HackTool.Win32.PingSweep.B

This Hacking Tool arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Arrival Details

This Hacking Tool arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Hacking Tool drops the following files:

• {malware path}\o.txt

Other Details

This Hacking Tool requires the following additional components to properly run:

• {malware path}\ip.txt
  • should contain domain name inputs used by application

It does the following:

• it resolves domain names into their corresponding IP addresses by doing the following:
  • reads ip.txt for the following inputs:
    • {domain}
    • note: if multiple domains as input, each should be separated with a new line
  • checks if domain is alive (through ICMP echo requests). If so, it retrieves its IP address and displays the following in the console:
    • ok: {resolved IP address} {domain}
  • records the resolution into o.txt as
    • {domain} {resolved IP address} 0
  • if domain is not alive, it displays the following in the console:
    • no: {domain}
• part of the console output are:
  • timeout=[{time (ms) to wait for replies}]
  • thread=[10]
    • no significant impact in application
  • time= {time (ms) elapsed since start of domain to ip resolution}