Technical Information
Malicious functions:
Executes the following:
- '<SYSTEM32>\find.exe' /I "mpa.one.microsoft.com"
- '<SYSTEM32>\find.exe' /I "sls.microsoft.com"
- '<SYSTEM32>\find.exe' /I "genuine.microsoft.com"
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\hosts.cmd""
- '<SYSTEM32>\cmd.exe' /S /D /c" TYPE "<DRIVERS>\etc\hosts" "
Modifies file system:
Creates the following files:
- %TEMP%\hosts.cmd
Modifies the HOSTS file.
