Technical Information
Malicious functions:
Executes the following:
- '<SYSTEM32>\ping.exe' -n 1 127.0.0.1
- '<SYSTEM32>\taskkill.exe' /f /im "<File name>.exe"
- '<SYSTEM32>\cmd.exe'
Modifies file system:
Creates the following files:
- %APPDATA%\hu.txt
- %APPDATA%\features.dll
- %APPDATA%\id.txt
- %TEMP%\nsd2.tmp\System.dll
- %APPDATA%\yo.txt
- %APPDATA%\pa-in.txt
- %APPDATA%\Norepinephrine.Tpgy
- %APPDATA%\mng2.txt
- %APPDATA%\co.txt
- %APPDATA%\WAIK_Ver_RTM_with_new_driver.txt
Deletes itself.
Miscellaneous:
Searches for the following windows:
- ClassName: '' WindowName: ''
