Technical Information
Malicious functions:
Creates and executes the following:
- '%TEMP%\nsp3.tmp\ns4.tmp' taskkill /f /im AppsUpdater.exe
- '%TEMP%\~nsu.tmp\Au_.exe' _?=<Current directory>\
Executes the following:
- '<SYSTEM32>\taskkill.exe' /f /im AppsUpdater.exe
Modifies file system :
Creates the following files:
- %TEMP%\nsp3.tmp\ns4.tmp
- %TEMP%\nsp3.tmp\nsURL.dll
- %TEMP%\nsp3.tmp\tkDecript.dll
- %TEMP%\nsp3.tmp\System.dll
- %TEMP%\~nsu.tmp\Au_.exe
- %TEMP%\nsp3.tmp\nsExec.dll
- %TEMP%\nsp3.tmp\SimpleSC.dll
Deletes the following files:
- %TEMP%\nsp3.tmp\ns4.tmp
Network activity:
Connects to:
- 'www.up###atsone.com':80
TCP:
HTTP GET requests:
- www.up###atsone.com/cmd/report.php?ke########################################
UDP:
- DNS ASK www.up###atsone.com
Miscellaneous:
Searches for the following windows:
- ClassName: 'SysListView32' WindowName: ''
- ClassName: '' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: '#32770' WindowName: ''
