Technical Information
Malicious functions:
Executes the following:
- '<SYSTEM32>\subst.exe' r: C:\
- '<SYSTEM32>\subst.exe' s: C:\
- '<SYSTEM32>\subst.exe' t: C:\
- '<SYSTEM32>\subst.exe' q: C:\
- '<SYSTEM32>\subst.exe' n: C:\
- '<SYSTEM32>\subst.exe' o: C:\
- '<SYSTEM32>\subst.exe' p: C:\
- '<SYSTEM32>\subst.exe' u: C:\
- '<SYSTEM32>\subst.exe' z: C:\
- '%WINDIR%\explorer.exe'
- '<SYSTEM32>\ping.exe' 127.0.0.1 /n 120
- '<SYSTEM32>\subst.exe' y: C:\
- '<SYSTEM32>\subst.exe' v: C:\
- '<SYSTEM32>\subst.exe' w: C:\
- '<SYSTEM32>\subst.exe' x: C:\
- '<SYSTEM32>\subst.exe' c: C:\
- '<SYSTEM32>\subst.exe' d: C:\
- '<SYSTEM32>\subst.exe' e: C:\
- '<SYSTEM32>\subst.exe' b: C:\
- '<SYSTEM32>\ping.exe' 127.0.0.1 /n 4
- '<SYSTEM32>\taskkill.exe' /f /im 360tray.exe
- '<SYSTEM32>\subst.exe' a: C:\
- '<SYSTEM32>\subst.exe' f: C:\
- '<SYSTEM32>\subst.exe' k: C:\
- '<SYSTEM32>\subst.exe' l: C:\
- '<SYSTEM32>\subst.exe' m: C:\
- '<SYSTEM32>\subst.exe' j: C:\
- '<SYSTEM32>\subst.exe' g: C:\
- '<SYSTEM32>\subst.exe' h: C:\
- '<SYSTEM32>\subst.exe' i: C:\
Terminates or attempts to terminate
the following user processes:
- 360tray.exe
Modifies file system :
Creates the following files:
- %TEMP%\2808IVXU.bat
Sets the 'hidden' attribute to the following files:
- %TEMP%\2808IVXU.bat
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: '' WindowName: '(null)'
- ClassName: '(null)' WindowName: '(null)'
