Technical Information
Malicious functions
Executes the following
- '<SYSTEM32>\taskkill.exe' /F /PID 3544
Patches code
in NTDLL dll
- httjmg.exe process, ntdll.dll module
Modifies file system
Creates the following files
- %ALLUSERSPROFILE%\boost_interprocess\0d000000_b6140000\chairfbi_sdk_to_addon
- nul
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: ''
Executes the following
- '<SYSTEM32>\cmd.exe' /C ping 127.0.0.1 -n 2 > nul & taskkill /F /PID 3544 > nul 2>&1 & ping 127.0.0.1 -n 2 > nul & del /F /Q "<Full path to file>" > nul 2>&1 & exit
- '<SYSTEM32>\ping.exe' 127.0.0.1 -n 2
- '<SYSTEM32>\cmd.exe' /C ping 127.0.0.1 -n 2 > nul & taskkill /F /PID 3544 > nul 2>&1 & ping 127.0.0.1 -n 2 > nul & del /F /Q "<Full path to file>" > nul 2>&1 & exit' (with hidden window)
