Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\avira_security_installation
Malicious functions
Terminates or attempts to terminate
the following system processes:
- %WINDIR%\syswow64\wscript.exe
Modifies file system
Creates the following files
- %ALLUSERSPROFILE%\a.txt
- %TEMP%\.cr.12266\dryiocattributes.dll
- %TEMP%\.cr.12266\en-us\avira.spotlight.bootstrapper.resources.dll
- %TEMP%\.cr.12266\endpointprotectionsdk.lic
- %TEMP%\.cr.12266\es-es\avira.spotlight.bootstrapper.resources.dll
- %TEMP%\.cr.12266\fr-fr\avira.spotlight.bootstrapper.resources.dll
- %TEMP%\.cr.12266\dryioc.dll
- %TEMP%\.cr.12266\dryioc.mefattributedmodel.dll
- %TEMP%\.cr.12266\it-it\avira.spotlight.bootstrapper.resources.dll
- %TEMP%\.cr.12266\nl-nl\avira.spotlight.bootstrapper.resources.dll
- %TEMP%\.cr.12266\pt-br\avira.spotlight.bootstrapper.resources.dll
- %TEMP%\.cr.12266\ru-ru\avira.spotlight.bootstrapper.resources.dll
- %TEMP%\.cr.12266\tr-tr\avira.spotlight.bootstrapper.resources.dll
- %TEMP%\.cr.12266\zh-cn\avira.spotlight.bootstrapper.resources.dll
- %TEMP%\.cr.12266\ja-jp\avira.spotlight.bootstrapper.resources.dll
- %TEMP%\.cr.12266\microsoft.windows.shell.dll
- %TEMP%\.cr.12266\de-de\avira.spotlight.bootstrapper.resources.dll
- %TEMP%\.cr.12266\avira.spotlight.bootstrapper.telemetry.interface.dll
- %TEMP%\.cr.12266\avira.spotlight.bootstrapper.logging.dll
- %ALLUSERSPROFILE%\kellvbs.vbs
- %ALLUSERSPROFILE%\setup.exe
- %ALLUSERSPROFILE%\start.bat
- %TEMP%\.cr.13503\setup.exe
- %TEMP%\.cr.4237\avira_security_installation.xml
- %ALLUSERSPROFILE%\start1.lnk
- %ALLUSERSPROFILE%\s.vbs
- %TEMP%\.cr.12266\antivirussetup.inf
- %TEMP%\.cr.12266\avira.common.mixpanel.dll
- %TEMP%\.cr.12266\avira.filedownloader.dll
- %TEMP%\.cr.12266\avira.spotlight.bootstrapper.core.dll
- %TEMP%\.cr.12266\avira.spotlight.bootstrapper.engine.dll
- %TEMP%\.cr.12266\avira.spotlight.bootstrapper.exe
- %TEMP%\.cr.12266\avira.spotlight.bootstrapper.exe.config
- %TEMP%\.cr.12266\avira.common.guards.dll
- %TEMP%\.cr.12266\zh-tw\avira.spotlight.bootstrapper.resources.dll
- %TEMP%\avira_spotlight_bootstrapper_2021-04-09_17-52-36.log
Deletes the following files
- %TEMP%\.cr.4237\avira_security_installation.xml
Modifies the HOSTS file.
Miscellaneous
Creates and executes the following
- '%WINDIR%\syswow64\wscript.exe' "%ALLUSERSPROFILE%\s.vbs"
- '%WINDIR%\syswow64\wscript.exe' "%ALLUSERSPROFILE%\kellvbs.vbs"
- '%ALLUSERSPROFILE%\setup.exe'
- '%TEMP%\.cr.12266\avira.spotlight.bootstrapper.exe' "%TEMP%\.CR.12266\Avira.Spotlight.Bootstrapper.exe" OriginalFileName=Setup.exe
Executes the following
- '%WINDIR%\syswow64\schtasks.exe' /Create /Xml "%TEMP%\.CR.4237\Avira_Security_Installation.xml" /F /TN "Avira_Security_Installation"
