Technical Information
Malicious functions:
Executes the following:
- '<SYSTEM32>\cmd.exe' /c dir "C:\soft\p7_k*.exe" /b /s
- '<SYSTEM32>\taskkill.exe' /f /im QQPCtray.exe
- '<SYSTEM32>\taskkill.exe' /f /im qqpcrtp.exe
- '<SYSTEM32>\cmd.exe' /c dir "C:\soft\p3_k*.exe" /b /s
- '<SYSTEM32>\cmd.exe' /c %TEMP%\bt8720.bat
- '<SYSTEM32>\cmd.exe' /c dir "%WINDIR%\KMS\rites.exe" /b /s
- '<SYSTEM32>\cmd.exe' /c dir "C:\soft\OEM\╬в╚э(Microsoft)OEM╛▓─м░▓╫░.exe" /b /s
Modifies file system:
Creates the following files:
- %TEMP%\bt8720.bat
Sets the 'hidden' attribute to the following files:
- %TEMP%\bt8720.bat
Miscellaneous:
Searches for the following windows:
- ClassName: '' WindowName: ''
