Trojan.KillFiles2.8742

Technical Information

To ensure autorun and distribution

Modifies master boot record (MBR).

Malicious functions

Launches a large number of processes

Modifies file system

Deletes the following system files

<SYSTEM32>\atl100.dll
<SYSTEM32>\atl110.dll
<SYSTEM32>\concrt140.dll
<SYSTEM32>\concrt140d.dll
<SYSTEM32>\defaultquestions.json
<SYSTEM32>\dll64.dll
<DRIVERS>\lsi_sas.sys
<DRIVERS>\rtnic64.sys
<SYSTEM32>\catroot2\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\catdb
<SYSTEM32>\catroot2\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\catdb.jfm
<SYSTEM32>\dssec.dat
<SYSTEM32>\fntcache.dat
<SYSTEM32>\license.rtf
<SYSTEM32>\LogFiles\WMI\Diagtrack-Listener.etl.006
<SYSTEM32>\LogFiles\WMI\LwtNetLog.etl
<SYSTEM32>\LogFiles\WMI\Microsoft-Windows-Rdp-Graphics-RdpIdd-Trace.etl
<SYSTEM32>\logfiles\wmi\netcore.etl
<SYSTEM32>\logfiles\wmi\ntfslog.etl
<SYSTEM32>\logfiles\wmi\radiomgr.etl
<SYSTEM32>\logfiles\wmi\wifi.etl
<SYSTEM32>\mfc100.dll
<SYSTEM32>\mfc100chs.dll
<SYSTEM32>\mfc100cht.dll
<SYSTEM32>\mfc100deu.dll
<SYSTEM32>\mfc100enu.dll
<SYSTEM32>\mfc100esn.dll
<SYSTEM32>\mfc100fra.dll
<SYSTEM32>\mfc100ita.dll
<SYSTEM32>\mfc100jpn.dll
<SYSTEM32>\mfc100kor.dll
<SYSTEM32>\mfc100rus.dll
<SYSTEM32>\mfc100u.dll
<SYSTEM32>\mfc110.dll
<SYSTEM32>\mfc110chs.dll
<SYSTEM32>\mfc110cht.dll
<SYSTEM32>\mfc110deu.dll
<SYSTEM32>\mfc110enu.dll
<SYSTEM32>\mfc110esn.dll
<SYSTEM32>\mfc110fra.dll
<SYSTEM32>\mfc110ita.dll
<SYSTEM32>\mfc110jpn.dll
<SYSTEM32>\mfc110kor.dll
<SYSTEM32>\mfc110rus.dll
<SYSTEM32>\mfc110u.dll
<SYSTEM32>\mfc120.dll
<SYSTEM32>\mfc120chs.dll
<SYSTEM32>\mfc120cht.dll
<SYSTEM32>\mfc120deu.dll
<SYSTEM32>\mfc120enu.dll
<SYSTEM32>\mfc120esn.dll
<SYSTEM32>\mfc120fra.dll
<SYSTEM32>\mfc120ita.dll
<SYSTEM32>\mfc120jpn.dll
<SYSTEM32>\mfc120kor.dll
<SYSTEM32>\mfc120rus.dll
<SYSTEM32>\mfc120u.dll
<SYSTEM32>\mfc140.dll
<SYSTEM32>\mfc140chs.dll
<SYSTEM32>\mfc140cht.dll
<SYSTEM32>\mfc140deu.dll
<SYSTEM32>\mfc140enu.dll
<SYSTEM32>\mfc140esn.dll
<SYSTEM32>\mfc140fra.dll
<SYSTEM32>\mfc140ita.dll
<SYSTEM32>\mfc140jpn.dll
<SYSTEM32>\mfc140kor.dll
<SYSTEM32>\mfc140rus.dll
<SYSTEM32>\mfc140u.dll
<SYSTEM32>\mfcm100.dll
<SYSTEM32>\mfcm100u.dll
<SYSTEM32>\mfcm110.dll
<SYSTEM32>\mfcm110u.dll
<SYSTEM32>\mfcm120.dll
<SYSTEM32>\mfcm120u.dll
<SYSTEM32>\mfcm140.dll
<SYSTEM32>\mfcm140u.dll
<SYSTEM32>\mmc.exe.config
<SYSTEM32>\msclmd.dll
<SYSTEM32>\msvcm90d.dll
<SYSTEM32>\msvcp100.dll
<SYSTEM32>\msvcp100d.dll
<SYSTEM32>\msvcp110.dll
<SYSTEM32>\msvcp110d.dll
<SYSTEM32>\msvcp120.dll
<SYSTEM32>\msvcp120d.dll
<SYSTEM32>\msvcp140.dll
<SYSTEM32>\msvcp140d.dll
<SYSTEM32>\msvcp140_1.dll
<SYSTEM32>\msvcp140_2.dll
<SYSTEM32>\msvcp140_atomic_wait.dll
<SYSTEM32>\msvcp140_codecvt_ids.dll
<SYSTEM32>\msvcp90d.dll
<SYSTEM32>\msvcr100.dll
<SYSTEM32>\msvcr100d.dll
<SYSTEM32>\msvcr110.dll
<SYSTEM32>\msvcr110d.dll
<SYSTEM32>\msvcr120.dll
<SYSTEM32>\msvcr120d.dll
<SYSTEM32>\msvcr90d.dll
<SYSTEM32>\noise.dat
<SYSTEM32>\oemdefaultassociations.dll
<SYSTEM32>\oemdefaultassociations.xml
<SYSTEM32>\perfc009.dat
<SYSTEM32>\perfd009.dat
<SYSTEM32>\perfh009.dat
<SYSTEM32>\perfi009.dat
<SYSTEM32>\perfstringbackup.ini
<SYSTEM32>\restore\MachineGuid.txt
<SYSTEM32>\spool\prtprocs\x64\winprint.dll
<SYSTEM32>\ucrtbased.dll
<SYSTEM32>\vcamp110.dll
<SYSTEM32>\vcamp120.dll
<SYSTEM32>\vcamp140.dll
<SYSTEM32>\vccorlib110.dll
<SYSTEM32>\vccorlib110d.dll
<SYSTEM32>\vccorlib120.dll
<SYSTEM32>\vccorlib120d.dll
<SYSTEM32>\vccorlib140.dll
<SYSTEM32>\vccorlib140d.dll
<SYSTEM32>\vcomp100.dll
<SYSTEM32>\vcomp110.dll
<SYSTEM32>\vcomp120.dll
<SYSTEM32>\vcomp140.dll
<SYSTEM32>\vcruntime140.dll
<SYSTEM32>\vcruntime140d.dll
<SYSTEM32>\vcruntime140_1.dll

Deletes following files that it created itself

<SYSTEM32>\catroot2\edb.log
<SYSTEM32>\catroot2\edb.chk

Moves the following files

from <SYSTEM32>\catroot2\edbtmp.log to <SYSTEM32>\catroot2\edb.log

Substitutes the following files

<SYSTEM32>\catroot2\edb.log

Miscellaneous

Executes the following

'<SYSTEM32>\cmd.exe' /c rd /s /q "<SYSTEM32>\0409"
'<SYSTEM32>\cmd.exe' /c rd /s /q "<SYSTEM32>\AdvancedInstallers"
'<SYSTEM32>\cmd.exe' /c rd /s /q "<SYSTEM32>\am-et"
'<SYSTEM32>\cmd.exe' /c rd /s /q "<SYSTEM32>\AppLocker"
'<SYSTEM32>\cmd.exe' /c rd /s /q "<SYSTEM32>\appraiser"
'<SYSTEM32>\cmd.exe' /c rd /s /q "<SYSTEM32>\AppV"
'<SYSTEM32>\cmd.exe' /c rd /s /q "<SYSTEM32>\ar-SA"
'<SYSTEM32>\cmd.exe' /c rd /s /q "<SYSTEM32>\bg-BG"
'<SYSTEM32>\cmd.exe' /c rd /s /q "<SYSTEM32>\Boot"
'<SYSTEM32>\cmd.exe' /c rd /s /q "<SYSTEM32>\Bthprops"
'<SYSTEM32>\cmd.exe' /c rd /s /q "<SYSTEM32>\CatRoot"
'<SYSTEM32>\cmd.exe' /c rd /s /q "<SYSTEM32>\catroot2"
'<SYSTEM32>\cmd.exe' /c rd /s /q "<SYSTEM32>\CodeIntegrity"
'<SYSTEM32>\cmd.exe' /c rd /s /q "<SYSTEM32>\Com"
'<SYSTEM32>\cmd.exe' /c rd /s /q "<SYSTEM32>\config"
'<SYSTEM32>\cmd.exe' /c rd /s /q "<SYSTEM32>\Configuration"
'<SYSTEM32>\cmd.exe' /c rd /s /q "<SYSTEM32>\ContainerSettingsProviders"
'<SYSTEM32>\cmd.exe' /c rd /s /q "<SYSTEM32>\cs-CZ"
'<SYSTEM32>\cmd.exe' /c rd /s /q "<SYSTEM32>\da-DK"
'<SYSTEM32>\cmd.exe' /c rd /s /q "<SYSTEM32>\DDFs"
'<SYSTEM32>\cmd.exe' /c rd /s /q "<SYSTEM32>\de-DE"
'<SYSTEM32>\cmd.exe' /c rd /s /q "<SYSTEM32>\DiagSvcs"
'<SYSTEM32>\cmd.exe' /c rd /s /q "<SYSTEM32>\Dism"
'<SYSTEM32>\cmd.exe' /c rd /s /q "<SYSTEM32>\downlevel"
'<SYSTEM32>\cmd.exe' /c rd /s /q "<DRIVERS>"
'<SYSTEM32>\cmd.exe' /c rd /s /q "<DRIVERS>tate"
'<SYSTEM32>\cmd.exe' /c rd /s /q "<DRIVERSTORE>"
'<SYSTEM32>\cmd.exe' /c rd /s /q "<SYSTEM32>\dsc"
'<SYSTEM32>\cmd.exe' /c rd /s /q "<SYSTEM32>\el-GR"
'<SYSTEM32>\cmd.exe' /c rd /s /q "<SYSTEM32>\en"
'<SYSTEM32>\cmd.exe' /c rd /s /q "<SYSTEM32>\en-GB"
'<SYSTEM32>\cmd.exe' /c rd /s /q "<SYSTEM32>\en-US"
'<SYSTEM32>\cmd.exe' /c rd /s /q "<SYSTEM32>\es-ES"
'<SYSTEM32>\cmd.exe' /c rd /s /q "<SYSTEM32>\es-MX"
'<SYSTEM32>\cmd.exe' /c rd /s /q "<SYSTEM32>\et-EE"
'<SYSTEM32>\cmd.exe' /c rd /s /q "<SYSTEM32>\F12"
'<SYSTEM32>\cmd.exe' /c rd /s /q "<SYSTEM32>\ff-Adlm-SN"
'<SYSTEM32>\cmd.exe' /c rd /s /q "<SYSTEM32>\fi-FI"
'<SYSTEM32>\cmd.exe' /c rd /s /q "<SYSTEM32>\fr-CA"
'<SYSTEM32>\cmd.exe' /c rd /s /q "<SYSTEM32>\fr-FR"
'<SYSTEM32>\cmd.exe' /c rd /s /q "<SYSTEM32>\FxsTmp"
'<SYSTEM32>\cmd.exe' /c rd /s /q "<SYSTEM32>\GroupPolicy"
'<SYSTEM32>\cmd.exe' /c rd /s /q "<SYSTEM32>\GroupPolicyUsers"
'<SYSTEM32>\cmd.exe' /c rd /s /q "<SYSTEM32>\he-IL"
'<SYSTEM32>\cmd.exe' /c rd /s /q "<SYSTEM32>\hr-HR"
'<SYSTEM32>\cmd.exe' /c rd /s /q "<SYSTEM32>\hu-HU"
'<SYSTEM32>\cmd.exe' /c rd /s /q "<SYSTEM32>\Hydrogen"
'<SYSTEM32>\cmd.exe' /c rd /s /q "<SYSTEM32>\ias"
'<SYSTEM32>\cmd.exe' /c rd /s /q "<SYSTEM32>\icsxml"
'<SYSTEM32>\cmd.exe' /c rd /s /q "<SYSTEM32>\IME"
'<SYSTEM32>\cmd.exe' /c rd /s /q "<SYSTEM32>\inetsrv"
'<SYSTEM32>\cmd.exe' /c rd /s /q "<SYSTEM32>\InputMethod"
'<SYSTEM32>\cmd.exe' /c rd /s /q "<SYSTEM32>\Ipmi"
'<SYSTEM32>\cmd.exe' /c rd /s /q "<SYSTEM32>\it-IT"
'<SYSTEM32>\cmd.exe' /c rd /s /q "<SYSTEM32>\ja-jp"
'<SYSTEM32>\cmd.exe' /c rd /s /q "<SYSTEM32>\Keywords"
'<SYSTEM32>\cmd.exe' /c rd /s /q "<SYSTEM32>\ko-KR"
'<SYSTEM32>\cmd.exe' /c rd /s /q "<SYSTEM32>\Licenses"
'<SYSTEM32>\cmd.exe' /c rd /s /q "<SYSTEM32>\LogFiles"
'<SYSTEM32>\cmd.exe' /c rd /s /q "<SYSTEM32>\lt-LT"
'<SYSTEM32>\cmd.exe' /c rd /s /q "<SYSTEM32>\lv-LV"
'<SYSTEM32>\cmd.exe' /c rd /s /q "<SYSTEM32>\MailContactsCalendarSync"
'<SYSTEM32>\cmd.exe' /c rd /s /q "<SYSTEM32>\Microsoft"
'<SYSTEM32>\cmd.exe' /c rd /s /q "<SYSTEM32>\migration"
'<SYSTEM32>\cmd.exe' /c rd /s /q "<SYSTEM32>\migwiz"
'<SYSTEM32>\cmd.exe' /c rd /s /q "<SYSTEM32>\MSDRM"
'<SYSTEM32>\cmd.exe' /c rd /s /q "<SYSTEM32>\MsDtc"
'<SYSTEM32>\cmd.exe' /c rd /s /q "<SYSTEM32>\MUI"
'<SYSTEM32>\cmd.exe' /c rd /s /q "<SYSTEM32>\my-mm"
'<SYSTEM32>\cmd.exe' /c rd /s /q "<SYSTEM32>\nb-NO"
'<SYSTEM32>\cmd.exe' /c rd /s /q "<SYSTEM32>\NDF"
'<SYSTEM32>\cmd.exe' /c rd /s /q "<SYSTEM32>\networklist"
'<SYSTEM32>\cmd.exe' /c rd /s /q "<SYSTEM32>\nl-NL"
'<SYSTEM32>\cmd.exe' /c rd /s /q "<SYSTEM32>\Nui"
'<SYSTEM32>\cmd.exe' /c rd /s /q "<SYSTEM32>\oobe"
'<SYSTEM32>\cmd.exe' /c rd /s /q "<SYSTEM32>\OpenSSH"
'<SYSTEM32>\cmd.exe' /c rd /s /q "<SYSTEM32>\osa-Osge-001"
'<SYSTEM32>\cmd.exe' /c rd /s /q "<SYSTEM32>\PerceptionSimulation"
'<SYSTEM32>\cmd.exe' /c rd /s /q "<SYSTEM32>\pl-PL"
'<SYSTEM32>\cmd.exe' /c rd /s /q "<SYSTEM32>\PointOfService"
'<SYSTEM32>\cmd.exe' /c rd /s /q "<SYSTEM32>\Printing_Admin_Scripts"
'<SYSTEM32>\cmd.exe' /c rd /s /q "<SYSTEM32>\ProximityToast"
'<SYSTEM32>\cmd.exe' /c rd /s /q "<SYSTEM32>\pt-BR"
'<SYSTEM32>\cmd.exe' /c rd /s /q "<SYSTEM32>\pt-PT"
'<SYSTEM32>\cmd.exe' /c rd /s /q "<SYSTEM32>\ras"
'<SYSTEM32>\cmd.exe' /c rd /s /q "<SYSTEM32>\RasToast"
'<SYSTEM32>\cmd.exe' /c rd /s /q "<SYSTEM32>\Recovery"
'<SYSTEM32>\cmd.exe' /c rd /s /q "<SYSTEM32>\restore"
'<SYSTEM32>\cmd.exe' /c rd /s /q "<SYSTEM32>\ro-RO"
'<SYSTEM32>\cmd.exe' /c rd /s /q "<SYSTEM32>\ru-RU"
'<SYSTEM32>\cmd.exe' /c rd /s /q "<SYSTEM32>\SecureBootUpdates"
'<SYSTEM32>\cmd.exe' /c rd /s /q "<SYSTEM32>\setup"
'<SYSTEM32>\cmd.exe' /c rd /s /q "<SYSTEM32>\Sgrm"
'<SYSTEM32>\cmd.exe' /c rd /s /q "<SYSTEM32>\ShellExperiences"
'<SYSTEM32>\cmd.exe' /c rd /s /q "<SYSTEM32>\si-lk"
'<SYSTEM32>\cmd.exe' /c rd /s /q "<SYSTEM32>\sk-SK"
'<SYSTEM32>\cmd.exe' /c rd /s /q "<SYSTEM32>\sl-SI"
'<SYSTEM32>\cmd.exe' /c rd /s /q "<SYSTEM32>\SleepStudy"
'<SYSTEM32>\cmd.exe' /c rd /s /q "<SYSTEM32>\slmgr"
'<SYSTEM32>\cmd.exe' /c rd /s /q "<SYSTEM32>\SMI"
'<SYSTEM32>\cmd.exe' /c rd /s /q "<SYSTEM32>\Speech"
'<SYSTEM32>\cmd.exe' /c rd /s /q "<SYSTEM32>\Speech_OneCore"
'<SYSTEM32>\cmd.exe' /c rd /s /q "<SYSTEM32>\spool"
'<SYSTEM32>\cmd.exe' /c rd /s /q "<SYSTEM32>\spp"
'<SYSTEM32>\cmd.exe' /c rd /s /q "<SYSTEM32>\sppui"
'<SYSTEM32>\cmd.exe' /c rd /s /q "<SYSTEM32>\sr-Latn-RS"
'<SYSTEM32>\cmd.exe' /c rd /s /q "<SYSTEM32>\sru"
'<SYSTEM32>\cmd.exe' /c rd /s /q "<SYSTEM32>\sv-SE"
'<SYSTEM32>\cmd.exe' /c rd /s /q "<SYSTEM32>\Sysprep"
'<SYSTEM32>\cmd.exe' /c rd /s /q "<SYSTEM32>\SystemResetPlatform"
'<SYSTEM32>\cmd.exe' /c rd /s /q "<SYSTEM32>\ta-in"
'<SYSTEM32>\cmd.exe' /c rd /s /q "<SYSTEM32>\ta-lk"
'<SYSTEM32>\cmd.exe' /c rd /s /q "<SYSTEM32>\Tasks"
'<SYSTEM32>\cmd.exe' /c rd /s /q "<SYSTEM32>\th-TH"
'<SYSTEM32>\cmd.exe' /c rd /s /q "<SYSTEM32>\ti-et"
'<SYSTEM32>\cmd.exe' /c rd /s /q "<SYSTEM32>\tr-TR"
'<SYSTEM32>\cmd.exe' /c rd /s /q "<SYSTEM32>\uk-UA"
'<SYSTEM32>\cmd.exe' /c rd /s /q "<SYSTEM32>\UNP"
'<SYSTEM32>\cmd.exe' /c rd /s /q "<SYSTEM32>\wbem"

TECHNOLOGIES

TERMINOLOGIE

COURS ET EDU

MYTHES

Technical Information

Recommandations pour le traitement

Free trial