Technical Information
Malicious functions
Executes the following
- '<SYSTEM32>\taskkill.exe' /F /IM x64dbg.exe
- '<SYSTEM32>\taskkill.exe' /F /IM x32dbg.exe
- '<SYSTEM32>\taskkill.exe' /F /IM ollydbg.exe
- '<SYSTEM32>\taskkill.exe' /F /IM windbg.exe
- '<SYSTEM32>\taskkill.exe' /F /IM ida.exe
- '<SYSTEM32>\taskkill.exe' /F /IM ida64.exe
- '<SYSTEM32>\taskkill.exe' /F /IM idaq.exe
- '<SYSTEM32>\taskkill.exe' /F /IM idaq64.exe
- '<SYSTEM32>\taskkill.exe' /F /IM idaw.exe
Modifies file system
Creates the following files
- nul
- %TEMP%\3354668345.exe
Deletes following files that it created itself
- %TEMP%\3354668345.exe
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: ''
Creates and executes the following
- '%TEMP%\3354668345.exe'
Executes the following
- '<SYSTEM32>\tasklist.exe'
- '<SYSTEM32>\cmd.exe' /C "title CoreBoosts v1.3.5 - Premium Nitro Sniper + Invite Scraper by @hw2d"
- '<SYSTEM32>\taskkill.exe' /F /IM x64dbg.exe' (with hidden window)
- '<SYSTEM32>\tasklist.exe' ' (with hidden window)
- '<SYSTEM32>\taskkill.exe' /F /IM x32dbg.exe' (with hidden window)
- '<SYSTEM32>\taskkill.exe' /F /IM ollydbg.exe' (with hidden window)
- '<SYSTEM32>\taskkill.exe' /F /IM windbg.exe' (with hidden window)
- '<SYSTEM32>\taskkill.exe' /F /IM ida.exe' (with hidden window)
- '<SYSTEM32>\taskkill.exe' /F /IM ida64.exe' (with hidden window)
- '<SYSTEM32>\taskkill.exe' /F /IM idaq.exe' (with hidden window)
- '<SYSTEM32>\taskkill.exe' /F /IM idaq64.exe' (with hidden window)
- '<SYSTEM32>\taskkill.exe' /F /IM idaw.exe' (with hidden window)
