Technical Information
Malicious functions:
Executes the following:
- '<SYSTEM32>\taskkill.exe' /IM ConnectifyGopher.exe /F
- '<SYSTEM32>\taskkill.exe' /IM DispatchUI.exe /F
- '<SYSTEM32>\net1.exe' start Connectify
- '<SYSTEM32>\xcopy.exe' "<Current directory>\Crack\*" "\Connectify\" /s /i /h /e /r /y
- '<SYSTEM32>\taskkill.exe' /IM Connectifyd.exe /F
- '<SYSTEM32>\net.exe' stop Connectify
- '<SYSTEM32>\attrib.exe' +h %TEMP%\ztmp
- '<SYSTEM32>\taskkill.exe' /IM Connectify.exe /F
- '<SYSTEM32>\net1.exe' stop Connectify
Modifies file system :
Creates the following files:
- %TEMP%\ztmp\tmp32921.exe
- %TEMP%\ztmp\tmp32431.bat
Deletes the following files:
- %TEMP%\ztmp\tmp32921.exe
Miscellaneous:
Searches for the following windows:
- ClassName: '(null)' WindowName: '(null)'
