Technical Information
- '<SYSTEM32>\attrib.exe' "<Full path to virus>" +s +h
- '<SYSTEM32>\attrib.exe' "<Current directory>" +s +h
- '<SYSTEM32>\notepad.exe'
- '<SYSTEM32>\cmd.exe' /k attrib "<Full path to virus>" +s +h
- '<SYSTEM32>\cmd.exe' /k attrib "<Current directory>" +s +h
- <SYSTEM32>\notepad.exe
- <Full path to virus>
- 'xf###.ddns.net':1605
- DNS ASK xf###.ddns.net
- ClassName: 'Afx:400000:0' WindowName: ''