Technical Information
Malicious functions:
Creates and executes the following:
- '%TEMP%\RarSFX0\batexe\wul.exe' /shtml "dump\InstalledUpdates.html"
- '%TEMP%\RarSFX0\batexe\strun.exe' /shtml "dump\Startup.html"
- '%TEMP%\RarSFX0\batexe\awatch.exe' /shtml "dump\NetworkAdapter.html"
- '%TEMP%\RarSFX0\batexe\mzcv.exe' /shtml "dump\MozillaCookies.html"
- '%TEMP%\RarSFX0\batexe\WebBrowserPassView.exe' /shtml "dump\Passweb.html"
- '%TEMP%\RarSFX0\batexe\mozillacache.exe' /shtml "dump\mozicache.html"
- '%TEMP%\RarSFX0\batexe\mozillahistory.exe' /shtml "dump\mozihistory.html"
- '%TEMP%\RarSFX0\batexe\bullets.exe' /shtml "dump\Otherpass.html"
- '%TEMP%\RarSFX0\batexe\mylast.exe' /shtml "dump\seaches.html"
- '%TEMP%\RarSFX0\batexe\cports.exe' /shtml "dump\OpenPorts.html"
- '%TEMP%\RarSFX0\nircmd.exe' execmd CALL batexe\moddump.bat
- '%TEMP%\RarSFX0\nircmd.exe' execmd .\batexe\mspass.exe /shtml "dump\IMClients.html"
- '%TEMP%\RarSFX0\start.exe'
- '%TEMP%\RarSFX0\nircmd.exe' execmd CALL batexe\progstart.bat
- '%TEMP%\RarSFX0\batexe\mailpv.exe' /shtml "dump\mail.html"
- '%TEMP%\RarSFX0\batexe\iepv.exe' /shtml "dump\IEPasswords.html"
- '%TEMP%\RarSFX0\batexe\PstPassword.exe' /shtml "dump\PstPassword.html"
- '%TEMP%\RarSFX0\batexe\iehv.exe' /shtml "dump\history.html"
- '%TEMP%\RarSFX0\batexe\ProduKey.exe' /shtml "dump\ProductKey.html"
Executes the following:
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\1.tmp\AUU.bat" "
Searches for registry branches where third party applications store passwords:
- [<HKCU>\Software\Yahoo\Pager]
- [<HKCU>\Software\Microsoft\IdentityCRL]
- [<HKCU>\Software\Microsoft\MessengerService]
- [<HKCU>\Software\Google\Google Talk\Accounts]
- [<HKCU>\Software\Microsoft\MSNMessenger]
Modifies file system :
Creates the following files:
- %TEMP%\RarSFX0\start.exe
- %TEMP%\RarSFX0\nircmd.exe
- %TEMP%\RarSFX0\dump\ptf.exe
- %TEMP%\1.tmp\AUU.bat
- %TEMP%\RarSFX0\dump\ProductKey.html
- %TEMP%\RarSFX0\dump\history.html
- %TEMP%\RarSFX0\dump\mail.html
- %TEMP%\RarSFX0\batexe\WebBrowserPassView.exe
- %TEMP%\RarSFX0\batexe\webbrowserpassview.cfg
- %TEMP%\RarSFX0\batexe\strun.exe
- %TEMP%\RarSFX0\batexe\webbrowserpassview.exeold
- %TEMP%\RarSFX0\batexe\wul.exe
- %TEMP%\RarSFX0\batexe\wireless.exe
- %TEMP%\RarSFX0\batexe\wireless.cfg
- %TEMP%\RarSFX0\dump\Otherpass.html
- %TEMP%\RarSFX0\dump\Passweb.html
- %TEMP%\RarSFX0\dump\Startup.html
- %TEMP%\sqp3.tmp
- %TEMP%\RarSFX0\dump\mozihistory.html
- %TEMP%\RarSFX0\dump\mozicache.html
- %TEMP%\RarSFX0\dump\seaches.html
- %TEMP%\RarSFX0\dump\OpenPorts.html
- %TEMP%\RarSFX0\dump\PstPassword.html
- %TEMP%\RarSFX0\dump\IEPasswords.html
- %TEMP%\RarSFX0\dump\NetworkAdapter.html
- %TEMP%\RarSFX0\dump\InstalledUpdates.html
- %TEMP%\RarSFX0\dump\MozillaCookies.html
- %TEMP%\cke2.tmp
- %TEMP%\RarSFX0\batexe\serviwin.exe
- %TEMP%\RarSFX0\batexe\moddump2.bat
- %TEMP%\RarSFX0\batexe\moddump.bat
- %TEMP%\RarSFX0\batexe\mailpv.exe
- %TEMP%\RarSFX0\batexe\modsmax.bat
- %TEMP%\RarSFX0\batexe\mozillahistory.exe
- %TEMP%\RarSFX0\batexe\mozillacache.exe
- %TEMP%\RarSFX0\batexe\mozillacache.cfg
- %TEMP%\RarSFX0\batexe\bullets.exe
- %TEMP%\RarSFX0\batexe\bullets.cfg
- %TEMP%\RarSFX0\batexe\awatch.exe
- %TEMP%\RarSFX0\batexe\cports.exe
- %TEMP%\RarSFX0\batexe\iepv.exe
- %TEMP%\RarSFX0\batexe\iehv.exe
- %TEMP%\RarSFX0\batexe\CProcess.exe
- %TEMP%\RarSFX0\batexe\ProduKey.exe
- %TEMP%\RarSFX0\batexe\OpenedFilesView.exe
- %TEMP%\RarSFX0\batexe\OpenedFilesView.cfg
- %TEMP%\RarSFX0\batexe\progcc.bat
- %TEMP%\RarSFX0\batexe\PstPassword.exe
- %TEMP%\RarSFX0\batexe\progstart.bat
- %TEMP%\RarSFX0\batexe\proghide.bat
- %TEMP%\RarSFX0\batexe\mylast.cfg
- %TEMP%\RarSFX0\batexe\mspass.cfg
- %TEMP%\RarSFX0\batexe\MozillaHistoryView.cfg
- %TEMP%\RarSFX0\batexe\mylast.exe
- %TEMP%\RarSFX0\batexe\netpass.cfg
- %TEMP%\RarSFX0\batexe\mzcv.exe
- %TEMP%\RarSFX0\batexe\mzcv.cfg
Sets the 'hidden' attribute to the following files:
- %TEMP%\RarSFX0\batexe\progstart.bat
- %TEMP%\RarSFX0\batexe\PstPassword.exe
- %TEMP%\RarSFX0\batexe\serviwin.exe
- %TEMP%\RarSFX0\batexe\ProduKey.exe
- %TEMP%\RarSFX0\batexe\progcc.bat
- %TEMP%\RarSFX0\batexe\proghide.bat
- %TEMP%\RarSFX0\batexe\strun.exe
- %TEMP%\RarSFX0\batexe\wul.exe
- %TEMP%\RarSFX0\dump\ptf.exe
- %TEMP%\RarSFX0\nircmd.exe
- %TEMP%\RarSFX0\batexe\WebBrowserPassView.exe
- %TEMP%\RarSFX0\batexe\webbrowserpassview.exeold
- %TEMP%\RarSFX0\batexe\wireless.exe
- %TEMP%\RarSFX0\batexe\OpenedFilesView.exe
- %TEMP%\RarSFX0\batexe\CProcess.exe
- %TEMP%\RarSFX0\batexe\iehv.exe
- %TEMP%\RarSFX0\batexe\iepv.exe
- %TEMP%\RarSFX0\batexe\awatch.exe
- %TEMP%\RarSFX0\batexe\bullets.exe
- %TEMP%\RarSFX0\batexe\cports.exe
- %TEMP%\RarSFX0\batexe\mailpv.exe
- %TEMP%\RarSFX0\batexe\mylast.exe
- %TEMP%\RarSFX0\batexe\mzcv.exe
- %TEMP%\RarSFX0\batexe\netpass.cfg
- %TEMP%\RarSFX0\batexe\modsmax.bat
- %TEMP%\RarSFX0\batexe\mozillacache.exe
- %TEMP%\RarSFX0\batexe\mozillahistory.exe
Deletes the following files:
- %TEMP%\cke2.tmp
- %TEMP%\sqp3.tmp
- %TEMP%\1.tmp\AUU.bat
- %TEMP%\RarSFX0\nircmd.exe
Miscellaneous:
Searches for the following windows:
- ClassName: '' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'EDIT' WindowName: ''
