Technical Information
Malicious functions
Executes the following
- '%WINDIR%\syswow64\taskkill.exe' /f /im AppsUpd4ter.exe
Modifies file system
Creates the following files
- %TEMP%\~nsu.tmp\au_.exe
- %TEMP%\nsl7850.tmp\system.dll
- %TEMP%\nsl7850.tmp\nsexec.dll
- %TEMP%\nsl7850.tmp\nsurl.dll
Network activity
TCP
HTTP GET requests
- http://up#.#pd4ter.com/installer_stats/?ac#######################################################################################################################################################...
UDP
- DNS ASK up#.#pd4ter.com
Miscellaneous
Searches for the following windows
- ClassName: '#32770' WindowName: ''
- ClassName: 'SysListView32' WindowName: ''
- ClassName: '' WindowName: ''
Creates and executes the following
- '%TEMP%\~nsu.tmp\au_.exe' _?=<Current directory>\
- '%WINDIR%\syswow64\sc.exe' stop SrvUpdater' (with hidden window)
- '%WINDIR%\syswow64\sc.exe' delete SrvUpdater' (with hidden window)
- '%WINDIR%\syswow64\taskkill.exe' /f /im AppsUpd4ter.exe' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\sc.exe' stop SrvUpdater
- '%WINDIR%\syswow64\sc.exe' delete SrvUpdater
