WARNING! USE AT YOUR OWN RISK!
This appears to be a trojan dropper.
This attempts to download and then install a file called Heartbeat.exe - which is malware.
In order for this to "run" you will need to rename the executable to something other then midnight.exe. If you leave it, it will delete itself. If you rename it, then it will update and drop the malware on your system.
Interestingly, if you look at the update process, it doesn't update itself, but instead deletes the process then renames itself, to appear to be legit. It doesnt even actually access the internet, to update, just does a ping test. The only thing which does seem to be legit, is the coords for the real hack.
Code: Select all
PING 1.1.1.1 -n 1 -w 3000 >NUL
del Midnight.exe
ren Midnight_up.exe Midnight.exe
start Midnight.exe
Note: If you block it from accessing the Internet, it will still say there is a update which needs to be run (clue). It then asks if you want to update the database.
As stated, this is a trojan dropper, use at your own risk.
It is NOT A FALSE POSITIVE!!!!
Names on the files were changed by me, to differentiate between the different copies I ran, but it's still the same file.
Who is online