Technical Information
To ensure autorun and distribution
Creates the following files on removable media
- <Drive name for removable media>:\delete.avi
- <Drive name for removable media>:\ako-readme.txt
- <Drive name for removable media>:\id.key
- <Drive name for removable media>:\join.avi
- <Drive name for removable media>:\default.bmp
- <Drive name for removable media>:\tileimage.bmp
- <Drive name for removable media>:\dialmap.bmp
- <Drive name for removable media>:\coffee.bmp
- <Drive name for removable media>:\toolbar.bmp
- <Drive name for removable media>:\dashborder_144.bmp
- <Drive name for removable media>:\contosoroot.cer
- <Drive name for removable media>:\sdksampleunprivdeveloper.cer
- <Drive name for removable media>:\contoso.cer
- <Drive name for removable media>:\applicantform_en.doc
- <Drive name for removable media>:\hanni_umami_chapter.doc
Malicious functions
To complicate detection of its presence in the operating system,
blocks the following features:
- System Restore (SR)
deletes volume shadow copies.
Injects code into
the following system processes:
- <SYSTEM32>\vssvc.exe
Modifies file system
Creates the following files
- %WINDIR%\logs\windowsbackup\wbadmin.0.etl
- C:\far2\addons\colors\custom_highlighting\ako-readme.txt
- C:\far2\addons\colors\custom_highlighting\id.key
Deletes the following files
- %WINDIR%\logs\windowsbackup\wbadmin.3.etl
Moves the following files
- from %WINDIR%\logs\windowsbackup\wbadmin.0.etl to %WINDIR%\logs\windowsbackup\wbadmin.1.etl
- from %WINDIR%\logs\windowsbackup\wbadmin.1.etl to %WINDIR%\logs\windowsbackup\wbadmin.2.etl
- from %WINDIR%\logs\windowsbackup\wbadmin.2.etl to %WINDIR%\logs\windowsbackup\wbadmin.3.etl
Substitutes the following files
- %WINDIR%\logs\windowsbackup\wbadmin.0.etl
- %WINDIR%\logs\windowsbackup\wbadmin.1.etl
- %WINDIR%\logs\windowsbackup\wbadmin.2.etl
- %WINDIR%\logs\windowsbackup\wbadmin.3.etl
Miscellaneous
Executes the following
- '<SYSTEM32>\vssvc.exe'
- '<SYSTEM32>\svchost.exe' -k swprv
- '<SYSTEM32>\bcdedit.exe' /set {default} bootstatuspolicy ignoreallfailures
- '<SYSTEM32>\wbadmin.exe' DELETE SYSTEMSTATEBACKUP
- '<SYSTEM32>\wbadmin.exe' DELETE SYSTEMSTATEBACKUP -deleteOldest
- '<SYSTEM32>\wbem\wmic.exe' SHADOWCOPY /nointeractive
