Technical Information
Malicious functions:
Executes the following:
- '<SYSTEM32>\taskkill.exe' /pid=2964
- '<SYSTEM32>\ping.exe' /pid=2868
- '<SYSTEM32>\taskkill.exe' 127.0.0.1 /n 5
- '<SYSTEM32>\taskkill.exe' /pid=3072
- '<SYSTEM32>\taskkill.exe' /F /IM ZHUDONGFANGYU.exe
- '<SYSTEM32>\ping.exe' 127.0.0.1 /n 5
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\1.tmp\360av3.bat" "
- '<SYSTEM32>\taskkill.exe' /F /IM 360tray.exe
- '<SYSTEM32>\taskkill.exe' /F /IM 360safe.exe
Injects code into
the following system processes:
- <SYSTEM32>\taskkill.exe
Terminates or attempts to terminate
the following user processes:
- 360tray.exe
Modifies file system :
Creates the following files:
- %TEMP%\1.tmp\360av3.bat
Miscellaneous:
Searches for the following windows:
- ClassName: '(null)' WindowName: '(null)'
