Technical Information
Malicious functions:
Executes the following:
- '%TEMP%\~nsu.tmp\Au_.exe' _?=<Current directory>\
Modifies file system:
Creates the following files:
- %TEMP%\nse4.tmp
- %TEMP%\nsk5.tmp\System.dll
- %TEMP%\nsc2.tmp
- %TEMP%\~nsu.tmp\Au_.exe
Deletes the following files:
- %TEMP%\nsk5.tmp\System.dll
Deletes itself.
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: '#32770' WindowName: ''
