Technical Information
Malicious functions
Executes the following
- '<SYSTEM32>\taskkill.exe' /im CareUEyes.exe /t /f
Modifies file system
Creates the following files
- %TEMP%\rarsfx0\crack.exe
- %APPDATA%\careueyes\unins000.dat
- %APPDATA%\microsoft\windows\start menu\programs\careueyes\uninstall careueyes.lnk
- %HOMEPATH%\desktop\careueyes.lnk
- %APPDATA%\microsoft\windows\start menu\programs\careueyes\careueyes.lnk
- %APPDATA%\careueyes\wallpaper\is-16b7i.tmp
- %APPDATA%\careueyes\wallpaper\is-8b1dc.tmp
- %APPDATA%\careueyes\wallpaper\is-4onv0.tmp
- %APPDATA%\careueyes\wallpaper\is-2ndri.tmp
- %APPDATA%\careueyes\wallpaper\is-8mqgh.tmp
- %APPDATA%\careueyes\wallpaper\is-pkdnp.tmp
- %APPDATA%\careueyes\setting_v2.dat
- %APPDATA%\careueyes\wallpaper\is-kh042.tmp
- %APPDATA%\careueyes\is-8q0tp.tmp
- %APPDATA%\careueyes\is-ge5ck.tmp
- %APPDATA%\careueyes\is-5br81.tmp
- %APPDATA%\careueyes\is-dmcei.tmp
- %APPDATA%\careueyes\is-egjdh.tmp
- %TEMP%\is-l4u55.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-l4u55.tmp\_isetup\_setup64.tmp
- %TEMP%\is-2lvgi.tmp\set.tmp
- %TEMP%\rarsfx0\k.bat
- %TEMP%\rarsfx0\set.exe
- %APPDATA%\careueyes\wallpaper\is-eoump.tmp
- %APPDATA%\careueyes\careueyes.exe
Deletes the following files
- %TEMP%\is-l4u55.tmp\_isetup\_setup64.tmp
- %TEMP%\is-l4u55.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-2lvgi.tmp\set.tmp
- %TEMP%\rarsfx0\crack.exe
- %TEMP%\rarsfx0\k.bat
- %TEMP%\rarsfx0\set.exe
Moves the following files
- from %APPDATA%\careueyes\is-egjdh.tmp to %APPDATA%\careueyes\unins000.exe
- from %APPDATA%\careueyes\is-dmcei.tmp to %APPDATA%\careueyes\careueyes.exe
- from %APPDATA%\careueyes\is-5br81.tmp to %APPDATA%\careueyes\update.exe
- from %APPDATA%\careueyes\is-ge5ck.tmp to %APPDATA%\careueyes\config.dat
- from %APPDATA%\careueyes\is-8q0tp.tmp to %APPDATA%\careueyes\alert_sound.wav
- from %APPDATA%\careueyes\wallpaper\is-eoump.tmp to %APPDATA%\careueyes\wallpaper\1.jpg
- from %APPDATA%\careueyes\wallpaper\is-kh042.tmp to %APPDATA%\careueyes\wallpaper\2.jpg
- from %APPDATA%\careueyes\wallpaper\is-pkdnp.tmp to %APPDATA%\careueyes\wallpaper\3.jpg
- from %APPDATA%\careueyes\wallpaper\is-8mqgh.tmp to %APPDATA%\careueyes\wallpaper\4.jpg
- from %APPDATA%\careueyes\wallpaper\is-2ndri.tmp to %APPDATA%\careueyes\wallpaper\5.jpg
- from %APPDATA%\careueyes\wallpaper\is-4onv0.tmp to %APPDATA%\careueyes\wallpaper\6.jpg
- from %APPDATA%\careueyes\wallpaper\is-8b1dc.tmp to %APPDATA%\careueyes\wallpaper\7.jpg
- from %APPDATA%\careueyes\wallpaper\is-16b7i.tmp to %APPDATA%\careueyes\wallpaper\8.jpg
Miscellaneous
Searches for the following windows
- ClassName: 'EDIT' WindowName: ''
- ClassName: '' WindowName: ''
Creates and executes the following
- '%TEMP%\rarsfx0\set.exe' /verysilent
- '%TEMP%\is-2lvgi.tmp\set.tmp' /SL5="$10258,4813474,129536,%TEMP%\RarSFX0\set.exe" /verysilent
- '%APPDATA%\careueyes\careueyes.exe' /gamma
- '%TEMP%\rarsfx0\crack.exe'
Executes the following
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\RarSFX0\k.bat" "
- '%APPDATA%\careueyes\careueyes.exe' /gamma' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\RarSFX0\k.bat" "' (with hidden window)
