Technical Information
Malicious functions:
Executes the following:
- '<SYSTEM32>\ping.exe' -n 1 127.0.0.1
- '<SYSTEM32>\taskkill.exe' /f /im "<File name>.exe"
- '<SYSTEM32>\cmd.exe'
Modifies file system:
Creates the following files:
- %TEMP%\nsm2.tmp\System.dll
- %TEMP%\23ef5514\436f.tmp
- %TEMP%\23ef5514\3059.tmp
- %TEMP%\excesses.r
- %TEMP%\validator
- %TEMP%\ektron.stylesheet.ashx
- %TEMP%\menutext.js
Deletes itself.
Miscellaneous:
Searches for the following windows:
- ClassName: '' WindowName: ''
