Technical Information
Malicious functions:
Executes the following:
- <SYSTEM32>\rundll32.exe "%PROGRAM_FILES%\sNiu.dll",MyDLLEntry
Terminates or attempts to terminate
the following user processes:
- AVP.EXE
- AVP.COM
- 360tray.exe
Restores hooked functions in System Service Descriptor Table (SSDT).
Modifies file system :
Creates the following files:
- %WINDIR%\Fonts\belww.fon
- %PROGRAM_FILES%\sNiu.dll
Deletes the following files:
- %WINDIR%\Fonts\belww.fon