Technical Information
Malicious functions:
Executes the following:
- '<SYSTEM32>\tasklist.exe'
Modifies file system :
Creates the following files:
- C:\ProgramData\Microsoft\RAC\Temp\sqlAEE4.tmp
- C:\ProgramData\Microsoft\RAC\Temp\sqlAEF5.tmp
Deletes the following files:
- C:\ProgramData\Microsoft\RAC\Temp\sqlAEE4.tmp
- C:\ProgramData\Microsoft\RAC\Temp\sqlAEF5.tmp
Deletes itself.