Technical Information
Malicious functions:
Creates and executes the following:
- '<SYSTEM32>\1041\sc.exe' stop Systemoler
- '<SYSTEM32>\1041\sc.exe' delete Systemoler
- '<SYSTEM32>\1041\sc.exe' stop Systemol
- '<SYSTEM32>\1041\sc.exe' delete Systemol
- '<SYSTEM32>\1041\sc.exe' stop Systemolers
- '<SYSTEM32>\1041\sc.exe' delete Systemoln
- '<SYSTEM32>\1041\sc.exe' stop Systemhelp
- '<SYSTEM32>\1041\sc.exe' delete Systemolers
- '<SYSTEM32>\1041\sc.exe' stop Systemoln
- '<SYSTEM32>\1041\sc.exe' delete Wintkons
- '<SYSTEM32>\1041\sc.exe' stop Systemen
- '<SYSTEM32>\1041\sc.exe' delete Systemen
- '<SYSTEM32>\1041\sc.exe' stop Wintkoosens
- '<SYSTEM32>\1041\sc.exe' delete Wintkoosens
- '<SYSTEM32>\1041\sc.exe' stop Systemo
- '<SYSTEM32>\1041\sc.exe' delete Systemink
- '<SYSTEM32>\1041\sc.exe' stop Wintkons
- '<SYSTEM32>\1041\sc.exe' delete Systemo
- '<SYSTEM32>\1041\sc.exe' stop Systemink
- '<SYSTEM32>\1041\sc.exe' delete Systemhelp
- '<SYSTEM32>\1041\sc.exe' stop Systemwinere
- '<SYSTEM32>\1041\sc.exe' delete Systemwinere
- '<SYSTEM32>\1041\sc.exe' stop Systemwinert
- '<SYSTEM32>\1041\sc.exe' delete Systemwinert
- '<SYSTEM32>\1041\sc.exe' stop Systemwinerl
- '<SYSTEM32>\1041\sc.exe' delete Systemwinerm
- '<SYSTEM32>\1041\instsrv.exe' Systemwia remove
- '<SYSTEM32>\1041\sc.exe' delete Systemwinerl
- '<SYSTEM32>\1041\sc.exe' stop Systemwinerm
- '<SYSTEM32>\1041\sc.exe' delete Systemwiners
- '<SYSTEM32>\1041\sc.exe' stop WintTapi
- '<SYSTEM32>\1041\sc.exe' delete WintTapi
- '<SYSTEM32>\1041\sc.exe' stop Systemhelps
- '<SYSTEM32>\1041\sc.exe' delete Systemhelps
- '<SYSTEM32>\1041\sc.exe' stop Systemwin
- '<SYSTEM32>\1041\sc.exe' delete Systemwiner
- '<SYSTEM32>\1041\sc.exe' stop Systemwiners
- '<SYSTEM32>\1041\sc.exe' delete Systemwin
- '<SYSTEM32>\1041\sc.exe' stop Systemwiner
- '<SYSTEM32>\1041\sc.exe' delete SystemMens
- '<SYSTEM32>\1041\sc.exe' stop Wintkooden
- '<SYSTEM32>\1041\sc.exe' delete Wintkooden
- '<SYSTEM32>\1041\sc.exe' stop SystemManag
- '<SYSTEM32>\1041\sc.exe' delete SystemManag
- '<SYSTEM32>\1041\sc.exe' stop SystemManers
- '<SYSTEM32>\1041\sc.exe' delete Wintkoodin
- '<SYSTEM32>\1041\sc.exe' stop Wintkoodinst
- '<SYSTEM32>\1041\sc.exe' delete SystemManers
- '<SYSTEM32>\1041\sc.exe' stop Wintkoodin
- '<SYSTEM32>\1041\sc.exe' delete wintkooders
- '<SYSTEM32>\1041\sc.exe' stop wintkool
- '<SYSTEM32>\1041\sc.exe' delete wintkool
- '<SYSTEM32>\1041\sc.exe' stop wintkooer
- '<SYSTEM32>\1041\sc.exe' delete wintkooer
- '<SYSTEM32>\1041\sc.exe' stop wintkooder
- '<SYSTEM32>\1041\sc.exe' delete wintkood
- '<SYSTEM32>\1041\sc.exe' stop wintkooders
- '<SYSTEM32>\1041\sc.exe' delete wintkooder
- '<SYSTEM32>\1041\sc.exe' stop wintkood
- '<SYSTEM32>\1041\sc.exe' delete Wintkoodinst
- '<SYSTEM32>\1041\sc.exe' stop Wintkooser
- '<SYSTEM32>\1041\sc.exe' delete Wintkooser
- '<SYSTEM32>\1041\sc.exe' stop SystemMain
- '<SYSTEM32>\1041\sc.exe' delete SystemMain
- '<SYSTEM32>\1041\sc.exe' stop Wintkoosen
- '<SYSTEM32>\1041\sc.exe' delete SystemMern
- '<SYSTEM32>\1041\sc.exe' stop SystemMens
- '<SYSTEM32>\1041\sc.exe' delete Wintkoosen
- '<SYSTEM32>\1041\sc.exe' stop SystemMern
- '<SYSTEM32>\1041\sc.exe' delete Wintkoose
- '<SYSTEM32>\1041\sc.exe' stop SystemMans
- '<SYSTEM32>\1041\sc.exe' delete SystemMans
- '<SYSTEM32>\1041\sc.exe' stop Wintkoodins
- '<SYSTEM32>\1041\sc.exe' delete Wintkoodins
- '<SYSTEM32>\1041\sc.exe' stop Wintkoodiner
- '<SYSTEM32>\1041\sc.exe' delete Wintkoodop
- '<SYSTEM32>\1041\sc.exe' stop Wintkoose
- '<SYSTEM32>\1041\sc.exe' delete Wintkoodiner
- '<SYSTEM32>\1041\sc.exe' stop Wintkoodop
Executes the following:
- '<SYSTEM32>\attrib.exe' +s +r +h csrss.exe
- '<SYSTEM32>\attrib.exe' +s +r +h lsass.exe
- '<SYSTEM32>\ping.exe' -n 3 127.1
- '<SYSTEM32>\attrib.exe' +s +r +h instsrv.exe
- '<SYSTEM32>\net1.exe' stop Systemwia
- '<SYSTEM32>\net.exe' stop Systemwia
- '<SYSTEM32>\attrib.exe' +s +r +h sc.exe
- '<SYSTEM32>\taskkill.exe' /f /im smssz.exe
- '<SYSTEM32>\taskkill.exe' /f /im mecoind.exe
- '<SYSTEM32>\cmd.exe' /c ""<SYSTEM32>\1041\ys.bat" "
- '<SYSTEM32>\taskkill.exe' /f /im minerd.exe
- '<SYSTEM32>\taskkill.exe' /f /im const.exe
- '<SYSTEM32>\taskkill.exe' /f /im smszs.exe
- '<SYSTEM32>\taskkill.exe' /f /im meciond.exe
Modifies file system :
Creates the following files:
- <SYSTEM32>\1041\sh.reg
- <SYSTEM32>\1041\smssz.exe
- <SYSTEM32>\1041\QtNetwork4.dll
- <SYSTEM32>\1041\sc.exe
- <SYSTEM32>\1041\data\Minicoin.conf
- <SYSTEM32>\1041\data\wallet.dat
- <SYSTEM32>\1041\xcc4.bat
- <SYSTEM32>\1041\ys.bat
- <SYSTEM32>\1041\libgcc_s_dw2-1.dll
- <SYSTEM32>\1041\libgmp-10.dll
- <SYSTEM32>\1041\csrss.exe
- <SYSTEM32>\1041\instsrv.exe
- <SYSTEM32>\1041\QtCore4.dll
- <SYSTEM32>\1041\QtGui4.dll
- <SYSTEM32>\1041\libstdc++-6.dll
- <SYSTEM32>\1041\mingwm10.dll
Sets the 'hidden' attribute to the following files:
- <SYSTEM32>\1041\sc.exe
- <SYSTEM32>\1041\instsrv.exe
- <SYSTEM32>\1041\csrss.exe
Miscellaneous:
Searches for the following windows:
- ClassName: '(null)' WindowName: '(null)'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'EDIT' WindowName: '(null)'
