Technical Information
Malicious functions:
Executes the following:
- '<SYSTEM32>\ping.exe' 8.8.8.8 -n 10
- '<SYSTEM32>\rundll32.exe'
- '<SYSTEM32>\cmd.exe' /c ping 8.8.8.8 -n 10
- '<SYSTEM32>\cmd.exe' /c ping 127.0.0.1 -n 20
- '<SYSTEM32>\ping.exe' 127.0.0.1 -n 20
Injects code into
the following system processes:
- <SYSTEM32>\rundll32.exe
Network activity:
Connects to:
- '<L###LNET>.2.2':4444
