Technical Information
Malicious functions:
Executes the following:
- '<SYSTEM32>\shutdown.exe' /pid=2976
- '<SYSTEM32>\shutdown.exe' /pid=772
- '<SYSTEM32>\shutdown.exe' /pid=2008
- '<SYSTEM32>\shutdown.exe' /pid=3344
- '<SYSTEM32>\shutdown.exe' /pid=2764
- '<SYSTEM32>\shutdown.exe' /pid=636
- '<SYSTEM32>\shutdown.exe' -r -t 00
- '<SYSTEM32>\shutdown.exe' /pid=2740
- '<SYSTEM32>\shutdown.exe' /pid=2024
Injects code into
the following system processes:
- <SYSTEM32>\shutdown.exe
Terminates or attempts to terminate
the following user processes:
- ClamWin.exe
Attempts to shut down the Windows operating system.
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
