Technical Information
Modifies file system
Creates the following files
- %TEMP%\selfdestruct_w7ooqncu.bat
- %TEMP%\selfdestruct_0m0qbpaz.bat
- %TEMP%\selfdestruct_fsuw3vj3.bat
- nul
- %LOCALAPPDATA%\svchost.exe
- %TEMP%\selfdestruct_nrbgcw2o.bat
- %TEMP%\selfdestruct_d5mvwnxk.bat
- %TEMP%\selfdestruct_zpowidsq.bat
Deletes the following files
- %LOCALAPPDATA%\svchost.exe
Deletes itself.
Miscellaneous
Creates and executes the following
- '%LOCALAPPDATA%\svchost.exe'
Executes the following
- '<SYSTEM32>\cmd.exe' /C "%TEMP%\selfdestruct_w7oOQnCU.bat"
- '<SYSTEM32>\cmd.exe' /C "%TEMP%\selfdestruct_0m0qbPaz.bat"
- '<SYSTEM32>\cmd.exe' /C "%TEMP%\selfdestruct_fSuW3vj3.bat"
- '<SYSTEM32>\timeout.exe' /t 2 /nobreak
- '<SYSTEM32>\cmd.exe' /C "%TEMP%\selfdestruct_NRbGcW2O.bat"
- '<SYSTEM32>\cmd.exe' /C "%TEMP%\selfdestruct_D5MvWNXk.bat"
- '<SYSTEM32>\cmd.exe' /C "%TEMP%\selfdestruct_ZPOwiDSq.bat"
