Technical Information
To ensure autorun and distribution:
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\Wintkooden] 'Start' = '00000002'
Malicious functions:
Creates and executes the following:
- '%WINDIR%\Panther\UnattendGC\sc.exe' delete wintkoolers
- '%WINDIR%\Panther\UnattendGC\sc.exe' stop wintkoolers
- '%WINDIR%\Panther\UnattendGC\sc.exe' delete Wintkooler
- '%WINDIR%\Panther\UnattendGC\sc.exe' stop wintkooer
- '%WINDIR%\Panther\UnattendGC\sc.exe' delete wintkoolen
- '%WINDIR%\Panther\UnattendGC\sc.exe' stop wintkoolen
- '%WINDIR%\Panther\UnattendGC\sc.exe' delete ReintSkooler
- '%WINDIR%\Panther\UnattendGC\sc.exe' stop ReintSkooler
- '%WINDIR%\Panther\UnattendGC\sc.exe' delete WintESkooler
- '%WINDIR%\Panther\UnattendGC\sc.exe' stop Wintkooler
- '%WINDIR%\Panther\UnattendGC\sc.exe' delete wintkood
- '%WINDIR%\Panther\UnattendGC\sc.exe' stop wintkood
- '%WINDIR%\Panther\UnattendGC\sc.exe' delete wintkooer
- '%WINDIR%\Panther\UnattendGC\sc.exe' config Wintkooden start= auto
- '%WINDIR%\Panther\UnattendGC\instsrv.exe' Wintkooden %WINDIR%\Panther\UnattendGC\csrss.exe
- '%WINDIR%\Panther\UnattendGC\instsrv.exe' Wintkooden remove
- '%WINDIR%\Panther\UnattendGC\csrss.exe'
- '%WINDIR%\Panther\UnattendGC\sc.exe' start Wintkooden
- '%WINDIR%\Panther\UnattendGC\sc.exe' description Wintkooden "Koold xport The Makefiles "
- '%WINDIR%\Panther\UnattendGC\sc.exe' stop wintkooders
- '%WINDIR%\Panther\UnattendGC\sc.exe' delete wintkool
- '%WINDIR%\Panther\UnattendGC\sc.exe' stop wintkool
- '%WINDIR%\Panther\UnattendGC\sc.exe' delete Wintkooder
- '%WINDIR%\Panther\UnattendGC\sc.exe' stop Wintkooder
- '%WINDIR%\Panther\UnattendGC\sc.exe' delete wintkooders
- '%WINDIR%\Panther\UnattendGC\sc.exe' stop PrintSpooler
- '%WINDIR%\Panther\UnattendGC\sc.exe' delete QRemebd
- '%WINDIR%\Panther\UnattendGC\sc.exe' stop QRemebd
- '%WINDIR%\Panther\UnattendGC\sc.exe' delete HEintSkooler
- '%WINDIR%\Panther\UnattendGC\sc.exe' stop HEintSkooler
- '%WINDIR%\Panther\UnattendGC\sc.exe' delete PrintSpooler
- '%WINDIR%\Panther\UnattendGC\sc.exe' stop themebc
- '%WINDIR%\Panther\UnattendGC\sc.exe' delete ExportMakefiles
- '%WINDIR%\Panther\UnattendGC\sc.exe' stop ExportMakefiles
- '%WINDIR%\Panther\UnattendGC\sc.exe' delete EintSkooler
- '%WINDIR%\Panther\UnattendGC\sc.exe' stop EintSkooler
- '%WINDIR%\Panther\UnattendGC\sc.exe' delete themebc
- '%WINDIR%\Panther\UnattendGC\sc.exe' stop SystemManager
- '%WINDIR%\Panther\UnattendGC\sc.exe' delete themeb
- '%WINDIR%\Panther\UnattendGC\sc.exe' stop themeb
- '%WINDIR%\Panther\UnattendGC\sc.exe' delete RintSkooler
- '%WINDIR%\Panther\UnattendGC\sc.exe' stop WintESkooler
- '%WINDIR%\Panther\UnattendGC\sc.exe' delete WintSkooler
- '%WINDIR%\Panther\UnattendGC\sc.exe' stop WintSkooler
- '%WINDIR%\Panther\UnattendGC\sc.exe' delete SysintemManager
- '%WINDIR%\Panther\UnattendGC\sc.exe' stop SysintemManager
- '%WINDIR%\Panther\UnattendGC\sc.exe' delete SystemManager
- '%WINDIR%\Panther\UnattendGC\sc.exe' stop RintSkooler
- '%WINDIR%\Panther\UnattendGC\sc.exe' delete ReConnectionManager
- '%WINDIR%\Panther\UnattendGC\sc.exe' stop ReConnectionManager
Executes the following:
- '<SYSTEM32>\net.exe' stop Wintkooden
- '<SYSTEM32>\net1.exe' stop Wintkooden
- '<SYSTEM32>\attrib.exe' +s +r +h sc.exe
- '<SYSTEM32>\attrib.exe' +s +r +h csrss.exe
- '<SYSTEM32>\attrib.exe' +s +r +h instsrv.exe
- '<SYSTEM32>\ping.exe' -n 2 127.1
- '<SYSTEM32>\cmd.exe' /c %WINDIR%\Panther\UnattendGC\xcc4.bat
- '%WINDIR%\regedit.exe' /s sh.reg
- '<SYSTEM32>\attrib.exe' +s +r +h %WINDIR%\Panther\UnattendGC\instsrv.exe
- '<SYSTEM32>\attrib.exe' +s +r +h %WINDIR%\Panther\UnattendGC\csrss.exe
- '<SYSTEM32>\taskkill.exe' /f /im minerd.exe
- '<SYSTEM32>\taskkill.exe' /f /im meciond.exe
- '<SYSTEM32>\taskkill.exe' /f /im smssz.exe
- '<SYSTEM32>\cmd.exe' /c ""%WINDIR%\Panther\UnattendGC\ys.bat" "
- '<SYSTEM32>\taskkill.exe' /f /im mecoind.exe
- '<SYSTEM32>\ping.exe' -n 3 127.1
- '<SYSTEM32>\attrib.exe' +s +r +h lsass.exe
- '<SYSTEM32>\taskkill.exe' /f /im jhPrimeminer.exe
- '<SYSTEM32>\taskkill.exe' /f /im smszs.exe
- '<SYSTEM32>\taskkill.exe' /f /im jhPrimemine.exe
Modifies file system :
Creates the following files:
- %WINDIR%\Panther\UnattendGC\sh.reg
- %WINDIR%\Panther\UnattendGC\xcc4.bat
- %WINDIR%\Panther\UnattendGC\ys.bat
- %WINDIR%\Panther\UnattendGC\sc.exe
- %WINDIR%\Panther\UnattendGC\csrss.exe
- %WINDIR%\Panther\UnattendGC\instsrv.exe
- %WINDIR%\Panther\UnattendGC\mecoind.exe
Sets the 'hidden' attribute to the following files:
- %WINDIR%\Panther\UnattendGC\sc.exe
- %WINDIR%\Panther\UnattendGC\instsrv.exe
- %WINDIR%\Panther\UnattendGC\csrss.exe
Deletes the following files:
- %WINDIR%\Panther\UnattendGC\sh.reg
Miscellaneous:
Searches for the following windows:
- ClassName: '(null)' WindowName: '(null)'
- ClassName: 'RegEdit_RegEdit' WindowName: '(null)'
- ClassName: 'EDIT' WindowName: '(null)'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
