Technical Information
Malicious functions:
Creates and executes the following:
- 'C:\quickkill\PsExec.exe' /accepteula -sd C:\quickkill\sysrun.bat
- '%WINDIR%\PSEXESVC.EXE'
- 'C:\quickkill\gawk.exe' "{print "PsExec" $2}"
- 'C:\quickkill\egrep.exe' -vi "(conhost\.exe|explorer\.exe|winlogon|Name|System|UI0Detect|WMIC|svchost|lsass|lsm|spoolsv|cmd|smss|csrss|wininit|services\.exe|wdm|cmgshieldsvc|emsservice|emservice)"
- 'C:\quickkill\Cax.exe' /killall wait
- 'C:\quickkill\Cax.exe' /killall ctfmon.exe
- 'C:\quickkill\Cax.exe' /killall alg.exe
- 'C:\quickkill\Cax.exe' /killall __cd75efb816b2cc__.exe
- 'C:\quickkill\Cax.exe' /killall 360tray.exe
- 'C:\quickkill\Cax.exe' /killall ageofconan.exe
- 'C:\quickkill\Cax.exe' /killall aion.exe
- 'C:\quickkill\Cax.exe' /killall ash.exe
- 'C:\quickkill\Cax.exe' /killall ashAvast.exe
- 'C:\quickkill\Cax.exe' /killall ashAvSrv.exe
- 'C:\quickkill\Cax.exe' /killall avgcc.exe
- 'C:\quickkill\Cax.exe' /killall AVGCC32.EXE
- 'C:\quickkill\Cax.exe' /killall AVGCTRL.EXE
- 'C:\quickkill\Cax.exe' /killall AVP.COM
- 'C:\quickkill\Cax.exe' /killall AVP.EXE
- 'C:\quickkill\Cax.exe' /killall AVP32.EXE
- 'C:\quickkill\Cax.exe' /killall AVPCC.EXE
- 'C:\quickkill\Cax.exe' /killall AVPM.EXE
- 'C:\quickkill\Cax.exe' /killall AVSYNMGR.EXE
- 'C:\quickkill\Cax.exe' /killall bdagent.exe
- 'C:\quickkill\Cax.exe' /killall bdss.exe
- 'C:\quickkill\Cax.exe' /killall bdsubmit.exe
- 'C:\quickkill\Cax.exe' /killall cabalmain.exe
- 'C:\quickkill\Cax.exe' /killall ccapp.exe
- 'C:\quickkill\Cax.exe' /killall chrome.exe
- 'C:\quickkill\Cax.exe' /killall ClamWin.exe
- 'C:\quickkill\Cax.exe' /killall dekaron.exe
- 'C:\quickkill\Cax.exe' /killall dnf.exe
- 'C:\quickkill\Cax.exe' /killall drweb.exe
- 'C:\quickkill\Cax.exe' /killall Drweb32w.exe
- 'C:\quickkill\Cax.exe' /killall drweb386.exe
- 'C:\quickkill\Cax.exe' /killall Drwebupw.exe
- 'C:\quickkill\Cax.exe' /killall Drwebwcl.exe
- 'C:\quickkill\Cax.exe' /killall egni.exe
- 'C:\quickkill\Cax.exe' /killall ekrn.exe
- 'C:\quickkill\Cax.exe' /killall elementclient.exe
- 'C:\quickkill\Cax.exe' /killall firefox.exe
- 'C:\quickkill\Cax.exe' /killall fsav.exe
- 'C:\quickkill\Cax.exe' /killall fsav32.exe
- 'C:\quickkill\Cax.exe' /killall fsavaui.exe
- 'C:\quickkill\Cax.exe' /killall fsavgui.exe
- 'C:\quickkill\Cax.exe' /killall gc.exe
- 'C:\quickkill\Cax.exe' /killall ge.exe
- 'C:\quickkill\Cax.exe' /killall googletalk.exe
- 'C:\quickkill\Cax.exe' /killall GUARD.EXE
- 'C:\quickkill\Cax.exe' /killall GVOnline.bin
- 'C:\quickkill\Cax.exe' /killall gw.exe
- 'C:\quickkill\Cax.exe' /killall httplook.exe
- 'C:\quickkill\Cax.exe' /killall ICQ.exe
- 'C:\quickkill\Cax.exe' /killall iexplore.exe
- 'C:\quickkill\Cax.exe' /killall InphaseNXD.exe
- 'C:\quickkill\Cax.exe' /killall l2.bin
- 'C:\quickkill\Cax.exe' /killall lin.bin
- 'C:\quickkill\Cax.exe' /killall lotroclient.exe
- 'C:\quickkill\Cax.exe' /killall magent.exe
- 'C:\quickkill\Cax.exe' /killall maplestory.exe
- 'C:\quickkill\Cax.exe' /killall MCAGENT.EXE
- 'C:\quickkill\Cax.exe' /killall Mir3Game.exe
- 'C:\quickkill\Cax.exe' /killall miranda32.exe
- 'C:\quickkill\Cax.exe' /killall mpftray.exe
- 'C:\quickkill\Cax.exe' /killall msn6.exe
- 'C:\quickkill\Cax.exe' /killall msnmsgr.exe
- 'C:\quickkill\Cax.exe' /killall NAVAPW32.EXE
- 'C:\quickkill\Cax.exe' /killall netxray.exe
- 'C:\quickkill\Cax.exe' /killall nod.exe
- 'C:\quickkill\Cax.exe' /killall nod32.exe
Executes the following:
- '<SYSTEM32>\cmd.exe' /c ""c:\quickkill\install.bat" "
- '<SYSTEM32>\cmd.exe' /c ""C:\quickkill\sysrun.bat" "
- '<SYSTEM32>\wbem\wmic.exe' process list brief
Terminates or attempts to terminate
the following system processes:
- <SYSTEM32>\ctfmon.exe
- <SYSTEM32>\alg.exe
a large number of user processes.
Modifies file system :
Creates the following files:
- C:\quickkill\cat.exe
- C:\quickkill\Cax.exe
- C:\quickkill\egrep.exe
- C:\quickkill\gawk.exe
- C:\quickkill\install.bat
- C:\quickkill\out.txt
- C:\quickkill\PsExec.exe
- C:\quickkill\sed.exe
- C:\quickkill\sysrun.bat
- %WINDIR%\PSEXESVC.EXE
- %WINDIR%\Temp\tmp1.tmp
- %WINDIR%\Temp\tmp2.tmp
- <SYSTEM32>\wbem\AutoRecover\C8463ECBE33BC240263A0B094E46D510.mof
- %WINDIR%\Temp\tmp3.tmp
- <SYSTEM32>\wbem\AutoRecover\23BDE61F1F4FACE17E9B0C01F2A1FD9B.mof
Deletes the following files:
- %WINDIR%\Temp\tmp1.tmp
- %WINDIR%\Temp\tmp2.tmp
- %WINDIR%\Temp\tmp3.tmp
Miscellaneous:
Searches for the following windows:
- ClassName: 'EDIT' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
