Technical Information
To ensure autorun and distribution:
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\OpenVPNService] 'ImagePath' = '"%ProgramFiles%\OpenVPN\bin\openvpnserv.exe"'
Modifies file system:
Creates the following files:
- %TEMP%\nsl2.tmp\ns5.tmp
- %TEMP%\nsl2.tmp\ns4.tmp
- %TEMP%\nsd7.tmp\UserInfo.dll
- %ProgramFiles%\TAP-Windows\bin\devcon.exe
- %TEMP%\nsd7.tmp\System.dll
- %ALLUSERSPROFILE%\Start Menu\Programs\OpenVPN\Utilities\Generate a static OpenVPN key.lnk
- %ProgramFiles%\OpenVPN\log\README.txt
- %ALLUSERSPROFILE%\Start Menu\Programs\OpenVPN\Shortcuts\OpenVPN Sample Configuration Files.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\OpenVPN\Shortcuts\OpenVPN configuration file directory.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\OpenVPN\Shortcuts\OpenVPN log file directory.lnk
- %ProgramFiles%\TAP-Windows\driver\OemWin2k.inf
- %ProgramFiles%\TAP-Windows\license.txt
- %ALLUSERSPROFILE%\Start Menu\Programs\TAP-Windows\Utilities\Delete ALL TAP virtual ethernet adapters.lnk
- %ProgramFiles%\TAP-Windows\icon.ico
- %TEMP%\nsd7.tmp\ns8.tmp
- %TEMP%\nsd7.tmp\nsExec.dll
- %ProgramFiles%\TAP-Windows\driver\tap0901.sys
- %ProgramFiles%\TAP-Windows\driver\tap0901.cat
- %ProgramFiles%\TAP-Windows\bin\addtap.bat
- %ALLUSERSPROFILE%\Start Menu\Programs\TAP-Windows\Utilities\Add a new TAP virtual ethernet adapter.lnk
- %ProgramFiles%\TAP-Windows\bin\deltapall.bat
- %TEMP%\RarSFX0\MD-Inform.rdp
- %TEMP%\RarSFX0\config\cacert.pem
- %TEMP%\nsl2.tmp\UserInfo.dll
- %TEMP%\nsl2.tmp\nsExec.dll
- %TEMP%\nsl2.tmp\System.dll
- %TEMP%\RarSFX0\openvpn_install.exe
- %TEMP%\RarSFX0\setup.bat
- %TEMP%\RarSFX0\config\MD-VPN-client.ovpn
- %TEMP%\RarSFX0\config\adm.pem
- %TEMP%\RarSFX0\config\A3DEFAEDAE597FC8.pem
- %TEMP%\nsl2.tmp\ns3.tmp
- %ProgramFiles%\OpenVPN\config\README.txt
- %ProgramFiles%\OpenVPN\bin\openvpnserv.exe
- %ProgramFiles%\OpenVPN\sample-config\sample.ovpn
- %ProgramFiles%\OpenVPN\sample-config\server.ovpn
- %ProgramFiles%\OpenVPN\sample-config\client.ovpn
- %ProgramFiles%\OpenVPN\doc\INSTALL-win32.txt
- %ProgramFiles%\OpenVPN\bin\openvpn.exe
- %ProgramFiles%\OpenVPN\doc\openvpn.8.html
- %ALLUSERSPROFILE%\Start Menu\Programs\OpenVPN\Documentation\OpenVPN Windows Notes.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\OpenVPN\Documentation\OpenVPN Manual Page.lnk
Deletes the following files:
- %TEMP%\nsl2.tmp\ns4.tmp
- %TEMP%\nsl2.tmp\ns3.tmp
Miscellaneous:
Searches for the following windows:
- ClassName: 'EDIT' WindowName: ''
Creates and executes the following:
- '%TEMP%\tap-windows.exe' /S /SELECT_UTILITIES=1
- '%TEMP%\nsl2.tmp\ns5.tmp' "%TEMP%\tap-windows.exe" /S /SELECT_UTILITIES=1
- '%ProgramFiles%\TAP-Windows\bin\devcon.exe' hwids tap0901
- '%TEMP%\nsd7.tmp\ns8.tmp' "%ProgramFiles%\TAP-Windows\bin\devcon.exe" hwids tap0901
- '%TEMP%\nsl2.tmp\ns3.tmp' "%ProgramFiles%\OpenVPN\bin\openvpnserv.exe" -remove
- '%TEMP%\RarSFX0\openvpn_install.exe' /S
- '%ProgramFiles%\OpenVPN\bin\openvpnserv.exe' -install
- '%TEMP%\nsl2.tmp\ns4.tmp' "%ProgramFiles%\OpenVPN\bin\openvpnserv.exe" -install
Executes the following:
- '<SYSTEM32>\reg.exe' Query "HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\OpenVPN" /V config_dir
- '<SYSTEM32>\cmd.exe' /c Reg Query "HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\OpenVPN" /V config_dir
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\RarSFX0\setup.bat" "
