Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- %HOMEPATH%\start menu\programs\startup\svchost.exe
Modifies file system
Creates the following files
- %TEMP%\rarsfx0\002.tmp
- %TEMP%\rarsfx0\7z.dll
- %TEMP%\rarsfx0\default.sfx
- %TEMP%\rarsfx0\rar.exe
- %TEMP%\rarsfx0\sfx.conf
- %TEMP%\rarsfx0\001.tmp
- %TEMP%\rarsfx0\009.tmp
- %TEMP%\rarsfx0\32.tmp
- %TEMP%\rarsfx0\012.tmp
- %TEMP%\rarsfx0\64.tmp
- %TEMP%\rarsfx0\015.tmp
- %TEMP%\rarsfx0\#\run.vbs
- %TEMP%\rarsfx0\7z.exe
- %TEMP%\rarsfx0\#\setup
- %TEMP%\rarsfx0\filters.exe
- %TEMP%\rarsfx0\filters.zip
- %TEMP%\rarsfx0\news.exe
- %TEMP%\rarsfx0\news.zip
- %TEMP%\rarsfx0\paint.exe
- %TEMP%\rarsfx0\paint.zip
- %TEMP%\rarsfx0\sample1.exe
- %TEMP%\rarsfx0\sample1.zip
- %TEMP%\rarsfx0\sample2.exe
- %TEMP%\rarsfx0\sample2.zip
- %TEMP%\rarsfx0\empty.exe
- %TEMP%\rarsfx0\empty.zip
- %TEMP%\rarsfx0\#\installer.bat
- %TEMP%\rarsfx0\#\016.tmp
- %TEMP%\rarsfx0\#\014.tmp
- %TEMP%\rarsfx0\004.tmp
- %TEMP%\rarsfx0\005.tmp
- %TEMP%\rarsfx0\006.tmp
- %TEMP%\rarsfx0\007.tmp
- %TEMP%\rarsfx0\008.tmp
- %TEMP%\rarsfx0\010.tmp
- %TEMP%\rarsfx0\011.tmp
- %TEMP%\rarsfx0\013.tmp
- %TEMP%\rarsfx0\014.tmp
- %TEMP%\rarsfx0\016.tmp
- %TEMP%\rarsfx0\installer.bat
- %TEMP%\rarsfx0\003.tmp
- %TEMP%\rarsfx0\run.vbs
- %TEMP%\rarsfx0\007.bat
- %TEMP%\rarsfx0\#\002.tmp
- %TEMP%\rarsfx0\#\003.tmp
- %TEMP%\rarsfx0\#\004.tmp
- %TEMP%\rarsfx0\#\005.tmp
- %TEMP%\rarsfx0\#\006.tmp
- %TEMP%\rarsfx0\#\007.tmp
- %TEMP%\rarsfx0\#\008.tmp
- %TEMP%\rarsfx0\#\010.tmp
- %TEMP%\rarsfx0\#\011.tmp
- %TEMP%\rarsfx0\#\013.tmp
- %TEMP%\rarsfx0\setup
- nul
- C:\appcache\x86\svchost.exe
Sets the 'hidden' attribute to the following files
- C:\appcache\x86\svchost.exe
Deletes the following files
- %TEMP%\rarsfx0\empty.exe
- %TEMP%\rarsfx0\filters.exe
- %TEMP%\rarsfx0\news.exe
- %TEMP%\rarsfx0\paint.exe
- %TEMP%\rarsfx0\sample1.exe
- %TEMP%\rarsfx0\sample2.exe
Moves the following files
- from %TEMP%\rarsfx0\empty.zip to %ProgramFiles%\movie maker\shared\empty.zip
- from %TEMP%\rarsfx0\filters.zip to %ProgramFiles%\movie maker\shared\filters.zip
- from %TEMP%\rarsfx0\news.zip to %ProgramFiles%\movie maker\shared\news.zip
- from %TEMP%\rarsfx0\paint.zip to %ProgramFiles%\movie maker\shared\paint.zip
- from %TEMP%\rarsfx0\sample1.zip to %ProgramFiles%\movie maker\shared\sample1.zip
- from %TEMP%\rarsfx0\sample2.zip to %ProgramFiles%\movie maker\shared\sample2.zip
Miscellaneous
Searches for the following windows
- ClassName: 'EDIT' WindowName: ''
Creates and executes the following
- '<SYSTEM32>\wscript.exe' "%TEMP%\RarSFX0\run.vbs"
- '%TEMP%\rarsfx0\rar.exe' a -r -sfx -m5 -ep1 -zsfx.conf "Empty".exe #\*
- '%TEMP%\rarsfx0\7z.exe' a -tzip -mx=0 "Empty".zip "Empty".exe
- '%TEMP%\rarsfx0\rar.exe' a -r -sfx -m5 -ep1 -zsfx.conf "Filters".exe #\*
- '%TEMP%\rarsfx0\7z.exe' a -tzip -mx=0 "Filters".zip "Filters".exe
- '%TEMP%\rarsfx0\rar.exe' a -r -sfx -m5 -ep1 -zsfx.conf "news".exe #\*
- '%TEMP%\rarsfx0\7z.exe' a -tzip -mx=0 "news".zip "news".exe
- '%TEMP%\rarsfx0\rar.exe' a -r -sfx -m5 -ep1 -zsfx.conf "paint".exe #\*
- '%TEMP%\rarsfx0\7z.exe' a -tzip -mx=0 "paint".zip "paint".exe
- '%TEMP%\rarsfx0\rar.exe' a -r -sfx -m5 -ep1 -zsfx.conf "Sample1".exe #\*
- '%TEMP%\rarsfx0\7z.exe' a -tzip -mx=0 "Sample1".zip "Sample1".exe
- '%TEMP%\rarsfx0\rar.exe' a -r -sfx -m5 -ep1 -zsfx.conf "Sample2".exe #\*
- '%TEMP%\rarsfx0\7z.exe' a -tzip -mx=0 "Sample2".zip "Sample2".exe
- '%HOMEPATH%\start menu\programs\startup\svchost.exe'
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\RarSFX0\installer.bat" "' (with hidden window)
Executes the following
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\RarSFX0\installer.bat" "
- '<SYSTEM32>\cmd.exe' /S /D /c" VER "
- '<SYSTEM32>\findstr.exe' /L "5."
- '<SYSTEM32>\attrib.exe' +s +h C:\AppCache\x86
- '<SYSTEM32>\attrib.exe' +s +h C:\AppCache
- '<SYSTEM32>\attrib.exe' +h "C:\AppCache\x86\svchost.exe"
