Technical Information
Malicious functions
Injects code into
the following system processes:
- %WINDIR%\explorer.exe
Modifies file system
Creates the following files
- nul
Deletes itself.
Miscellaneous
Executes the following
- '<SYSTEM32>\cmd.exe' /c ping -n 20 127.0.0.1 > nul & del "<Full path to file>" > nul
- '<SYSTEM32>\ping.exe' -n 20 127.0.0.1
- '<SYSTEM32>\cmd.exe' /c ping -n 20 127.0.0.1 > nul & del "<Full path to file>" > nul' (with hidden window)
