Technical Information
Malicious functions:
To bypass firewall, removes or modifies the following registry keys:
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'DoNotAllowExceptions' = '00000000'
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'EnableFirewall' = '00000000'
Executes the following:
- '<SYSTEM32>\net1.exe' stop POP3TRAP
- '<SYSTEM32>\net.exe' stop PCCMAIN
- '<SYSTEM32>\net1.exe' stop PCCMAIN
- '<SYSTEM32>\net.exe' stop POP3TRAP
- '<SYSTEM32>\net1.exe' stop AVCONSOL
- '<SYSTEM32>\net.exe' stop WEBTRAP
- '<SYSTEM32>\net1.exe' stop WEBTRAP
- '<SYSTEM32>\net.exe' stop KIMLAB
- '<SYSTEM32>\net1.exe' stop KIMLAB
- '<SYSTEM32>\net.exe' stop MONSYSNT
- '<SYSTEM32>\net1.exe' stop AHNLAB
- '<SYSTEM32>\net.exe' stop PCCIOMON
- '<SYSTEM32>\net1.exe' stop PCCIOMON
- '<SYSTEM32>\net.exe' stop AHNLAB
- '<SYSTEM32>\net1.exe' stop NAVW32
- '<SYSTEM32>\net.exe' stop NAVAPW32
- '<SYSTEM32>\net1.exe' stop NAVAPW32
- '<SYSTEM32>\net.exe' stop NAVW32
- '<SYSTEM32>\net1.exe' stop LUALL
- '<SYSTEM32>\net.exe' stop NMAIN
- '<SYSTEM32>\net1.exe' stop NMAIN
- '<SYSTEM32>\net.exe' stop AVSYNMGR
- '<SYSTEM32>\net1.exe' stop AVSYNMGR
- '<SYSTEM32>\net.exe' stop AVCONSOL
- '<SYSTEM32>\net1.exe' stop VSHWIN32
- '<SYSTEM32>\net.exe' stop VSSTAT
- '<SYSTEM32>\net1.exe' stop VSSTAT
- '<SYSTEM32>\net.exe' stop VSHWIN32
- '<SYSTEM32>\net1.exe' stop MONSYSNT
- '<SYSTEM32>\net.exe' stop SpiderNT
- '<SYSTEM32>\net1.exe' stop SpiderNT
- '<SYSTEM32>\net1.exe' stop SpiderUI
- '<SYSTEM32>\net1.exe' stop scanner
- '<SYSTEM32>\net1.exe' stop scanner.exe
- '<SYSTEM32>\net.exe' stop scanner.exe
- '<SYSTEM32>\net.exe' stop scanner
- '<SYSTEM32>\net1.exe' stop Vcrmon
- '<SYSTEM32>\net.exe' stop Vcrmon
- '<SYSTEM32>\net1.exe' /pid=3440
- '<SYSTEM32>\net1.exe' stop spider
- '<SYSTEM32>\net.exe' stop SpiderUI
- '<SYSTEM32>\net1.exe' /pid=3376
- '<SYSTEM32>\net.exe' stop spider
- '<SYSTEM32>\net.exe' stop V3
- '<SYSTEM32>\net1.exe' stop V3
- '<SYSTEM32>\net1.exe' stop V3CFGU
- '<SYSTEM32>\net1.exe' stop V3PRO32
- '<SYSTEM32>\net.exe' stop MONSVCNT
- '<SYSTEM32>\net1.exe' stop MONSVCNT
- '<SYSTEM32>\net.exe' stop V3PRO32
- '<SYSTEM32>\net1.exe' stop knlscan
- '<SYSTEM32>\net.exe' stop knlscan
- '<SYSTEM32>\net1.exe' /pid=3172
- '<SYSTEM32>\net1.exe' /pid=3104
- '<SYSTEM32>\net.exe' stop V3CFGU
- '<SYSTEM32>\net1.exe' stop V3P3AT
- '<SYSTEM32>\net.exe' stop V3P3AT
- '<SYSTEM32>\net.exe' stop LUALL
- '<SYSTEM32>\net1.exe' stop MCAFEE
- '<SYSTEM32>\net.exe' stop NORTON
- '<SYSTEM32>\net1.exe' stop NORTON
- '<SYSTEM32>\net.exe' stop MCAFEE
- '<SYSTEM32>\net1.exe' stop WEBSCANX
- '<SYSTEM32>\net.exe' stop ANTIVIR
- '<SYSTEM32>\net1.exe' stop ANTIVIR
- '<SYSTEM32>\net.exe' stop IOMON98
- '<SYSTEM32>\net1.exe' stop IOMON98
- '<SYSTEM32>\net.exe' stop PCCWIN98
- '<SYSTEM32>\net1.exe' stop FP-WIN
- '<SYSTEM32>\net.exe' stop NVC95
- '<SYSTEM32>\net1.exe' stop NVC95
- '<SYSTEM32>\net.exe' stop FP-WIN
- '<SYSTEM32>\net1.exe' stop AVP.EXE
- '<SYSTEM32>\net.exe' stop CFINET32
- '<SYSTEM32>\net1.exe' stop CFINET32
- '<SYSTEM32>\net.exe' stop AVP.EXE
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\1.tmp\killav.bat" "
- '<SYSTEM32>\net.exe' stop MsMpSvc
- '<SYSTEM32>\net1.exe' stop MsMpSvc
- '<SYSTEM32>\net.exe' stop SAFEWEB
- '<SYSTEM32>\net1.exe' stop SAFEWEB
- '<SYSTEM32>\net.exe' stop WEBSCANX
- '<SYSTEM32>\net1.exe' stop ICMON
- '<SYSTEM32>\net.exe' stop CFINET
- '<SYSTEM32>\net1.exe' stop CFINET
- '<SYSTEM32>\net.exe' stop ICMON
- '<SYSTEM32>\net1.exe' stop PCCWIN98
- '<SYSTEM32>\net.exe' stop RESCUE32
- '<SYSTEM32>\net1.exe' stop RESCUE32
- '<SYSTEM32>\net.exe' stop NISSERV
- '<SYSTEM32>\net1.exe' stop SYMPROXYSVC
- '<SYSTEM32>\net.exe' stop NISUM
- '<SYSTEM32>\net1.exe' stop NISUM
- '<SYSTEM32>\net.exe' stop SYMPROXYSVC
- '<SYSTEM32>\net1.exe' stop IAMAPP
- '<SYSTEM32>\net.exe' stop LUCOMSERVER
- '<SYSTEM32>\net1.exe' stop LUCOMSERVER
- '<SYSTEM32>\net.exe' stop IAMAPP
- '<SYSTEM32>\net1.exe' stop NISSERV
- '<SYSTEM32>\net.exe' stop ATRACK
- '<SYSTEM32>\net1.exe' stop ATRACK
- '<SYSTEM32>\net.exe' stop PVIEW95
- '<SYSTEM32>\net1.exe' stop PVIEW95
- '<SYSTEM32>\net.exe' stop NAVWNT
- '<SYSTEM32>\net1.exe' stop F-STOPW
- '<SYSTEM32>\net.exe' stop F-PROT95
- '<SYSTEM32>\net1.exe' stop F-PROT95
- '<SYSTEM32>\net.exe' stop F-STOPW
- '<SYSTEM32>\net1.exe' stop NAVLU32
- '<SYSTEM32>\net.exe' stop NAVAPSVC
- '<SYSTEM32>\net1.exe' stop NAVAPSVC
- '<SYSTEM32>\net.exe' stop NAVLU32
- '<SYSTEM32>\net1.exe' stop NAVWNT
- '<SYSTEM32>\net.exe' stop NAVRUNR
- '<SYSTEM32>\net1.exe' stop NAVRUNR
Injects code into
the following system processes:
- <SYSTEM32>\net.exe
- <SYSTEM32>\net1.exe
Modifies file system :
Creates the following files:
- %TEMP%\1.tmp\killav.bat