Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'ShinoBOT' = '"%HOMEPATH%\ShinoBOT.exe"'
Sets the following service settings
- [<HKLM>\System\CurrentControlSet\Services\IKEEXT] 'Start' = '00000002'
Malicious functions
To complicate detection of its presence in the operating system,
blocks the following features:
- User Account Control (UAC)
Executes the following
- '%WINDIR%\syswow64\netsh.exe' firewall set opmode mode=disable
- '%WINDIR%\syswow64\net.exe' stop wuauserv
- '%WINDIR%\syswow64\net.exe' stop McShield
Modifies file system
Creates the following files
- %HOMEPATH%\shinobot.exe
Network activity
Connects to
- '54.##4.189.77':80
Miscellaneous
Creates and executes the following
- '%WINDIR%\syswow64\netsh.exe' firewall set opmode mode=disable' (with hidden window)
- '%WINDIR%\syswow64\net.exe' stop wuauserv' (with hidden window)
- '%WINDIR%\syswow64\net.exe' stop McShield' (with hidden window)
- '%WINDIR%\syswow64\reg.exe' add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\reg.exe' add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
- '%WINDIR%\syswow64\net1.exe' stop wuauserv
- '%WINDIR%\syswow64\net1.exe' stop McShield
