Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKCU\Software\Classes\discord-1150373996290904174\shell\open\command] '' = '<Full path to file>'
Malicious functions
Executes the following
- '%WINDIR%\syswow64\taskkill.exe' /F /IM adb.exe
- '%WINDIR%\syswow64\taskkill.exe' /F /IM AndroidProcess.exe
- '%WINDIR%\syswow64\taskkill.exe' /F /im AndroidEmulator.exe
- '%WINDIR%\syswow64\taskkill.exe' /F /im AndroidEmulatorEn.exe
- '%WINDIR%\syswow64\taskkill.exe' /F /IM ProjectTitan.exe
- '%WINDIR%\syswow64\taskkill.exe' /F /im AndroidEmulatorEx.exe
- '%WINDIR%\syswow64\taskkill.exe' /F /im cmd.exe
- '%WINDIR%\syswow64\taskkill.exe' /F /im Gameloop.exe
Terminates or attempts to terminate
the following system processes:
- %WINDIR%\syswow64\cmd.exe
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: ''
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c mode con cols=80 lines=25
- '%WINDIR%\syswow64\cmd.exe' /c rundll32 user32.dll,MessageBeep
- '%WINDIR%\syswow64\cmd.exe' /c netsh advfirewall firewall delete rule name = port
- '%WINDIR%\syswow64\cmd.exe' /c netsh advfirewall firewall delete rule name = ip
- '%WINDIR%\syswow64\sc.exe' delete UniFairy_x64
- '%WINDIR%\syswow64\cmd.exe' /c sc delete aow_drv
- '%WINDIR%\syswow64\cmd.exe' /c sc delete AndroidKernel
- '%WINDIR%\syswow64\cmd.exe' /c sc stop driver
- '%WINDIR%\syswow64\cmd.exe' /c sc stop venbpx
- '%WINDIR%\syswow64\cmd.exe' /c net stop AndroidKernel
- '%WINDIR%\syswow64\cmd.exe' /c sc stop UniFairy_x64
- '%WINDIR%\syswow64\cmd.exe' /c sc delete driver
- '%WINDIR%\syswow64\cmd.exe' /c sc delete UniFairy_x64
- '%WINDIR%\syswow64\cmd.exe' /c rd /s /q "C:/ProgramData/Tencent"
- '%WINDIR%\syswow64\cmd.exe' /c rd /s /q "C:/Users/%USERNAME%/AppData/Local/Tencent"
- '%WINDIR%\syswow64\cmd.exe' /c rd /s /q "C:/Users/%USERNAME%/AppData/Roaming/Tencent"
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall delete rule name = port
- '%WINDIR%\syswow64\sc.exe' stop UniFairy_x64
- '%WINDIR%\syswow64\sc.exe' delete driver
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /F /IM ProjectTitan.exe
- '%WINDIR%\syswow64\cmd.exe' /c sc delete venbpx
- '%WINDIR%\syswow64\sc.exe' delete venbpx
- '%WINDIR%\syswow64\cmd.exe' /c cls
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /F /im cmd.exe
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /F /im Gameloop.exe
- '%WINDIR%\syswow64\cmd.exe' /c net stop aow_drv
- '%WINDIR%\syswow64\mode.com' con cols=80 lines=25
- '%WINDIR%\syswow64\cmd.exe' /c netsh advfirewall firewall delete rule name=ven
- '%WINDIR%\syswow64\cmd.exe' /c netsh advfirewall firewall delete rule name=ip
- '%WINDIR%\syswow64\cmd.exe' /c netsh advfirewall firewall delete rule name=island
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /F /IM AndroidProcess.exe
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /F /IM adb.exe
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall delete rule name=island
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /F /im AndroidEmulator.exe
- '%WINDIR%\syswow64\rundll32.exe' user32.dll,MessageBeep
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /F /im AndroidEmulatorEn.exe
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /F /im AndroidEmulatorEx.exe
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall delete rule name=ip
- '%WINDIR%\syswow64\cmd.exe' /c adb kill-server
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall delete rule name=ven
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /F /im Gameloop.exe' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c rundll32 user32.dll,MessageBeep' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c netsh advfirewall firewall delete rule name=ven' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /F /im cmd.exe' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c netsh advfirewall firewall delete rule name=ip' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c netsh advfirewall firewall delete rule name = port' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c netsh advfirewall firewall delete rule name=island' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c rd /s /q "C:/ProgramData/Tencent"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c net stop AndroidKernel' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /F /im AndroidEmulatorEn.exe' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c adb kill-server' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c rd /s /q "C:/Users/%USERNAME%/AppData/Roaming/Tencent"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c rd /s /q "C:/Users/%USERNAME%/AppData/Local/Tencent"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c sc stop venbpx' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c sc stop driver' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /F /im AndroidEmulator.exe' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c sc delete driver' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c sc delete aow_drv' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c sc delete AndroidKernel' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /F /IM ProjectTitan.exe' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c net stop aow_drv' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /F /IM AndroidProcess.exe' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c netsh advfirewall firewall delete rule name = ip' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c sc stop UniFairy_x64' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /F /IM adb.exe' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c sc delete UniFairy_x64' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c sc delete venbpx' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /F /im AndroidEmulatorEx.exe' (with hidden window)
