Technical Information
Malicious functions:
Creates and executes the following:
- '%TEMP%\tmp2RVH\service.exe' service tmp2RVH
Executes the following:
- '<SYSTEM32>\cmd.exe' /c <Current directory>\deleteme.bat
Modifies file system :
Creates the following files:
- %TEMP%\TextLog.dat
- <Current directory>\deleteme.bat
- %TEMP%\tmp2RVH\service.exe
Sets the 'hidden' attribute to the following files:
- %TEMP%\tmp2RVH\service_ICE.tgs
Moves the following files:
- from %TEMP%\tmp2RVH\service.exe to %TEMP%\tmp2RVH\service_ICE.tgs
Deletes itself.
