Technical Information
Malicious functions:
Creates and executes the following:
- '%APPDATA%\winmyl.exe'
Executes the following:
- '<SYSTEM32>\schtasks.exe' /create /sc onlogon /f /tn winmyl /rl highest /tr "%APPDATA%\winmyl.exe"
- '<SYSTEM32>\cmd.exe' /c ""%APPDATA%\updatecheck.bat" "
Terminates or attempts to terminate
the following user processes:
- chrome.exe
Modifies file system :
Creates the following files:
- %APPDATA%\updatecheck.bat
- %APPDATA%\winmyl.exe
Sets the 'hidden' attribute to the following files:
- %APPDATA%\updatecheck.bat
- %APPDATA%\winmyl.exe
