Technical Information
Malicious functions
Sets a new unauthorized home page for Windows Internet Explorer.
Modifies file system
Deletes itself.
Miscellaneous
Executes the following
- '<SYSTEM32>\cmd.exe' /c ping 127.0.0.1 -n 1&del /q "<Full path to file>"
- '<SYSTEM32>\cmd.exe' /c ping -n 3 127.1 & del /q "<Full path to file>"
- '<SYSTEM32>\ping.exe' -n 3 127.1
- '<SYSTEM32>\ping.exe' 127.0.0.1 -n 1
- '<SYSTEM32>\cmd.exe' /c ping 127.0.0.1 -n 1&del /q "<Full path to file>"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c ping -n 3 127.1 & del /q "<Full path to file>"' (with hidden window)
