Technical Information
Malicious functions:
Executes the following:
- '<SYSTEM32>\ping.exe' -n 1 127.0.0.1
- '<SYSTEM32>\taskkill.exe' /f /im "<File name>.exe"
- '<SYSTEM32>\cmd.exe'
Modifies file system:
Creates the following files:
- %TEMP%\xmlrpc.php
- %TEMP%\hatches.zgL
- %TEMP%\nsb2.tmp\System.dll
- %TEMP%\ppibfi_pinterest.js
- %TEMP%\easyrecipe-min.js
- %TEMP%\a
Deletes itself.
Miscellaneous:
Searches for the following windows:
- ClassName: 'balloon' WindowName: ''
