Technical Information
Malicious functions:
Creates and executes the following:
- %TEMP%\conduitinstaller.exe -ctid=CT2451227 -ie -ff -ch -startpage=true -defaultsearch=true
- %TEMP%\nsx4.tmp\ns5.tmp %TEMP%\conduitinstaller.exe -ctid=CT2451227 -ie -ff -ch -startpage=true -defaultsearch=true
- %TEMP%\V9Zip_000\GoPlayerSetup_tr.exe /verysilent
- %TEMP%\V9Zip_000\v9hpnt2.exe -h -t -oem=sskts -nation=tr
- %TEMP%\V9Zip_000\downloader.exe
- %CommonProgramFiles%\1323\Mercan_CT2451227_s.exe
- %CommonProgramFiles%\1323\aa.exe
- %TEMP%\nso2.tmp\stub.exe -parameters=%TEMP%\CT2451227\parameters.csf
- %CommonProgramFiles%\1323\GoPlayer_trkts.exe
- %TEMP%\V9Zip_000\GoPlayerSetup_tr.exe (downloaded from the Internet)
- %TEMP%\conduitinstaller.exe (downloaded from the Internet)
- %TEMP%\V9Zip_000\v9hpnt2.exe (downloaded from the Internet)
Terminates or attempts to terminate
the following user processes:
- firefox.exe
- chrome.exe
- iexplore.exe
- opera.exe
Modifies file system :
Creates the following files:
- %TEMP%\V9Zip_000\lang\en\down_lang.ini
- %TEMP%\V9Zip_000\lang\cn\down_lang.ini
- %TEMP%\V9Zip_000\res\goplayer.jpg
- %TEMP%\V9Zip_000\lang\pt\down_lang.ini
- %TEMP%\V9Zip_000\lang\pl\down_lang.ini
- %TEMP%\V9Zip_000\lang\es\down_lang.ini
- %TEMP%\nsx4.tmp\ConduitInetc.dll
- %TEMP%\V9Zip_000\images\title.png
- %TEMP%\V9Zip_000\images\soft365.bmp
- %TEMP%\V9Zip_000\res\goplayer.ico
- %TEMP%\V9Zip_000\res\config.ini
- %TEMP%\V9Zip_000\images\unCheck.png
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\license[1].htm
- %TEMP%\V9Zip_000\v9hpnt2.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\v9hpnt2[1].exe
- %TEMP%\V9Zip_000\GoPlayerSetup_tr.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\GoPlayerSetup_tr[1].exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\welcome[1]
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\conduitinstaller[1].exe
- %TEMP%\V9Zip_000\lang\tr\down_lang.ini
- %TEMP%\V9Zip_000\lang\th\down_lang.ini
- %TEMP%\nsx4.tmp\ns5.tmp
- %TEMP%\nsx4.tmp\nsExec.dll
- %TEMP%\conduitinstaller.exe
- %TEMP%\nso2.tmp\nsDialogs.dll
- %TEMP%\nso2.tmp\stub.exe
- %TEMP%\nso2.tmp\TBLogo.bmp
- %TEMP%\CT2451227\conduitStatistics.csf
- %TEMP%\CT2451227\parameters.csf
- %TEMP%\nso2.tmp\System.dll
- %CommonProgramFiles%\1323\Mercan_CT2451227_s.exe
- %TEMP%\$inst\temp_0.tmp
- %TEMP%\$inst\2.tmp
- %TEMP%\nso2.tmp\WelcomeScreenLogo.bmp
- %CommonProgramFiles%\1323\aa.exe
- %CommonProgramFiles%\1323\GoPlayer_trkts.exe
- %TEMP%\V9Zip_000\images\loading.png
- %TEMP%\V9Zip_000\images\ico.png
- %TEMP%\V9Zip_000\images\Check.png
- %TEMP%\V9Zip_000\images\progressbg.png
- %TEMP%\V9Zip_000\images\progress.png
- %TEMP%\V9Zip_000\images\ok.png
- %TEMP%\V9Zip_000\images\bt2.png
- %TEMP%\V9Zip_000\downloader.exe
- %TEMP%\V9Zip_000\db.con
- %TEMP%\V9Zip_000\images\Cancel.png
- %TEMP%\V9Zip_000\images\btn_min.png
- %TEMP%\V9Zip_000\images\btn_close.png
Deletes the following files:
- %TEMP%\nso2.tmp\System.dll
- %TEMP%\nso2.tmp\stub.exe
- %TEMP%\nso2.tmp\WelcomeScreenLogo.bmp
- %TEMP%\nso2.tmp\TBLogo.bmp
- %TEMP%\nso2.tmp\nsDialogs.dll
- %TEMP%\nsx4.tmp\ns5.tmp
- %TEMP%\$inst\temp_0.tmp
- %TEMP%\nsx4.tmp\nsExec.dll
- %TEMP%\nsx4.tmp\ConduitInetc.dll
Network activity:
Connects to:
- 'ct######7.ourtoolbar.com':80
- 'localhost':1044
- 'ad#.#oft365.com':80
- 'tr.##player.cc':80
- 'www.tw##ext.com':80
- 'localhost':1038
- 'st####e.conduit.com':80
- 'ho##.#r.soft365.com':80
- 'xa.###gcloud.com':80
TCP:
HTTP GET requests:
- tr.##player.cc/original/GoPlayerSetup_tr.exe
- ct######7.ourtoolbar.com/welcome
- xa.###gcloud.com/v4/sof-ss/VMwareXVirtualXIDEXHardXDrive_11000000000000000001?ac###################################################
- ad#.#oft365.com/ads/sendss?si#####################################################################
- xa.###gcloud.com/v4/sof-dl/VMwareXVirtualXIDEXHardXDrive_11000000000000000001?ac#############################################################################################
- xa.###gcloud.com/v4/sof-dl/VMwareXVirtualXIDEXHardXDrive_11000000000000000001?ac#############################################################################
- st####e.conduit.com/ps/conduitinstaller/conduitinstaller.exe
- www.tw##ext.com/download/res/v9hpnt2.exe
- ho##.#r.soft365.com/license.htm
UDP:
- DNS ASK tr.##player.cc
- DNS ASK www.go##ayer.cc
- DNS ASK ad#.#oft365.com
- DNS ASK ct######7.ourtoolbar.com
- DNS ASK www.tw##ext.com
- DNS ASK st####e.conduit.com
- DNS ASK www.google.com
- DNS ASK ho##.#r.soft365.com
- DNS ASK xa.###gcloud.com
Miscellaneous:
Searches for the following windows:
- ClassName: 'MS_WebcheckMonitor' WindowName: ''
- ClassName: '' WindowName: ''
- ClassName: 'IEFrame' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: '#32770' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''