Technical Information
Malicious functions:
Executes the following:
- '<SYSTEM32>\taskkill.exe' /f /im "YouTubeByClick.exe" /t
Modifies file system:
Creates the following files:
- %TEMP%\7ZipSfx.000\shortcut_0.exe
- %TEMP%\7ZipSfx.000\shortcut.exe
- %TEMP%\CIK4547I.cmd
- %TEMP%\7ZipSfx.000\YouTube By Click.msi
- %TEMP%\7ZipSfx.000\YouTube.By.Click.v.2.2.77_Silent.exe
- %TEMP%\7ZipSfx.000\delete_click_youtube.exe
Deletes the following files:
- %TEMP%\CIK4547I.cmd
Miscellaneous:
Searches for the following windows:
- ClassName: '' WindowName: ''
Creates and executes the following:
- '%TEMP%\7ZipSfx.000\delete_click_youtube.exe'
- '<Full path to file>' -sfxwaitall:1 "delete_click_youtube.exe"
Executes the following:
- '<SYSTEM32>\mode.com' 70,13
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\CIK4547I.cmd" "%TEMP%\7ZipSfx.000\delete_click_youtube.exe" "
