Technical Information
To ensure autorun and distribution:
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\Systemwinerl] 'Start' = '00000002'
Malicious functions:
Creates and executes the following:
- '<SYSTEM32>\1033\sc.exe' delete Systemolers
- '<SYSTEM32>\1033\sc.exe' stop Systemoln
- '<SYSTEM32>\1033\sc.exe' stop Systemolers
- '<SYSTEM32>\1033\sc.exe' stop Systemoler
- '<SYSTEM32>\1033\sc.exe' delete Systemoler
- '<SYSTEM32>\1033\sc.exe' stop Systemhelps
- '<SYSTEM32>\1033\sc.exe' delete Systemhelps
- '<SYSTEM32>\1033\sc.exe' delete Systemhelp
- '<SYSTEM32>\1033\sc.exe' delete Systemoln
- '<SYSTEM32>\1033\sc.exe' stop Systemhelp
- '<SYSTEM32>\1033\sc.exe' delete Systemo
- '<SYSTEM32>\1033\sc.exe' stop Systemink
- '<SYSTEM32>\1033\sc.exe' stop Systemo
- '<SYSTEM32>\1033\sc.exe' stop Systemen
- '<SYSTEM32>\1033\sc.exe' delete Systemen
- '<SYSTEM32>\1033\sc.exe' stop Systemol
- '<SYSTEM32>\1033\sc.exe' delete Systemol
- '<SYSTEM32>\1033\sc.exe' delete Wintkons
- '<SYSTEM32>\1033\sc.exe' delete Systemink
- '<SYSTEM32>\1033\sc.exe' stop Wintkons
- '<SYSTEM32>\1033\sc.exe' stop WintTapi
- '<SYSTEM32>\1033\sc.exe' config Systemwinerl start= auto
- '<SYSTEM32>\1033\sc.exe' description Systemwinerl "Doll xport The Makefiles "
- '<SYSTEM32>\1033\instsrv.exe' Systemwinerl <SYSTEM32>\1033\csrss.exe
- '<SYSTEM32>\1033\sc.exe' delete Systemwinere
- '<SYSTEM32>\1033\instsrv.exe' Systemwinerl remove
- '<SYSTEM32>\1033\sc.exe' /c <SYSTEM32>\1033\xcc4.bat
- '<SYSTEM32>\1033\mecoind.exe' -pooluser=DNjHh3utoa13d1ugQxcyikHaJVJ3JtjsJC -poolpassword=0 -poolip=162.243.41.59 -poolport=8336 -poolshare=6 -genproclimit=8
- '<SYSTEM32>\1033\sc.exe'
- '<SYSTEM32>\1033\sc.exe' /pid=2756
- '<SYSTEM32>\1033\sc.exe' start Systemwinerl
- '<SYSTEM32>\1033\sc.exe' stop Systemwiner
- '<SYSTEM32>\1033\sc.exe' delete Systemwiner
- '<SYSTEM32>\1033\sc.exe' delete Systemwin
- '<SYSTEM32>\1033\sc.exe' delete WintTapi
- '<SYSTEM32>\1033\sc.exe' stop Systemwin
- '<SYSTEM32>\1033\sc.exe' delete Systemwinert
- '<SYSTEM32>\1033\sc.exe' stop Systemwinere
- '<SYSTEM32>\1033\sc.exe' stop Systemwinert
- '<SYSTEM32>\1033\sc.exe' stop Systemwiners
- '<SYSTEM32>\1033\sc.exe' delete Systemwiners
- '<SYSTEM32>\1033\sc.exe' delete Wintkoosens
- '<SYSTEM32>\1033\sc.exe' delete Wintkooden
- '<SYSTEM32>\1033\sc.exe' stop SystemManers
- '<SYSTEM32>\1033\sc.exe' stop Wintkooden
- '<SYSTEM32>\1033\sc.exe' stop SystemManag
- '<SYSTEM32>\1033\sc.exe' delete SystemManag
- '<SYSTEM32>\1033\sc.exe' stop Wintkoodinst
- '<SYSTEM32>\1033\sc.exe' delete Wintkoodinst
- '<SYSTEM32>\1033\sc.exe' delete Wintkoodin
- '<SYSTEM32>\1033\sc.exe' delete SystemManers
- '<SYSTEM32>\1033\sc.exe' stop Wintkoodin
- '<SYSTEM32>\1033\sc.exe' delete wintkool
- '<SYSTEM32>\1033\sc.exe' stop wintkooder
- '<SYSTEM32>\1033\sc.exe' stop wintkool
- '<SYSTEM32>\1033\sc.exe' stop wintkooer
- '<SYSTEM32>\1033\sc.exe' delete wintkooer
- '<SYSTEM32>\1033\sc.exe' stop wintkooders
- '<SYSTEM32>\1033\sc.exe' delete wintkooders
- '<SYSTEM32>\1033\sc.exe' delete wintkood
- '<SYSTEM32>\1033\sc.exe' delete wintkooder
- '<SYSTEM32>\1033\sc.exe' stop wintkood
- '<SYSTEM32>\1033\sc.exe' stop Wintkoodins
- '<SYSTEM32>\1033\sc.exe' stop Wintkoosen
- '<SYSTEM32>\1033\sc.exe' delete Wintkoosen
- '<SYSTEM32>\1033\sc.exe' delete Wintkooser
- '<SYSTEM32>\1033\sc.exe' delete SystemMain
- '<SYSTEM32>\1033\sc.exe' stop Wintkooser
- '<SYSTEM32>\1033\sc.exe' delete SystemMens
- '<SYSTEM32>\1033\sc.exe' stop Wintkoosens
- '<SYSTEM32>\1033\sc.exe' stop SystemMens
- '<SYSTEM32>\1033\sc.exe' stop SystemMern
- '<SYSTEM32>\1033\sc.exe' delete SystemMern
- '<SYSTEM32>\1033\sc.exe' stop Wintkoodiner
- '<SYSTEM32>\1033\sc.exe' delete Wintkoodiner
- '<SYSTEM32>\1033\sc.exe' delete SystemMans
- '<SYSTEM32>\1033\sc.exe' delete Wintkoodins
- '<SYSTEM32>\1033\sc.exe' stop SystemMans
- '<SYSTEM32>\1033\sc.exe' delete Wintkoose
- '<SYSTEM32>\1033\sc.exe' stop SystemMain
- '<SYSTEM32>\1033\sc.exe' stop Wintkoose
- '<SYSTEM32>\1033\sc.exe' stop Wintkoodop
- '<SYSTEM32>\1033\sc.exe' delete Wintkoodop
Executes the following:
- '<SYSTEM32>\attrib.exe' +s +r +h sc.exe
- '<SYSTEM32>\net.exe' stop Systemwinerl
- '<SYSTEM32>\attrib.exe' +s +r +h csrss.exe
- '<SYSTEM32>\attrib.exe' +s +r +h instsrv.exe
- '<SYSTEM32>\net1.exe' stop Systemwinerl
- '%WINDIR%\regedit.exe' /s sh.reg
- '<SYSTEM32>\ping.exe' -n 2 127.1
- '<SYSTEM32>\attrib.exe' +s +r +h <SYSTEM32>\1033\instsrv.exe
- '<SYSTEM32>\attrib.exe' +s +r +h <SYSTEM32>\1033\csrss.exe
- '<SYSTEM32>\taskkill.exe' /f /im smssz.exe
- '<SYSTEM32>\taskkill.exe' /f /im minerd.exe
- '<SYSTEM32>\cmd.exe' /c ""<SYSTEM32>\1033\ys.bat" "
- '<SYSTEM32>\taskkill.exe' /f /im mecoind.exe
- '<SYSTEM32>\taskkill.exe' /f /im meciond.exe
- '<SYSTEM32>\ping.exe' -n 3 127.1
- '<SYSTEM32>\attrib.exe' +s +r +h lsass.exe
- '<SYSTEM32>\taskkill.exe' /f /im smszs.exe
- '<SYSTEM32>\taskkill.exe' /f /im const.exe
Modifies file system :
Creates the following files:
- <SYSTEM32>\1033\sh.reg
- <SYSTEM32>\1033\xcc4.bat
- <SYSTEM32>\1033\ys.bat
- <SYSTEM32>\1033\sc.exe
- <SYSTEM32>\1033\csrss.exe
- <SYSTEM32>\1033\instsrv.exe
- <SYSTEM32>\1033\mecoind.exe
Sets the 'hidden' attribute to the following files:
- <SYSTEM32>\1033\sc.exe
- <SYSTEM32>\1033\instsrv.exe
- <SYSTEM32>\1033\csrss.exe
Deletes the following files:
- <SYSTEM32>\1033\sh.reg
Miscellaneous:
Searches for the following windows:
- ClassName: '(null)' WindowName: '(null)'
- ClassName: 'RegEdit_RegEdit' WindowName: '(null)'
- ClassName: 'EDIT' WindowName: '(null)'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
