Technical Information
To ensure autorun and distribution
Creates the following files on removable media
- <Drive name for removable media>:\revengerat\svсѓhost.exe
- <Drive name for removable media>:\correct.avi
Modifies file system
Creates the following files
- C:\revengerat\svсѓhost.exe
- %TEMP%\yupxsbiy.out
- %TEMP%\vbc5e3f.tmp
- %TEMP%\res5e40.tmp
- %ProgramFiles%.exe
- %TEMP%\9rvrkreb.0.vb
- %TEMP%\9rvrkreb.cmdline
- %TEMP%\9rvrkreb.out
- %TEMP%\vbc615c.tmp
- %TEMP%\res615d.tmp
- C:\recovery.exe
- %TEMP%\wkosr_de.0.vb
- %TEMP%\wkosr_de.cmdline
- %TEMP%\wkosr_de.out
- %TEMP%\vbc6459.tmp
- %TEMP%\res645a.tmp
- C:\totalcmd.exe
- D:\revengerat\svсѓhost.exe
- %PROGRAMDATA%\revengerat\install.ico
- %TEMP%\hhva8otj.0.vb
- %TEMP%\hhva8otj.cmdline
- %TEMP%\hhva8otj.out
- %TEMP%\vbc6a54.tmp
- %TEMP%\res6a55.tmp
- D:\install.log.exe
- %TEMP%\jz4zurks.0.vb
- %TEMP%\jz4zurks.cmdline
- %TEMP%\jz4zurks.out
- %TEMP%\vbc6dfe.tmp
- %TEMP%\res6dff.tmp
- %TEMP%\yupxsbiy.cmdline
- %APPDATA%\svсѓhost.exe
- %TEMP%\yupxsbiy.0.vb
- %TEMP%\res5b32.tmp
- %PROGRAMDATA%\revengerat\iqbexibpt.ico
- %TEMP%\wpietsvo.0.vb
- %TEMP%\wpietsvo.cmdline
- %TEMP%\wpietsvo.out
- %TEMP%\vbc4e51.tmp
- %TEMP%\res4e61.tmp
- C:\$recycle.bin.exe
- %TEMP%\p9a2huiw.0.vb
- %TEMP%\p9a2huiw.cmdline
- %TEMP%\p9a2huiw.out
- %TEMP%\vbc51bc.tmp
- %TEMP%\res51bd.tmp
- C:\documents and settings.exe
- %TEMP%\undjhzcm.0.vb
- %TEMP%\undjhzcm.cmdline
- %TEMP%\undjhzcm.out
- %TEMP%\vbc54d8.tmp
- %TEMP%\res54d9.tmp
- C:\far2.exe
- %TEMP%\ql6l5hac.0.vb
- %TEMP%\ql6l5hac.cmdline
- %TEMP%\ql6l5hac.out
- %TEMP%\vbc5815.tmp
- %TEMP%\res5825.tmp
- C:\msocache.exe
- %TEMP%\nuzjx8wa.0.vb
- %TEMP%\nuzjx8wa.cmdline
- %TEMP%\nuzjx8wa.out
- %TEMP%\vbc5b31.tmp
- C:\perflogs.exe
- D:\$recycle.bin.exe
Sets the 'hidden' attribute to the following files
- C:\revengerat\svсѓhost.exe
- D:\revengerat\svсѓhost.exe
- <Drive name for removable media>:\revengerat\svсѓhost.exe
Deletes the following files
- %TEMP%\res4e61.tmp
- %TEMP%\yupxsbiy.0.vb
- %TEMP%\yupxsbiy.cmdline
- %TEMP%\res615d.tmp
- %TEMP%\vbc615c.tmp
- %TEMP%\9rvrkreb.cmdline
- %TEMP%\9rvrkreb.0.vb
- %TEMP%\9rvrkreb.out
- %TEMP%\res645a.tmp
- %TEMP%\vbc6459.tmp
- %TEMP%\undjhzcm.out
- %TEMP%\wkosr_de.cmdline
- %TEMP%\wkosr_de.0.vb
- %TEMP%\res6a55.tmp
- %TEMP%\vbc6a54.tmp
- %TEMP%\hhva8otj.0.vb
- %TEMP%\hhva8otj.cmdline
- %TEMP%\hhva8otj.out
- %TEMP%\res6dff.tmp
- %TEMP%\vbc6dfe.tmp
- %TEMP%\jz4zurks.out
- %TEMP%\vbc5e3f.tmp
- %TEMP%\yupxsbiy.out
- %TEMP%\res5e40.tmp
- %TEMP%\nuzjx8wa.0.vb
- %TEMP%\nuzjx8wa.out
- %TEMP%\wpietsvo.0.vb
- %TEMP%\wpietsvo.cmdline
- %TEMP%\wpietsvo.out
- %TEMP%\res51bd.tmp
- %TEMP%\vbc51bc.tmp
- %TEMP%\p9a2huiw.out
- %TEMP%\p9a2huiw.cmdline
- %TEMP%\p9a2huiw.0.vb
- %TEMP%\res54d9.tmp
- %TEMP%\jz4zurks.0.vb
- %TEMP%\wkosr_de.out
- %TEMP%\vbc54d8.tmp
- %TEMP%\undjhzcm.cmdline
- %TEMP%\res5825.tmp
- %TEMP%\vbc5815.tmp
- %TEMP%\ql6l5hac.0.vb
- %TEMP%\ql6l5hac.out
- %TEMP%\ql6l5hac.cmdline
- %TEMP%\res5b32.tmp
- %TEMP%\vbc5b31.tmp
- %TEMP%\nuzjx8wa.cmdline
- %TEMP%\vbc4e51.tmp
- %TEMP%\undjhzcm.0.vb
- %TEMP%\jz4zurks.cmdline
Network activity
Connects to
- '62.#3.2.50':5555
TCP
- '62.#3.2.50':5555
Miscellaneous
Creates and executes the following
- '%APPDATA%\svсѓhost.exe'
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\jz4zurks.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES6A55.tmp" "%TEMP%\vbc6A54.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\hhva8otj.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES645A.tmp" "%TEMP%\vbc6459.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\wkosr_de.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES615D.tmp" "%TEMP%\vbc615C.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\9rvrkreb.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES5E40.tmp" "%TEMP%\vbc5E3F.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES6DFF.tmp" "%TEMP%\vbc6DFE.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\yupxsbiy.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\nuzjx8wa.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES5825.tmp" "%TEMP%\vbc5815.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\ql6l5hac.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES54D9.tmp" "%TEMP%\vbc54D8.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\undjhzcm.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES51BD.tmp" "%TEMP%\vbc51BC.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\p9a2huiw.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES4E61.tmp" "%TEMP%\vbc4E51.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES5B32.tmp" "%TEMP%\vbc5B31.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\wpietsvo.cmdline"' (with hidden window)
Executes the following
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\wpietsvo.cmdline"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES6A55.tmp" "%TEMP%\vbc6A54.tmp"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\hhva8otj.cmdline"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES645A.tmp" "%TEMP%\vbc6459.tmp"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\wkosr_de.cmdline"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES615D.tmp" "%TEMP%\vbc615C.tmp"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\9rvrkreb.cmdline"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES5E40.tmp" "%TEMP%\vbc5E3F.tmp"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\yupxsbiy.cmdline"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES5B32.tmp" "%TEMP%\vbc5B31.tmp"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\nuzjx8wa.cmdline"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES5825.tmp" "%TEMP%\vbc5815.tmp"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\ql6l5hac.cmdline"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES54D9.tmp" "%TEMP%\vbc54D8.tmp"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\undjhzcm.cmdline"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES51BD.tmp" "%TEMP%\vbc51BC.tmp"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\p9a2huiw.cmdline"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES4E61.tmp" "%TEMP%\vbc4E51.tmp"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\jz4zurks.cmdline"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES6DFF.tmp" "%TEMP%\vbc6DFE.tmp"
