Technical Information
Malicious functions
Executes the following
- '<SYSTEM32>\taskkill.exe' /f /im taskmgr*
- '<SYSTEM32>\taskkill.exe' /FI "IMAGENAME eq x32dbg*" /IM * /F /T
- '<SYSTEM32>\taskkill.exe' /FI "IMAGENAME eq x64dbg*" /IM * /F /T
- '<SYSTEM32>\taskkill.exe' /f /im easyanticheat*
- '<SYSTEM32>\taskkill.exe' /f /im beservice*
- '<SYSTEM32>\taskkill.exe' /f /im vanguard*
- '<SYSTEM32>\taskkill.exe' /f /im valorant*
- '<SYSTEM32>\taskkill.exe' /f /im epicgames*
- '<SYSTEM32>\taskkill.exe' /FI "IMAGENAME eq ollydbg*" /IM * /F /T
- '<SYSTEM32>\taskkill.exe' /f /im fortnite*
- '<SYSTEM32>\taskkill.exe' /FI "IMAGENAME eq taskmgr*" /IM * /F /T
- '<SYSTEM32>\taskkill.exe' /FI "IMAGENAME eq taskmanager*" /IM * /F /T
- '<SYSTEM32>\taskkill.exe' /FI "IMAGENAME eq cheatengine*" /IM * /F /T
- '<SYSTEM32>\taskkill.exe' /FI "IMAGENAME eq processhacker*" /IM * /F /T
- '<SYSTEM32>\taskkill.exe' /f /im processhacker.exe
- '<SYSTEM32>\taskkill.exe' /f /im taskmgr.exe
- '<SYSTEM32>\taskkill.exe' /f /im mmc.exe
- '<SYSTEM32>\taskkill.exe' /FI "IMAGENAME eq httpdebugger*" /IM * /F /T
- '<SYSTEM32>\taskkill.exe' /FI "IMAGENAME eq fiddler*" /IM * /F /T
Launches a large number of processes
Searches for windows to
detect analytical utilities:
- ClassName: '', WindowName: 'The Wireshark Network Analyzer'
Modifies file system
Creates the following files
- nul
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: ''
- ClassName: '' WindowName: 'ProcessHacker'
- ClassName: '' WindowName: 'HTTP Debugger Pro'
- ClassName: '' WindowName: 'Ida Freeware'
- ClassName: '' WindowName: 'Ida Pro'
- ClassName: '' WindowName: 'Ida'
- ClassName: '' WindowName: 'Cheat Engine 6.8'
- ClassName: '' WindowName: 'Cheat Engine 6.9'
- ClassName: '' WindowName: 'Cheat Engine 7.0'
- ClassName: '' WindowName: 'Cheat Engine 7.1'
- ClassName: '' WindowName: 'Cheat Engine 7.2'
- ClassName: '' WindowName: 'HxD'
- ClassName: '' WindowName: 'FolderChangesView'
- ClassName: '' WindowName: 'dnSpy'
- ClassName: '' WindowName: 'HTTP Debugger'
- ClassName: '' WindowName: 'x64dbg'
- ClassName: '' WindowName: 'Finddler'
- ClassName: '' WindowName: 'Progress Telerik Folder Web Debugger'
- ClassName: '' WindowName: 'Process Hacker'
- ClassName: '' WindowName: 'Task Manager'
- ClassName: '' WindowName: 'Process Hacker 2'
- ClassName: '' WindowName: 'OllyDbg'
Executes the following
- '<SYSTEM32>\cmd.exe' /c taskkill /f /im taskmgr* >nul 2>&1
- '<SYSTEM32>\cmd.exe' /c taskkill /FI "IMAGENAME eq x32dbg*" /IM * /F /T >nul 2>&1
- '<SYSTEM32>\cmd.exe' /c taskkill /FI "IMAGENAME eq x64dbg*" /IM * /F /T >nul 2>&1
- '<SYSTEM32>\cmd.exe' /c taskkill /f /im easyanticheat* >Nul 2>&1
- '<SYSTEM32>\cmd.exe' /c taskkill /f /im beservice* >Nul 2>&1
- '<SYSTEM32>\cmd.exe' /c taskkill /f /im vanguard* >Nul 2>&1
- '<SYSTEM32>\cmd.exe' /c taskkill /f /im valorant* >Nul 2>&1
- '<SYSTEM32>\cmd.exe' /c taskkill /f /im epicgames* >Nul 2>&1
- '<SYSTEM32>\cmd.exe' /c taskkill /f /im fortnite* >Nul 2>&1
- '<SYSTEM32>\sc.exe' stop vgc
- '<SYSTEM32>\cmd.exe' /c sc stop vgc >Nul 2>&1
- '<SYSTEM32>\sc.exe' stop vgk
- '<SYSTEM32>\cmd.exe' /c sc stop vgk >Nul 2>&1
- '<SYSTEM32>\cmd.exe' /c taskkill /FI "IMAGENAME eq ollydbg*" /IM * /F /T >nul 2>&1
- '<SYSTEM32>\sc.exe' stop easyanticheat
- '<SYSTEM32>\sc.exe' stop bedaisy
- '<SYSTEM32>\cmd.exe' /c sc stop bedaisy >Nul 2>&1
- '<SYSTEM32>\sc.exe' stop beservice
- '<SYSTEM32>\cmd.exe' /c sc stop beservice >Nul 2>&1
- '<SYSTEM32>\cmd.exe' /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>&1
- '<SYSTEM32>\cmd.exe' /c taskkill /FI "IMAGENAME eq taskmgr*" /IM * /F /T >nul 2>&1
- '<SYSTEM32>\cmd.exe' /c taskkill /FI "IMAGENAME eq taskmanager*" /IM * /F /T >nul 2>&1
- '<SYSTEM32>\cmd.exe' /c taskkill /FI "IMAGENAME eq cheatengine*" /IM * /F /T >nul 2>&1
- '<SYSTEM32>\cmd.exe' /c taskkill /FI "IMAGENAME eq processhacker*" /IM * /F /T >nul 2>&1
- '<SYSTEM32>\cmd.exe' /c taskkill /f /im processhacker.exe >nul 2>&1
- '<SYSTEM32>\cmd.exe' /c taskkill /f /im taskmgr.exe >nul 2>&1
- '<SYSTEM32>\cmd.exe' /c taskkill /f /im mmc.exe >nul 2>&1
- '<SYSTEM32>\cmd.exe' /c sc stop easyanticheat >Nul 2>&1
- '<SYSTEM32>\cmd.exe' /c taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T >nul 2>&1
