Technical Information
Malicious functions:
Searches for registry branches where third party applications store passwords:
- [<HKCU>\Software\Microsoft\Internet Account Manager\Accounts]
Modifies file system:
Creates the following files:
- %TEMP%\RarSFX0\App\Reg Organizer\WhatsNew-Russian.txt
- %TEMP%\RarSFX0\App\Reg Organizer\WhatsNew.txt
- %TEMP%\RarSFX0\App\Reg Organizer\Updater.exe
- %TEMP%\RarSFX0\App\Reg Organizer\updaterdll.dll
- %TEMP%\nsq2.tmp
- %TEMP%\nsg3.tmp\System.dll
- %TEMP%\RarSFX0\App\Reg Organizer\WinRTApps.dll
- %TEMP%\RarSFX0\RegOrganizerPortable.exe
- %TEMP%\RarSFX0\App\Reg Organizer\UndoingChangesCenterUnit.const
- %TEMP%\RarSFX0\App\Reg Organizer\Reg64Call.exe
- %TEMP%\RarSFX0\App\Reg Organizer\RegKeysV3to5.dll
- %TEMP%\RarSFX0\App\Reg Organizer\Readme-Russian.txt
- %TEMP%\RarSFX0\App\Reg Organizer\Readme.txt
- %TEMP%\RarSFX0\App\Reg Organizer\StartupCheckingHelper.exe
- %TEMP%\RarSFX0\App\Reg Organizer\tweaks.bkp.xml
- %TEMP%\RarSFX0\App\Reg Organizer\RegOrganizer.exe
- %TEMP%\RarSFX0\App\Reg Organizer\RegOrganizerAgent.exe
- %TEMP%\nsg3.tmp\UAC.dll
- <LS_APPDATA>\ChemTable Software\Reg Organizer\Tweaks.log
- %APPDATA%\ChemTable Software\Reg Organizer\Tweaks.xml
- %TEMP%\RarSFX0\App\Reg Organizer\regkey.ini
- <LS_APPDATA>\ChemTable Software\Shared\RenamedApps.xml
- %HOMEPATH%\Local Settings\<INETFILES>\Content.IE5\KHMHGZ4F\data[1].xml
- %TEMP%\RegOrganizerPortableTemp\cu4.xml
- %APPDATA%\ChemTable Software\Reg Organizer\IgnoreRegCleaner.xml
- %APPDATA%\ChemTable Software\Reg Organizer\IgnoreDiskCleaner2.xml
- %TEMP%\nsg3.tmp\runtimedata.ini
- %TEMP%\nsg3.tmp\splash.jpg
- %TEMP%\nsg3.tmp\newadvsplash.dll
- %TEMP%\nsg3.tmp\launcher.ini
- %TEMP%\RarSFX0\Data\settings\Reg Organizer.reg
- %TEMP%\RarSFX0\Data\settings\RegOrganizerPortableSettings.ini
- %TEMP%\RarSFX0\Data\PortableApps.comLauncherRuntimeData-RegOrganizerPortable.ini
- %TEMP%\~DF564.tmp
- %TEMP%\nsg3.tmp\registry.dll
- %TEMP%\RarSFX0\App\Reg Organizer\Documentation\French\Documentation.chm
- %TEMP%\RarSFX0\App\Reg Organizer\Documentation\Russian\Documentation.chm
- %TEMP%\RarSFX0\App\Reg Organizer\CloseApplication.dll
- %TEMP%\RarSFX0\App\Reg Organizer\Documentation\English\Documentation.chm
- %TEMP%\RarSFX0\App\Reg Organizer\IgnoreDiskCleaner.bkp.xml
- %TEMP%\RarSFX0\App\Reg Organizer\IgnoreRegCleaner.bkp.xml
- %TEMP%\RarSFX0\App\Reg Organizer\HardwareConstant.dll
- %TEMP%\RarSFX0\App\Reg Organizer\HelperFor64Bits.exe
- %TEMP%\RarSFX0\App\Reg Organizer\AppUninstIgnore.bkp.xml
- %TEMP%\RarSFX0\App\AppInfo\appicon_128.png
- %TEMP%\RarSFX0\App\AppInfo\appicon_16.png
- %TEMP%\RarSFX0\Read Me.url
- %TEMP%\RarSFX0\App\AppInfo\appicon.ico
- %TEMP%\RarSFX0\App\AppInfo\Launcher\RegOrganizerPortable.ini
- %TEMP%\RarSFX0\App\DefaultData\settings\Reg Organizer.reg
- %TEMP%\RarSFX0\App\AppInfo\appicon_32.png
- %TEMP%\RarSFX0\App\AppInfo\appinfo.ini
- %TEMP%\RarSFX0\App\Reg Organizer\InstallerTracingAgent.dll
- %TEMP%\RarSFX0\App\Reg Organizer\links.xml
- %TEMP%\RarSFX0\App\Reg Organizer\OptimizationAnimation.avi
- %TEMP%\RarSFX0\App\Reg Organizer\License-Russian.txt
- %TEMP%\RarSFX0\App\Reg Organizer\License.txt
- %TEMP%\RarSFX0\App\Reg Organizer\QuickRegEditorLaunch.dll
- %TEMP%\RarSFX0\App\Reg Organizer\Readme-French.txt
- %TEMP%\RarSFX0\App\Reg Organizer\ProgramDataStorage.const
- %TEMP%\RarSFX0\App\Reg Organizer\Progress.avi
- %TEMP%\RarSFX0\App\Reg Organizer\License-French.txt
- %TEMP%\RarSFX0\App\Reg Organizer\Languages\Korean-7.16.sib
- %TEMP%\RarSFX0\App\Reg Organizer\Languages\korean.sib
- %TEMP%\RarSFX0\App\Reg Organizer\Languages\French-7.16.sib
- %TEMP%\RarSFX0\App\Reg Organizer\Languages\French.sib
- %TEMP%\RarSFX0\App\Reg Organizer\Languages\Portuguese.sib
- %TEMP%\RarSFX0\App\Reg Organizer\Languages\Russian.sib
- %TEMP%\RarSFX0\App\Reg Organizer\Languages\Portuguese(pt-BR)-7.16[3].sib
- %TEMP%\RarSFX0\App\Reg Organizer\Languages\Portuguese(pt-PT)-7.16.sib
Deletes the following files:
- %TEMP%\RegOrganizerPortableTemp\cu4.xml
Network activity:
Connects to:
- 'ch###able.com':80
- 'localhost':1036
TCP:
HTTP GET requests:
- http://www.ch###able.com/checkupdate/RegOrganizer/data.xml?Va################ via ch###able.com
UDP:
- DNS ASK www.ch###able.com
Miscellaneous:
Searches for the following windows:
- ClassName: 'EDIT' WindowName: ''
Creates and executes the following:
- '%TEMP%\RarSFX0\App\Reg Organizer\RegOrganizer.exe'
- '%TEMP%\RarSFX0\RegOrganizerPortable.exe'
