Technical Information
Malicious functions:
Executes the following:
- '<SYSTEM32>\ping.exe' 1.1.1.1 -n 1 -w 1
- '<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 1 > Nul & Del "<Full path to file>"
Modifies file system:
Deletes itself.
Network activity:
Connects to:
- '74.##5.232.51':443
- '3d###########0f361858b76753e65df.icyboards.net':80
- 'wp#d':80
TCP:
HTTP GET requests:
- http://3d###########0f361858b76753e65df.icyboards.net/misc.php?pa############
- http://11#.#11.111.1/wpad.dat via wp#d
UDP:
- DNS ASK dr###.google.com
- DNS ASK 3d###########0f361858b76753e65df.icyboards.net
- DNS ASK wp#d
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: ''
