Technical Information
Malicious functions:
Creates and executes the following:
- '%TEMP%\nsr6.tmp' (downloaded from the Internet)
Executes the following:
- '%TEMP%\nsr6.tmp'
Modifies file system:
Creates the following files:
- %TEMP%\nst7.tmp
- %TEMP%\nsr6.tmp
- %TEMP%\nsl8.tmp
- %TEMP%\nsxA.tmp
- %TEMP%\nsh9.tmp
- %TEMP%\nsa3.tmp\WmiInspector.dll
- %TEMP%\nsk2.tmp
- %TEMP%\nsa3.tmp\inetc.dll
- %TEMP%\nsq5.tmp
- %TEMP%\nsn4.tmp
Deletes the following files:
- %TEMP%\nsxA.tmp
- %TEMP%\nsh9.tmp
- %TEMP%\nsa3.tmp\WmiInspector.dll
- %TEMP%\nsa3.tmp\inetc.dll
- %TEMP%\nsr6.tmp
- %TEMP%\nsq5.tmp
- %TEMP%\nsn4.tmp
- %TEMP%\nsl8.tmp
- %TEMP%\nst7.tmp
Network activity:
Connects to:
- 'li#####tscounter.com':80
- 'cm#.##onbeast.io':80
TCP:
HTTP GET requests:
- http://li#####tscounter.com/Generic/dlc.php?si######################################
HTTP POST requests:
- http://cm#.##onbeast.io/
UDP:
- DNS ASK li#####tscounter.com
- DNS ASK cm#.##onbeast.io
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: ''
