•Modifies the listed registry keys.

•Creates or modifies the listed files.

•Creates the listed services.

•Changes the listed executable system files.

•Replaces the listed executable system files.

•Infects the listed executable files.

•Creates the following files on removable media.

•Modifies master boot record (MBR).

•Bypasses firewall, removes, or modifies the listed registry keys.

•To complicate detection of its presence in the operating system:

▪Forces the system to hide from view:

▫hidden files;

▫file extensions.

▪Blocks execution of the listed system utilities:

▫Command Prompt (CMD);

▫Windows Task Manager (Taskmgr);

▫Registry Editor (RegEdit).

▫Windows Firewall.

▫System Updates (Windows Update).

▫Windows Security Center.

▫System Anti-virus (Windows Defender).

▪Blocks the following features:

▫System Restore (SR);

▫Windows File Protection (WFP);

▫User Account Control (UAC);

▫System File Checker (SFC);

▫Windows Security Center.

▫Windows Support Center (Action Center).

▪Changes the listed system preferences:

▫changes the DNS server,

▫disables taskbar notifications.

▪Removes shadow copies of volumes.

▪Adds anti-virus exceptions using the listed registry keys.

•Creates and executes the listed processes:

▫creates and executes files (an exploit);

▫creates and loads libraries (an exploit);

▫downloads and executes files.

•Executes the listed processes.

•Injects code into the listed processes:

▪listed system processes;

▪listed user processes;

▪a large number of user processes.

•Installs hooks to intercept notifications:

▪About keystrokes:

▫Handler for all processes;

▫Handler for the listed processes.

•Terminates or attempts to terminate:

▪listed system processes;

▪listed user processes;

▪a large number of user processes.

•Searches for registry branches where third-party applications store passwords.

•Executes WMI operations.

•Registers a file system filter driver.

•Searches for the listed windows to:

▪bypass different anti-viruses;

▪bypass the Windows File Protection system;

▪detect analytics tools;

▪detect applications and games;

▪detect virtual machines.

•Creates an onion service.

•Loads the listed drivers.

•Hooks the following functions in the System Service Descriptor Table (SSDT):

▪a handler.

•Restores hooked functions in the System Service Descriptor Table (SSDT).

•Brute forces passwords of OS accounts.

•Disables AMSI.

•Modifies the listed settings of Windows Explorer.

•Modifies the listed settings of Windows Internet Explorer.

•Hides the listed processes.

•Forces autorun for removable media.

•Sets a new unauthorized home page for Internet Explorer.

•Attempts to shut down Windows OS.

•Sends SMS.

•Executes the code of detectable threats.

•Downloads detectable threats from the internet.

•Sends contacts saved on the device to a remote server.

•Sends data on incoming SMS to a remote server.

•Overlays the interface preventing access to it.

•Sets a lock screen password.

•Prompts to install a third-party application.

•Hides its icon from screen.

•Ends incoming phone calls.

•Muffles incoming phone calls.

•Intercepts incoming SMS and terminates the process of their transmission to handlers of other apps.

•Deactivates a device administrator.

•Removes user data.

•Threat detection based on machine learning.

•Contains typical banking trojan/virus code.

•Contains typical locker code.

•Loads the listed detectable threats to be executed.

•Downloads the listed detectable threats from the internet.

•Creates the listed files.

•Appends the “hidden” attribute to the listed files.

•Deletes the listed files.

•Moves the listed system files.

•Replaces the listed files.

•Infects the listed executable files.

•Modifies the HOSTS file.

•Replaces the HOSTS file.

•Moves itself.

•Deletes itself.

•Creates files.

•Creates files and demands payment for file decoding (Trojan.Encoder).

•Changes a large amount of user data (Trojan.Encoder).

•Changes file extensions in user data (Trojan.Encoder).

•Sets permissions to execute files.

•Connects to a network resource.

•TCP:

▪HTTP GET requests;

▪HTTP POST requests;

▪HTTP HEAD requests;

▪HTTP PATCH requests;

▪HTTP PUT requests;

▪HTTP DELETE requests;

▪HTTP OPTIONS requests;

▪HTTP TRACE requests;

▪unknown HTTP requests.

•UDP.

▪DNS requests.

•Adds a root certificate.

•Disables certificate.

•Changes value of the AutoConfigURL parameter as follows.

•Searches for the listed windows.

•Creates and executes files.

•File protected with the Themida packer by Oreans Technologies.

•Uses NTFS alternate data streams.

•Loads the listed drivers.

•Executes shell scripts.

•Loads dynamic libraries.

•Makes phone calls.

•Uses data encryption algorithms.

•Uses data decryption algorithms.

•Uses elevated priveleges.

•Uses administrator rights.

•Accesses the ITelephony private interface.

•Uses libraries to hide executable bytecode.

•Can send SMS automatically.

•Accesses audio/video recording interfaces.

•Records audio/video.

•Accesses camera interface.

•Changes volume and vibration settings.

•Accesses location of the device.

•Accesses network information.

•Gets information about the device (phone number, IMEI, etc.).

•Gets information about APN settings.

•Gets information about active device administrators.

•Gets information about installed apps.

•Gets information about running apps.

•Gets information about accounts linked with the device.

•Adds tasks to the System Scheduler.

•Displays its windows over windows of other apps.

•Processes information from SMS.

•Gets information about incoming/outgoing phone calls.

•Gets information about sent/received SMS.

•Gets information about phone contacts.

•Enables/disables all cameras.

•Manages WiFi connectivity.

•Checks for anti-virus applications.

•Intercepts notifications.

•Requests permission to display system alert windows.

•Sample from Google Play Store.