Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Classes\MSProgramGroup\Shell\Open\Command] '' = '<SYSTEM32>\grpconv.exe %1'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] 'GrpConv' = 'grpconv -o'
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\IDMTDI] 'Start' = '00000001'
Malicious functions:
Creates and executes the following:
- '%PROGRAM_FILES%\Internet Download Manager\Uninstall.exe' -instdriv
- '%TEMP%\RarSFX0\IDMGrHlp.sfx.exe'
- '%TEMP%\RarSFX0\IDMGrHlp2.sfx.exe'
- '%TEMP%\RarSFX0\HOST.exe'
- '%TEMP%\RarSFX0\Internet.Download.Manager.v6.19.2.exe' /S /EN
- '%TEMP%\nsa3.tmp\ns4.tmp' "%PROGRAM_FILES%\Internet Download Manager\Uninstall.exe" -instdriv
Executes the following:
- '<SYSTEM32>\grpconv.exe' -o
- '<SYSTEM32>\net1.exe' start IDMTDI
- '%WINDIR%\regedit.exe' /S Reg.reg
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\RarSFX0\Hassan.cmd" "
- '<SYSTEM32>\rundll32.exe' SETUPAPI.DLL,InstallHinfSection DefaultInstall 128 %PROGRAM_FILES%\Internet Download Manager\idmtdi.inf
- '<SYSTEM32>\runonce.exe' -r
Modifies file system :
Creates the following files:
- %PROGRAM_FILES%\Internet Download Manager\Toolbar\3d_style_3.tbi
- %PROGRAM_FILES%\Internet Download Manager\Toolbar\Blue_Arrow.tbi
- %PROGRAM_FILES%\Internet Download Manager\Toolbar\Blue_Arrow_Disable.bmp
- %PROGRAM_FILES%\Internet Download Manager\Toolbar\3d_large_3_hdpi15.bmp
- %PROGRAM_FILES%\Internet Download Manager\Toolbar\3d_smallHot_3.bmp
- %PROGRAM_FILES%\Internet Download Manager\Toolbar\3d_small_3.bmp
- %PROGRAM_FILES%\Internet Download Manager\Toolbar\Blue_Arrow_Mini_Normal.bmp
- %PROGRAM_FILES%\Internet Download Manager\Toolbar\Blue_Arrow_Normal.bmp
- %PROGRAM_FILES%\Internet Download Manager\Toolbar\Koushik Halder.tbi
- %PROGRAM_FILES%\Internet Download Manager\Toolbar\Blue_Arrow_Hot.bmp
- %PROGRAM_FILES%\Internet Download Manager\Toolbar\Blue_Arrow_Mini_Disable.bmp
- %PROGRAM_FILES%\Internet Download Manager\Toolbar\Blue_Arrow_Mini_Hot.bmp
- %PROGRAM_FILES%\Internet Download Manager\Toolbar\3d_large_3.bmp
- %PROGRAM_FILES%\Internet Download Manager\Languages\idm_ru.chm
- %PROGRAM_FILES%\Internet Download Manager\Languages\idm_ru.lng
- %PROGRAM_FILES%\Internet Download Manager\Languages\idm_ua.lng
- %PROGRAM_FILES%\Internet Download Manager\idmwfp64.sys
- %PROGRAM_FILES%\Internet Download Manager\tips.txt
- %PROGRAM_FILES%\Internet Download Manager\Languages\grabber_ru.chm
- %PROGRAM_FILES%\Internet Download Manager\Languages\tut_ru.chm
- %PROGRAM_FILES%\Internet Download Manager\Toolbar\3d_largeHot_3.bmp
- %PROGRAM_FILES%\Internet Download Manager\Toolbar\3d_largeHot_3_hdpi15.bmp
- %PROGRAM_FILES%\Internet Download Manager\Languages\scheduler_ru.chm
- %PROGRAM_FILES%\Internet Download Manager\Languages\tips_ru.txt
- %PROGRAM_FILES%\Internet Download Manager\Languages\tips_ua.txt
- %TEMP%\Cab7.tmp
- %TEMP%\Cab9.tmp
- %TEMP%\CabB.tmp
- %APPDATA%\Microsoft\CryptnetUrlCache\Content\2BF68F4714092295550497DD56F57004
- %APPDATA%\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- %APPDATA%\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
- %HOMEPATH%\Desktop\Internet Download Manager.lnk
- %HOMEPATH%\Start Menu\Programs\Internet Download Manager\Internet Download Manager.lnk
- %HOMEPATH%\Start Menu\Programs\Internet Download Manager\Uninstall Internet Download Manager.lnk
- %WINDIR%\inf\oem3.inf
- %WINDIR%\inf\oem3.PNF
- <DRIVERS>\SETD.tmp
- %APPDATA%\Microsoft\CryptnetUrlCache\MetaData\2BF68F4714092295550497DD56F57004
- %PROGRAM_FILES%\Internet Download Manager\Toolbar\Koushik_Halder_Small_Disable.bmp
- %PROGRAM_FILES%\Internet Download Manager\Toolbar\Koushik_Halder_Small_Hot.bmp
- %PROGRAM_FILES%\Internet Download Manager\Toolbar\Koushik_Halder_Small_Normal.bmp
- %PROGRAM_FILES%\Internet Download Manager\Toolbar\Koushik_Halder_Large_Disable.bmp
- %PROGRAM_FILES%\Internet Download Manager\Toolbar\Koushik_Halder_Large_Hot.bmp
- %PROGRAM_FILES%\Internet Download Manager\Toolbar\Koushik_Halder_Large_Normal.bmp
- %PROGRAM_FILES%\Internet Download Manager\Uninstall-ME.exe
- %TEMP%\nsa3.tmp\nsExec.dll
- %TEMP%\nsa3.tmp\ns4.tmp
- %PROGRAM_FILES%\Internet Download Manager\Toolbar\Mosi_Modern_XP.bmp
- %PROGRAM_FILES%\Internet Download Manager\Toolbar\Mosi_Modern_XP.tbi
- %PROGRAM_FILES%\Internet Download Manager\Toolbar\Mosi_Modern_XPHot.bmp
- %PROGRAM_FILES%\Internet Download Manager\IDMNetMon.dll
- %PROGRAM_FILES%\Internet Download Manager\IDMNetMon64.dll
- %PROGRAM_FILES%\Internet Download Manager\IDMShellExt.dll
- %PROGRAM_FILES%\Internet Download Manager\IDMIECC.dll
- %PROGRAM_FILES%\Internet Download Manager\IDMIECC64.dll
- %PROGRAM_FILES%\Internet Download Manager\IDMIntegrator64.exe
- %PROGRAM_FILES%\Internet Download Manager\IEGetAll.htm
- %PROGRAM_FILES%\Internet Download Manager\IEGetVL.htm
- %PROGRAM_FILES%\Internet Download Manager\IEGetVL2.htm
- %PROGRAM_FILES%\Internet Download Manager\IDMShellExt64.dll
- %PROGRAM_FILES%\Internet Download Manager\IDMan.exe
- %PROGRAM_FILES%\Internet Download Manager\IEExt.htm
- %PROGRAM_FILES%\Internet Download Manager\IDMGrHlp.exe
- %TEMP%\RarSFX0\Reg.reg
- %TEMP%\RarSFX0\Internet.Download.Manager.v6.19.2.exe
- %TEMP%\RarSFX0\Hassan.cmd
- %TEMP%\RarSFX0\HOST.exe
- %TEMP%\RarSFX0\IDMGrHlp.sfx.exe
- %TEMP%\RarSFX0\IDMGrHlp2.sfx.exe
- %PROGRAM_FILES%\Internet Download Manager\IDMGCExt.crx
- %PROGRAM_FILES%\Internet Download Manager\IDMGetAll.dll
- %PROGRAM_FILES%\Internet Download Manager\IDMGetAll64.dll
- %TEMP%\nsf2.tmp
- %PROGRAM_FILES%\Internet Download Manager\IDMFType.dat
- %PROGRAM_FILES%\Internet Download Manager\IDMFType64.dll
- %PROGRAM_FILES%\Internet Download Manager\idmmzcc.xpi
- %PROGRAM_FILES%\Internet Download Manager\idmtdi.cat
- %PROGRAM_FILES%\Internet Download Manager\idmtdi.inf
- %PROGRAM_FILES%\Internet Download Manager\idmftype.dll
- %PROGRAM_FILES%\Internet Download Manager\idmindex.dll
- %PROGRAM_FILES%\Internet Download Manager\idmmkb.dll
- %PROGRAM_FILES%\Internet Download Manager\idmwfp.cat
- %PROGRAM_FILES%\Internet Download Manager\idmwfp.inf
- %PROGRAM_FILES%\Internet Download Manager\idmwfp32.sys
- %PROGRAM_FILES%\Internet Download Manager\idmtdi32.sys
- %PROGRAM_FILES%\Internet Download Manager\idmtdi64.sys
- %PROGRAM_FILES%\Internet Download Manager\idmvs.dll
- %PROGRAM_FILES%\Internet Download Manager\idmfsa.dll
- %PROGRAM_FILES%\Internet Download Manager\defexclist.txt
- %PROGRAM_FILES%\Internet Download Manager\downlWithIDM.dll
- %PROGRAM_FILES%\Internet Download Manager\downlWithIDM64.dll
- %PROGRAM_FILES%\Internet Download Manager\IEMonitor.exe
- %PROGRAM_FILES%\Internet Download Manager\MediumILStart.exe
- %PROGRAM_FILES%\Internet Download Manager\Uninstall.exe
- %PROGRAM_FILES%\Internet Download Manager\idmbrbtn64.dll
- %PROGRAM_FILES%\Internet Download Manager\idmcchandler2.dll
- %PROGRAM_FILES%\Internet Download Manager\idmcchandler2_64.dll
- %PROGRAM_FILES%\Internet Download Manager\idmBroker.exe
- %PROGRAM_FILES%\Internet Download Manager\idmantypeinfo.tlb
- %PROGRAM_FILES%\Internet Download Manager\idmbrbtn.dll
Deletes the following files:
- %TEMP%\RarSFX0\IDMGrHlp.sfx.exe
- %TEMP%\RarSFX0\HOST.exe
- %TEMP%\RarSFX0\IDMGrHlp2.sfx.exe
- %TEMP%\RarSFX0\Reg.reg
- %TEMP%\RarSFX0\Internet.Download.Manager.v6.19.2.exe
- %TEMP%\RarSFX0\Hassan.cmd
- %TEMP%\Cab9.tmp
- %TEMP%\Cab7.tmp
- %TEMP%\CabB.tmp
- %TEMP%\nsa3.tmp\nsExec.dll
- %TEMP%\nsa3.tmp\ns4.tmp
Moves the following files:
- from <DRIVERS>\SETD.tmp to <DRIVERS>\idmtdi.sys
Modifies the HOSTS file.
Network activity:
Connects to:
- 'www.download.windowsupdate.com':80
- 'wp#d':80
TCP:
HTTP GET requests:
- www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
- www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt
- wp#d/wpad.dat
UDP:
- DNS ASK www.download.windowsupdate.com
- DNS ASK wp#d
Miscellaneous:
Searches for the following windows:
- ClassName: 'RegEdit_RegEdit' WindowName: '(null)'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'EDIT' WindowName: '(null)'