Technical Information
Malicious functions:
Executes the following:
- '<SYSTEM32>\net1.exe' stop SharedAccess
- '<SYSTEM32>\cmd.exe' /c c:\RECYCLER\svchost.bat
- '<SYSTEM32>\netsh.exe' firewallset opmode disable
- '<SYSTEM32>\net.exe' stop SharedAccess
Modifies file system:
Creates the following files:
- C:\RECYCLER\ntldr.sys
- C:\RECYCLER\ntldre.sys
- %ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\DSS\MachineKeys\boot.sys
- %ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\DSS\MachineKeys\SHORTCUT.DRV
- %ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\DSS\MachineKeys\SHORTCUT.SYS
- C:\RECYCLER\ntldrc.sys
- %ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\DSS\MachineKeys\SHORTCUT.EXE\SHORTCUT.DLL
- %ALLUSERSPROFILE%\Application Data\Microsoft\STOPRUN.SYS
- %ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\DSS\MachineKeys\SOFTWARE.SET
- C:\RECYCLER\svchost.bat
- %ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\DSS\MachineKeys\SYSTEM.SET
Deletes the following files:
- C:\RECYCLER\svchost.bat
- %ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\DSS\MachineKeys\SHORTCUT.SYS
- C:\RECYCLER\ntldre.sys
- C:\RECYCLER\ntldr.sys
- C:\RECYCLER\ntldrc.sys
