Technical Information
Malicious functions:
Executes the following:
- '<SYSTEM32>\taskkill.exe' /f /pid "2816"
Modifies file system:
Deletes the following files:
- <Full path to file>
Miscellaneous:
Searches for the following windows:
- ClassName: '' WindowName: ''
Executes the following:
- '<SYSTEM32>\cmd.exe' /c taskkill /f /pid "2816" & attrib -s -h -r -a "<Full path to file>" & del /q /f "<Full path to file>"
- '<SYSTEM32>\attrib.exe' -s -h -r -a "<Full path to file>"
