Technical Information
To ensure autorun and distribution:
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\AIDA64Driver] 'ImagePath' = '%TEMP%\RarSFX0\kerneld.x32'
Modifies file system:
Creates the following files:
- %TEMP%\RarSFX0\Language\lang_aa.txt
- %TEMP%\RarSFX0\Language\lang_tw.txt
- %TEMP%\RarSFX0\Language\lang_ua.txt
- %TEMP%\RarSFX0\license.txt
- %TEMP%\RarSFX0\pkey.txt
- %TEMP%\RarSFX0\aida64.ini
- %TEMP%\RarSFX0\aida64.exe
- %TEMP%\RarSFX0\aida_bench32.dll
- %TEMP%\RarSFX0\aida_bench64.dll
- %TEMP%\RarSFX0\aida_diskbench.dll
- %TEMP%\RarSFX0\aida_helper64.dll
- %TEMP%\RarSFX0\aida_icons2k.dll
- %TEMP%\RarSFX0\aida_icons7.dll
- %TEMP%\RarSFX0\aida_iconsxp.dll
- %TEMP%\RarSFX0\aida_lglcd.dll
- %TEMP%\RarSFX0\aida_lglcd3.dll
- %TEMP%\RarSFX0\aida_mondiag.dll
- %TEMP%\RarSFX0\aida_uires.dll
- %TEMP%\RarSFX0\kerneld.x32
- %TEMP%\RarSFX0\aida64.web
- %TEMP%\RarSFX0\kerneld.w9x
- %TEMP%\RarSFX0\aida_vsb.vsb
- %TEMP%\RarSFX0\aida64.mem
- %TEMP%\RarSFX0\aida64.exe.manifest
- %TEMP%\RarSFX0\kerneld.ia64
- %TEMP%\RarSFX0\aida64en.ico
- %TEMP%\RarSFX0\aida64.dat
- %TEMP%\RarSFX0\aida_cpl.cpl
- %TEMP%\RarSFX0\ssleay32.dll
- %TEMP%\RarSFX0\libeay32.dll
- %TEMP%\RarSFX0\aida_zipdll.dll
- %TEMP%\RarSFX0\aida_update.dll
- %TEMP%\RarSFX0\kerneld.x64
- %TEMP%\RarSFX0\Language\lang_tr.txt
- %TEMP%\RarSFX0\Language\lang_srl.txt
- %TEMP%\RarSFX0\Language\lang_src.txt
- %TEMP%\RarSFX0\Language\lang_al.txt
- %TEMP%\RarSFX0\Language\lang_bg.txt
- %TEMP%\RarSFX0\Language\lang_br.txt
- %TEMP%\RarSFX0\Language\lang_bs.txt
- %TEMP%\RarSFX0\Language\lang_by.txt
- %TEMP%\RarSFX0\Language\lang_ca.txt
- %TEMP%\RarSFX0\Language\lang_cn.txt
- %TEMP%\RarSFX0\Language\lang_cz.txt
- %TEMP%\RarSFX0\Language\lang_de.txt
- %TEMP%\RarSFX0\Language\lang_dk.txt
- %TEMP%\RarSFX0\Language\lang_ee.txt
- %TEMP%\RarSFX0\Language\lang_es.txt
- %TEMP%\RarSFX0\Language\lang_fi.txt
- %TEMP%\RarSFX0\Language\lang_fr.txt
- %TEMP%\RarSFX0\Language\lang_hr.txt
- %TEMP%\RarSFX0\Language\lang_hu.txt
- %TEMP%\RarSFX0\Language\lang_id.txt
- %TEMP%\RarSFX0\Language\lang_si.txt
- %TEMP%\RarSFX0\Language\lang_se.txt
- %TEMP%\RarSFX0\Language\lang_ru.txt
- %TEMP%\RarSFX0\Language\lang_ro.txt
- %TEMP%\RarSFX0\Language\lang_pt.txt
- %TEMP%\RarSFX0\Language\lang_pl.txt
- %TEMP%\RarSFX0\Language\lang_nl.txt
- %TEMP%\RarSFX0\Language\lang_no.txt
- %TEMP%\RarSFX0\Language\lang_mk.txt
- %TEMP%\RarSFX0\Language\lang_lv.txt
- %TEMP%\RarSFX0\Language\lang_lt.txt
- %TEMP%\RarSFX0\Language\lang_kr.txt
- %TEMP%\RarSFX0\Language\lang_jp.txt
- %TEMP%\RarSFX0\Language\lang_it.txt
- %TEMP%\RarSFX0\Language\lang_sk.txt
- %TEMP%\RarSFX0\aida64.chm
Network activity:
Connects to:
- 'up####.aida64.com':80
TCP:
HTTP GET requests:
- http://up####.aida64.com/update/?pt#################################################################################################################
UDP:
- DNS ASK up####.aida64.com
Miscellaneous:
Searches for the following windows:
- ClassName: 'EDIT' WindowName: ''
Creates and executes the following:
- '%TEMP%\RarSFX0\aida64.exe'
