Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Shell' = '<PATH_SAMPLE>.vbs'
- [HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Shell' = '<PATH_SAMPLE>.vbs'
- [HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmd.exe] 'Debugger' = ''
- [HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmd.exe] 'Debugger' = '<PATH_SAMPLE>.vbs'
- [HKLM\Software\Microsoft\Windows\CurrentVersion\Run] 'MyStartupScript' = '<PATH_SAMPLE>.vbs'
- [HKLM\Software\Microsoft\Windows\CurrentVersion\Run] 'msvcr80dll' = '%WINDIR%\SysWOW64\msvcr80.dll.bat'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'msvcr80dll' = '%WINDIR%\SysWOW64\msvcr80.dll.bat'
- [HKLM\Software\Microsoft\Windows\CurrentVersion\Run] 'Win32Updater' = '<SYSTEM32>\systemconfig.exe.vbs'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'Anti-VirusScript' = '<SYSTEM32>\systemconfig.exe.vbs'
- [HKLM\Software\Microsoft\Windows\CurrentVersion\Run] 'advapi32_ext' = '%WINDIR%\advapi32_ext.vbs'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'advapi32_ext' = '%WINDIR%\advapi32_ext.vbs'
Malicious functions
To complicate detection of its presence in the operating system,
blocks execution of the following system utilities:
- Command Prompt (CMD)
- Windows Task Manager (Taskmgr)
- Registry Editor (RegEdit)
blocks the following features:
- User Account Control (UAC)
modifies the following system settings:
- [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoRun' = '00000001'
- [HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoRun' = '00000001'
- [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoControlPanel' = '00000001'
- [HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoControlPanel' = '00000001'
- [HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'DisallowRun' = '00000001'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'DisallowRun' = '00000001'
deletes volume shadow copies.
adds antivirus exclusion:
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Set-MpPreference -DisableRealtimeMonitoring $true
Executes the following
- '<SYSTEM32>\taskkill.exe' /IM powershell.exe /F
- '<SYSTEM32>\taskkill.exe' /IM mbam.exe /F
- '<SYSTEM32>\taskkill.exe' /IM pavsrvx.exe /F
- '<SYSTEM32>\taskkill.exe' /IM Protegent.exe /F
- '<SYSTEM32>\taskkill.exe' /IM NortonSecurity.exe /F
- '<SYSTEM32>\taskkill.exe' /IM avc.exe /F
- '<SYSTEM32>\taskkill.exe' /IM avgsvc.exe /F
- '<SYSTEM32>\taskkill.exe' /IM AvastSvc.exe /F
- '<SYSTEM32>\taskkill.exe' /IM avp.exe /F
- '<SYSTEM32>\taskkill.exe' /IM MsMpEng.exe /F
- '<SYSTEM32>\taskkill.exe' /IM msconfig.exe /F
- '<SYSTEM32>\taskkill.exe' /IM gp.exe /F
- '<SYSTEM32>\taskkill.exe' /IM control.exe /F
- '<SYSTEM32>\taskkill.exe' /IM regedit.exe /F
- '<SYSTEM32>\taskkill.exe' /IM cmd.exe /F
- '<SYSTEM32>\taskkill.exe' /IM taskmgr.exe /F
- '<SYSTEM32>\taskkill.exe' /IM avguard.exe /F
- '<SYSTEM32>\taskkill.exe' /IM mcshield.exe /F
Injects code into
the following system processes:
- <SYSTEM32>\wbengine.exe
- <SYSTEM32>\vds.exe
Terminates or attempts to terminate
the following system processes:
- <SYSTEM32>\cmd.exe
Modifies file system
Creates the following files
- %HOMEPATH%\desktop\readmeplease.txt
- %WINDIR%\syswow64\msvcr80.dll.bat
- <SYSTEM32>\systemconfig.exe.vbs
- %WINDIR%\advapi32_ext.vbs
Sets the 'hidden' attribute to the following files
- <PATH_SAMPLE>.vbs
- %WINDIR%\syswow64\msvcr80.dll.bat
- <SYSTEM32>\systemconfig.exe.vbs
- %WINDIR%\advapi32_ext.vbs
Modifies the HOSTS file.
Network activity
Connects to
- 'google.com':80
- 'me###fire.com':443
- '18#.#72.128.203':80
TCP
HTTP GET requests
- http://www.google.com/
Other
- 'me###fire.com':443
UDP
- DNS ASK google.com
- DNS ASK me###fire.com
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: ''
Creates and executes the following
- '<SYSTEM32>\wscript.exe' <SYSTEM32>\systemconfig.exe.vbs
- '<SYSTEM32>\wscript.exe' %WINDIR%\advapi32_ext.vbs
Executes the following
- '<SYSTEM32>\wscript.exe' "<PATH_SAMPLE>.vbs" /elevated
- '<SYSTEM32>\cmd.exe'
- '<SYSTEM32>\calc.exe'
- '<SYSTEM32>\cmd.exe' /c ""%WINDIR%\SysWOW64\msvcr80.dll.bat" "
- '<SYSTEM32>\notepad.exe' %HOMEPATH%\Desktop\READMEPLEASE.txt
- '<SYSTEM32>\cmd.exe' /c "%ProgramFiles%\Bitdefender\Bitdefender 2025\bdnserv.exe" -disable
- '<SYSTEM32>\vds.exe'
- '<SYSTEM32>\cmd.exe' /c wbadmin delete catalog -quiet
- '<SYSTEM32>\wbengine.exe'
- '<SYSTEM32>\cmd.exe' /c vssadmin delete shadows /all /quiet
- '<SYSTEM32>\cmd.exe' /c "%ProgramFiles(x86)%\Kaspersky Lab\Kaspersky Anti-Virus 2025\avp.com" disable
- '<SYSTEM32>\wbadmin.exe' delete catalog -quiet
- '<SYSTEM32>\taskkill.exe' /IM NortonSecurity.exe /F' (with hidden window)
- '<SYSTEM32>\taskkill.exe' /IM avc.exe /F' (with hidden window)
- '<SYSTEM32>\taskkill.exe' /IM msconfig.exe /F' (with hidden window)
- '<SYSTEM32>\taskkill.exe' /IM Protegent.exe /F' (with hidden window)
- '<SYSTEM32>\taskkill.exe' /IM pavsrvx.exe /F' (with hidden window)
- '<SYSTEM32>\taskkill.exe' /IM mbam.exe /F' (with hidden window)
- '<SYSTEM32>\taskkill.exe' /IM control.exe /F' (with hidden window)
- '<SYSTEM32>\taskkill.exe' /IM AvastSvc.exe /F' (with hidden window)
- '<SYSTEM32>\taskkill.exe' /IM avp.exe /F' (with hidden window)
- '<SYSTEM32>\taskkill.exe' /IM MsMpEng.exe /F' (with hidden window)
- '<SYSTEM32>\taskkill.exe' /IM avgsvc.exe /F' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c wbadmin delete catalog -quiet' (with hidden window)
- '<SYSTEM32>\taskkill.exe' /IM cmd.exe /F' (with hidden window)
- '<SYSTEM32>\taskkill.exe' /IM taskmgr.exe /F' (with hidden window)
- '<SYSTEM32>\taskkill.exe' /IM powershell.exe /F' (with hidden window)
- '<SYSTEM32>\taskkill.exe' /IM avguard.exe /F' (with hidden window)
- '<SYSTEM32>\taskkill.exe' /IM gp.exe /F' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c vssadmin delete shadows /all /quiet' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "%ProgramFiles(x86)%\Kaspersky Lab\Kaspersky Anti-Virus 2025\avp.com" disable' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "%ProgramFiles%\Bitdefender\Bitdefender 2025\bdnserv.exe" -disable' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command Set-MpPreference -DisableRealtimeMonitoring $true' (with hidden window)
- '<SYSTEM32>\taskkill.exe' /IM regedit.exe /F' (with hidden window)
- '<SYSTEM32>\wscript.exe' <SYSTEM32>\systemconfig.exe.vbs' (with hidden window)
- '<SYSTEM32>\taskkill.exe' /IM mcshield.exe /F' (with hidden window)
