Technical Information
Malicious functions
Patches code
in NTDLL dll
- qgqbsfp.exe process, ntdll.dll module
- vwangf5athfakxpke.exe process, ntdll.dll module
Searches for windows to
detect analytical utilities:
- ClassName: 'RegmonClass', WindowName: ''
- ClassName: 'FilemonClass', WindowName: ''
- ClassName: '', WindowName: 'File Monitor - Sysinternals: www.sysinternals.com'
- ClassName: 'PROCMON_WINDOW_CLASS', WindowName: ''
- ClassName: '', WindowName: 'Process Monitor - Sysinternals: www.sysinternals.com'
Modifies file system
Creates the following files
- <Current directory>\vwangf5athfakxpke.exe
- \device\harddiskvolume1\boot\bcd.log
- \device\harddiskvolume1\boot\bcd
Deletes itself.
Miscellaneous
Searches for the following windows
- ClassName: 'Registry Monitor - Sysinternals: www.sysinternals.com' WindowName: ''
- ClassName: '18467-41' WindowName: ''
Creates and executes the following
- '<Current directory>\vwangf5athfakxpke.exe' "<Full path to file>"
Executes the following
- '<SYSTEM32>\shutdown.exe' /r /t 15 /f /c "System configuration has been updated. Your computer will restart automatically in 15 seconds to apply these changes. Please save any unsaved work immediately."
Attempts to shut down the Windows operating system.
