Technical Information
Malicious functions
Injects code into
the following user processes:
- gc_000d7e1a0490.exe
Modifies file system
Creates the following files
- %TEMP%\gc_000d7e1a0490.exe
- nul
Deletes following files that it created itself
- %TEMP%\gc_000d7e1a0490.exe
Miscellaneous
Creates and executes the following
- '%TEMP%\gc_000d7e1a0490.exe' --g
- '%TEMP%\gc_000d7e1a0490.exe'
Executes the following
- '<SYSTEM32>\cmd.exe' /c ping -n 4 127.0.0.1 >nul & del "%TEMP%\gc_000D7E1A0490.exe"
- '<SYSTEM32>\ping.exe' -n 4 127.0.0.1
