Technical Information
Malicious functions
Injects code into
the following user processes:
- gc_000d9bd3068c.exe
Modifies file system
Creates the following files
- %TEMP%\gc_000d9bd3068c.exe
- nul
Deletes following files that it created itself
- %TEMP%\gc_000d9bd3068c.exe
Miscellaneous
Creates and executes the following
- '%TEMP%\gc_000d9bd3068c.exe' --g
- '%TEMP%\gc_000d9bd3068c.exe'
Executes the following
- '<SYSTEM32>\cmd.exe' /c ping -n 4 127.0.0.1 >nul & del "%TEMP%\gc_000D9BD3068C.exe"
- '<SYSTEM32>\ping.exe' -n 4 127.0.0.1
