Technical Information
To ensure autorun and distribution
Creates the following files on removable media
- <Drive name for removable media>:\how to restore your files.txt
- <Drive name for removable media>:\system volume information\how to restore your files.txt
- <Drive name for removable media>:\system volume information\wpsettings.dat.babyk
- <Drive name for removable media>:\gruenspecht_02172016.pptx
- <Drive name for removable media>:\waterresourcesag.pptx
- <Drive name for removable media>:\iso27k_isms_implementation_and_certification_process_overview_v2.pptx
- <Drive name for removable media>:\middaugh_keynote.pptx
- <Drive name for removable media>:\roozenedowebinar.pptx
Malicious functions
To complicate detection of its presence in the operating system,
deletes volume shadow copies.
Terminates or attempts to terminate
the following user processes:
- firefox.exe
Searches for windows to
detect analytical utilities:
- ClassName: 'OLLYDBG', WindowName: ''
- ClassName: 'GBDYLLO', WindowName: ''
- ClassName: 'pediy06', WindowName: ''
- ClassName: 'FilemonClass', WindowName: ''
- ClassName: '', WindowName: 'File Monitor - Sysinternals: www.sysinternals.com'
- ClassName: 'PROCMON_WINDOW_CLASS', WindowName: ''
- ClassName: '', WindowName: 'Process Monitor - Sysinternals: www.sysinternals.com'
- ClassName: 'RegmonClass', WindowName: ''
- ClassName: '', WindowName: 'Registry Monitor - Sysinternals: www.sysinternals.com'
Modifies file system
Creates the following files
- C:\how to restore your files.txt
- C:\users\public\music\how to restore your files.txt
- %HOMEPATH%\.oracle_jre_usage\how to restore your files.txt
- %HOMEPATH%\3d objects\how to restore your files.txt
- %HOMEPATH%\application data\how to restore your files.txt
- %HOMEPATH%\contacts\how to restore your files.txt
- %HOMEPATH%\cookies\how to restore your files.txt
- C:\users\public\desktop\how to restore your files.txt
- %HOMEPATH%\documents\how to restore your files.txt
- %HOMEPATH%\documents\my music\how to restore your files.txt
- %HOMEPATH%\desktop\how to restore your files.txt
- %HOMEPATH%\documents\my videos\how to restore your files.txt
- %HOMEPATH%\documents\my pictures\how to restore your files.txt
- %HOMEPATH%\favorites\how to restore your files.txt
- C:\users\default\downloads\how to restore your files.txt
- %HOMEPATH%\local settings\how to restore your files.txt
- %HOMEPATH%\nethood\how to restore your files.txt
- %HOMEPATH%\downloads\how to restore your files.txt
- %HOMEPATH%\onedrive\how to restore your files.txt
- %HOMEPATH%\favorites\links\how to restore your files.txt
- %HOMEPATH%\pictures\camera roll\how to restore your files.txt
- %HOMEPATH%\recent\how to restore your files.txt
- %HOMEPATH%\saved games\how to restore your files.txt
- %HOMEPATH%\printhood\how to restore your files.txt
- %HOMEPATH%\start menu\how to restore your files.txt
- %HOMEPATH%\templates\how to restore your files.txt
- %HOMEPATH%\searches\how to restore your files.txt
- %HOMEPATH%\sendto\how to restore your files.txt
- D:\how to restore your files.txt
- C:\users\public\libraries\how to restore your files.txt
- %HOMEPATH%\how to restore your files.txt
- C:\users\public\downloads\how to restore your files.txt
- C:\users\public\documents\how to restore your files.txt
- C:\users\public\documents\my videos\how to restore your files.txt
- <Current directory>\how to restore your files.txt
- C:\kms\how to restore your files.txt
- C:\msocache\how to restore your files.txt
- C:\perflogs\how to restore your files.txt
- C:\recovery\how to restore your files.txt
- C:\recovery\windowsre\how to restore your files.txt
- C:\users\default\how to restore your files.txt
- C:\users\default\cookies\how to restore your files.txt
- C:\users\default\application data\how to restore your files.txt
- C:\users\default\desktop\how to restore your files.txt
- C:\users\default\documents\how to restore your files.txt
- C:\users\default\documents\my music\how to restore your files.txt
- C:\users\default\documents\my pictures\how to restore your files.txt
- m:\how to restore your files.txt
- %HOMEPATH%\links\how to restore your files.txt
- C:\users\default\documents\my videos\how to restore your files.txt
- m:\system volume information\wpsettings.dat
- C:\users\default\links\how to restore your files.txt
- C:\users\default\local settings\how to restore your files.txt
- C:\users\default\nethood\how to restore your files.txt
- C:\users\default\printhood\how to restore your files.txt
- C:\users\default\recent\how to restore your files.txt
- C:\users\default\saved games\how to restore your files.txt
- C:\users\default\sendto\how to restore your files.txt
- C:\users\default\start menu\how to restore your files.txt
- C:\users\default\templates\how to restore your files.txt
- C:\users\public\how to restore your files.txt
- C:\users\public\accountpictures\how to restore your files.txt
- C:\users\public\documents\my pictures\how to restore your files.txt
- C:\documents and settings\how to restore your files.txt
- C:\users\default\favorites\how to restore your files.txt
- m:\bootnxt.babyk
Modifies the following files
- C:\kms\kms_vl_all_aio.cmd.babyk
- C:\users\public\desktop\firefox.lnk.babyk
- %HOMEPATH%\desktop\telegram.lnk.babyk
- %HOMEPATH%\desktop\microsoft edge.lnk.babyk
- C:\users\public\desktop\acrobat reader dc.lnk.babyk
- C:\users\public\desktop\mozilla thunderbird.lnk.babyk
- %HOMEPATH%\desktop\210252809.jpeg.babyk
- %HOMEPATH%\desktop\210252809.jpg.babyk
- %HOMEPATH%\desktop\168.jpeg.babyk
- C:\users\public\desktop\opera.lnk.babyk
- C:\users\public\desktop\steam.lnk.babyk
- C:\users\public\libraries\recordedtv.library-ms.babyk
- %HOMEPATH%\desktop\google chrome.lnk.babyk
- %HOMEPATH%\.oracle_jre_usage\90737d32e3aba6b.timestamp.babyk
- C:\users\default\ntuser.dat{fd9a35db-49fe-11e9-aa2c-248a07783950}.tmcontainer00000000000000000002.regtrans-ms.babyk
- C:\users\default\ntuser.dat{2d8c3f0b-3f9b-11ed-9ead-0800278e6e63}.tm.blf.babyk
- C:\users\default\ntuser.dat.log2.babyk
- C:\users\default\ntuser.dat{fd9a35db-49fe-11e9-aa2c-248a07783950}.tm.blf.babyk
- C:\users\default\ntuser.dat{fd9a35db-49fe-11e9-aa2c-248a07783950}.tmcontainer00000000000000000001.regtrans-ms.babyk
- C:\users\default\ntuser.dat{2d8c3f0b-3f9b-11ed-9ead-0800278e6e63}.tmcontainer00000000000000000002.regtrans-ms.babyk
- C:\users\default\ntuser.dat{2d8c3f0b-3f9b-11ed-9ead-0800278e6e63}.tmcontainer00000000000000000001.regtrans-ms.babyk
- C:\users\default\ntuser.dat.log1.babyk
- C:\recovery\windowsre\reagent.xml.babyk
- C:\recovery\windowsre\boot.sdi.babyk
- C:\kms\kms_vl_all_aio_debug.log.babyk
- C:\recovery\windowsre\winre.wim.babyk
- %HOMEPATH%\links\desktop.lnk.babyk
Modifies multiple files.
Changes user data files extensions (Trojan.Encoder).
Miscellaneous
Searches for the following windows
- ClassName: 'OleMainThreadWndClass' WindowName: ''
- ClassName: '18467-41' WindowName: ''
Creates and executes the following
- '<SYSTEM32>\cmd.exe' /c vssadmin.exe delete shadows /all /quiet' (with hidden window)
Executes the following
- '<SYSTEM32>\cmd.exe' /c vssadmin.exe delete shadows /all /quiet