live casino online

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

?bertragungsdetails

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

F¨¹gt die folgenden Prozesse hinzu:

• %System%\cmd.exe" /C DEL /F /Q %ProgramData%\{Random Hex}.tmp >> NUL

F¨¹gt die folgenden Mutexe hinzu, damit nur jeweils eine ihrer Kopien ausgef¨¹hrt wird:

• Global\{Generated Hash}

Prozessbeendigung

Beendet die folgenden Dienste, wenn sie auf dem betroffenen System gefunden werden:

• backup
• GxBlr
• GxCIMgr
• GxCVD
• GxFWD
• GxVss
• memtas
• mepocs
• msexchange
• oracle
• sophos
• sql
• svc$
• veeam
• vss

Beendet Prozesse oder Dienste, die einen oder mehrere dieser Zeichenfolgen enthalten, wenn sie im Speicher des betroffenen Systems ausgef¨¹hrt werden:

• agntsvc
• calc
• dbeng50
• dbsnmp
• encsvc
• excel
• firefox
• infopath
• isqlplussvc
• msaccess
• mspub
• mydesktopqos
• mydesktopservice
• ocautoupds
• ocomm
• ocssd
• onedrive
• onenote
• oracle
• outlook
• powerpnt
• sqbcoreservice
• sql
• steam
• synctime
• tbirdconfig
• thebat
• thunderbird
• visio
• winword
• wordpad
• wuauclt
• xfssvccon

Einschleusungsroutine

Schleust die folgenden Dateien ein:

• %ProgramData%\{Random Hex}.tmp ¡ú used to delete itself
  • It renames the malware's filename from A to Z sequentially before deleting it. Each letter is duplicated based on the length of the original filename

Andere Details

Es macht Folgendes:

• It deletes the following services if found running on the affected system:
  • sppsvc
  • WinDefend
  • wscsvc
  • vmvss
  • eventlog
• It bypasses user account control (UAC), by using the ICMLuaUtil COM interface under %System%\dllhost.exe
• It uses the Windows Restart Manager API to close processes or shut down Windows services that may be keeping a file open and preventing encryption.
• It duplicates the token of the following:
  • TrustedInstaller - Service is started if not yet running
• It clears Windows event log.
• It contains a list of username:password that it will use to log into domain controllers.
• It encrypts fixed, removable and network shares.
• It contains the following export functions which can be loaded using command line arguments:
  • del ¡ú function responsible for deleting itself.
  • gdel ¡ú function responsible for deleting group policy.
  • gmod ¡ú function responsible for updating group policy.
  • wdll ¡ú function responsible for installing the icon and changing the Desktop wallpaper.
  • gdll ¡ú function responsible for encrypting the infected system.
  • sdll ¡ú function responsible for restarting the system in safe mode.
  • pmod

(Hinweis: %System% ist der Windows Systemordner. Er lautet in der Regel C:\Windows\System unter Windows 98 und ME, C:\WINNT\System32 unter Windows NT und 2000 sowie C:\Windows\System32 unter Windows 2000(32-bit), XP, Server 2003(32-bit), Vista, 7, 8, 8.1, 2008(64-bit), 2012(64bit) and 10(64-bit).)