Technical Information
Malicious functions:
Executes the following:
- '<SYSTEM32>\ping.exe' -n 1 127.0.0.1
- '<SYSTEM32>\taskkill.exe' /f /im "<File name>.exe"
- '<SYSTEM32>\cmd.exe'
Modifies file system:
Creates the following files:
- %TEMP%\nsx3.tmp\System.dll
- %TEMP%\craftsmanship.dll
- %TEMP%\23ef5514\3059.tmp
- %TEMP%\23ef5514\436f.tmp
- %TEMP%\Sedge.riJm
- %TEMP%\floppy_disk.png
- %TEMP%\nsw2.tmp
- %TEMP%\flat.xsl
- %TEMP%\floppy_disk_disabled.png
Miscellaneous:
Searches for the following windows:
- ClassName: '' WindowName: ''
