %TEMP%\nsr2.tmp\SimpleSC.dll
- %TEMP%\nsr2.tmp\nsBR.dll
- %TEMP%\nsr2.tmp\System.dll
- %TEMP%\nsr2.tmp\ns4.tmp
- %PROGRAM_FILES%\BrowserProtect\search-with-eazelbar.xml
- %PROGRAM_FILES%\BrowserProtect\translations.xml
- %PROGRAM_FILES%\BrowserProtect\Newtonsoft.Json.dll
- %TEMP%\nsx6.tmp
- %TEMP%\nsy5.tmp
- %PROGRAM_FILES%\BrowserProtect\Web Data
- %PROGRAM_FILES%\BrowserProtect\BrowserProtectIUW8.exe
- %PROGRAM_FILES%\BrowserProtect\srvBrowserProtect.exe
- %PROGRAM_FILES%\BrowserProtect\BrowserProtectIU.exe
- %PROGRAM_FILES%\BrowserProtect\Interop.Shell32.dll
- %PROGRAM_FILES%\BrowserProtect\config.xml
- %PROGRAM_FILES%\BrowserProtect\srvBrowserProtectW8.exe
Deletes the following files:
- %TEMP%\nsr2.tmp\nsExec.dll
- %TEMP%\nsr2.tmp\nsBR.dll
- %PROGRAM_FILES%\BrowserProtect\proxy\config.old
- %TEMP%\nsr2.tmp\SimpleSC.dll
- %PROGRAM_FILES%\BrowserProtect\updateSrv\updateBPSrv.zip
- %TEMP%\nsr2.tmp\tkDecript.dll
- %TEMP%\nsr2.tmp\System.dll
- %PROGRAM_FILES%\BrowserProtect\BrowserProtectIUW8.exe
- %TEMP%\nsr2.tmp\ns4.tmp
- %TEMP%\nsr2.tmp\ns3.tmp
- %PROGRAM_FILES%\BrowserProtect\BrowserProtectIUW8.exe.config
- %PROGRAM_FILES%\BrowserProtect\config.xml.old
- %PROGRAM_FILES%\BrowserProtect\BrowserProtectIU.exe.config.old
- %PROGRAM_FILES%\BrowserProtect\srvBrowserProtectW8.exe
Moves the following files:
- from %TEMP%\nsl14.tmp to %PROGRAM_FILES%\BrowserProtect\config.xml
- from %TEMP%\nsi15.tmp to %PROGRAM_FILES%\BrowserProtect\config.xml
- from %TEMP%\nsv16.tmp to %PROGRAM_FILES%\BrowserProtect\config.xml
- from %TEMP%\nsl11.tmp to %PROGRAM_FILES%\BrowserProtect\config.xml
- from %TEMP%\nsc12.tmp to %PROGRAM_FILES%\BrowserProtect\config.xml
- from %TEMP%\nsp13.tmp to %PROGRAM_FILES%\BrowserProtect\config.xml
- from %TEMP%\nsm17.tmp to %PROGRAM_FILES%\BrowserProtect\config.xml
- from %TEMP%\nsd1A.tmp to %PROGRAM_FILES%\BrowserProtect\proxy\config
- from %TEMP%\nso1B.tmp to %PROGRAM_FILES%\BrowserProtect\proxy\config
- from %TEMP%\nst1C.tmp to %PROGRAM_FILES%\BrowserProtect\proxy\config
- from %TEMP%\nse18.tmp to %PROGRAM_FILES%\BrowserProtect\config.xml
- from %TEMP%\nsr19.tmp to %PROGRAM_FILES%\BrowserProtect\config.xml
- from %PROGRAM_FILES%\BrowserProtect\proxy\config to %PROGRAM_FILES%\BrowserProtect\proxy\config.old
- from %TEMP%\nsp10.tmp to %PROGRAM_FILES%\BrowserProtect\config.xml
- from %PROGRAM_FILES%\BrowserProtect\config.xml to %PROGRAM_FILES%\BrowserProtect\config.xml.old
- from %TEMP%\nsq7.tmp to %PROGRAM_FILES%\BrowserProtect\config.xml
- from %TEMP%\nsx8.tmp to %PROGRAM_FILES%\BrowserProtect\config.xml
- from %PROGRAM_FILES%\BrowserProtect\BrowserProtectIU.exe.config to %PROGRAM_FILES%\BrowserProtect\BrowserProtectIU.exe.config.old
- from %TEMP%\nsy5.tmp to %PROGRAM_FILES%\BrowserProtect\BrowserProtectIU.exe.config
- from %TEMP%\nsx6.tmp to %PROGRAM_FILES%\BrowserProtect\BrowserProtectIU.exe.config
- from %TEMP%\nsd9.tmp to %PROGRAM_FILES%\BrowserProtect\config.xml
- from %TEMP%\nszD.tmp to %PROGRAM_FILES%\BrowserProtect\config.xml
- from %TEMP%\nslE.tmp to %PROGRAM_FILES%\BrowserProtect\config.xml
- from %TEMP%\nsnF.tmp to %PROGRAM_FILES%\BrowserProtect\config.xml
- from %TEMP%\nsfA.tmp to %PROGRAM_FILES%\BrowserProtect\config.xml
- from %TEMP%\nshB.tmp to %PROGRAM_FILES%\BrowserProtect\config.xml
- from %TEMP%\nssC.tmp to %PROGRAM_FILES%\BrowserProtect\config.xml
Network activity:
Connects to:
- 'me###.vitkvitk.com':80
- 'wp#d':80
TCP:
HTTP GET requests:
- me###.vitkvitk.com/xmlstatic/installers/software/browserprotect/versionBP
- me###.vitkvitk.com/xmlstatic/installers/software/browserprotect/versionPr
- me###.vitkvitk.com/xmlstatic/installers/software/browserprotect/updateBPSrv.zip
- wp#d/wpad.dat
- me###.vitkvitk.com/xmlstatic/installers/software/browserprotect/versionBPSrv
UDP:
- DNS ASK me###.vitkvitk.com
- DNS ASK wp#d
Miscellaneous:
Searches for the following windows:
- ClassName: '(null)' WindowName: '(null)'
