Technical Information
Malicious functions:
Executes the following:
- '<SYSTEM32>\taskkill.exe' /fi "imagename eq KakaoTalk.exe"
- '<SYSTEM32>\tasklist.exe' /fi "imagename eq LINE.exe"
- '<SYSTEM32>\taskkill.exe' /fi "imagename eq LINE.exe"
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\1.tmp\2.bat" <Full path to file>"
- '<SYSTEM32>\mode.com' con cols=80 lines=30
- '<SYSTEM32>\tasklist.exe' /fi "imagename eq KakaoTalk.exe"
Modifies file system:
Creates the following files:
- <SYSTEM32>\test
- %TEMP%\1.tmp\2.bat
Deletes the following files:
- <SYSTEM32>\test
Miscellaneous:
Searches for the following windows:
- ClassName: '' WindowName: ''
