Technical Information
Malicious functions:
To bypass firewall, removes or modifies the following registry keys:
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%TEMP%\RarSFX0\SetupUnificato.exe' = '%TEMP%\RarSFX0\SetupUnificato.ex...
Executes the following:
- '<SYSTEM32>\netsh.exe' firewall add allowedprogram "program=%TEMP%\RarSFX0\SetupUnificato.exe" "name=%TEMP%\RarSFX0\SetupUnificato.exe" mode=ENABLE scope=SUBNET
- '<SYSTEM32>\netsh.exe' firewall add portopening UDP 4111 UDP-4111 ENABLE ALL
- '<SYSTEM32>\netsh.exe' firewall add portopening UDP 4112 UDP-4112 ENABLE ALL
- '<SYSTEM32>\netsh.exe' firewall add portopening UDP 4113 UDP-4113 ENABLE ALL
- '<SYSTEM32>\netsh.exe' firewall add portopening UDP 4114 UDP-4114 ENABLE ALL
- '<SYSTEM32>\netsh.exe' firewall add portopening UDP 4115 UDP-4115 ENABLE ALL
- '<SYSTEM32>\netsh.exe' firewall add portopening UDP 4212 UDP-4212 ENABLE ALL
- '<SYSTEM32>\netsh.exe' firewall add portopening UDP 4213 UDP-4213 ENABLE ALL
- '<SYSTEM32>\netsh.exe' firewall add portopening UDP 4214 UDP-4214 ENABLE ALL
- '<SYSTEM32>\netsh.exe' firewall add portopening UDP 4215 UDP-4215 ENABLE ALL
Modifies file system:
Creates the following files:
- %TEMP%\RarSFX0\Start.bmp
- %TEMP%\RarSFX0\SetupUnificato.exe.manifest
- %TEMP%\RarSFX0\SetupUnificato.exe
- %TEMP%\RarSFX0\setup.inx
- %TEMP%\RarSFX0\Setup.ini
- %TEMP%\RarSFX0\Setup.exe
- %TEMP%\RarSFX0\RunAppOn64bit_NET40.exe
- %TEMP%\RarSFX0\RunAppOn64bit.exe
- %TEMP%\RarSFX0\RicercaIstanzaSQL.exe
- %TEMP%\RarSFX0\REGOCX32.EXE
- %TEMP%\RarSFX0\NoMessaggi.Spy
- %TEMP%\RarSFX0\MSWINSCK.OCX
- %TEMP%\RarSFX0\MSCOMCTL.OCX
- %TEMP%\RarSFX0\MSCOMCT2.OCX
- %TEMP%\RarSFX0\layout.bin
- %TEMP%\RarSFX0\LASTVER.INI
- %TEMP%\RarSFX0\ikernel.ex_
- %TEMP%\RarSFX0\data2.cab
- %TEMP%\RarSFX0\data1.hdr
- %TEMP%\RarSFX0\data1.cab
- %TEMP%\RarSFX0\AvvioInstallazione.exe.manifest
- %TEMP%\RarSFX0\AvvioInstallazione.exe
- %TEMP%\RarSFX0\AggiornamentoInternet.exe
- %TEMP%\RarSFX0\Start.ini
- %TEMP%\RarSFX0\SPR32X30.ocx
- <SYSTEM32>\MSCOMCT2.OCX
Miscellaneous:
Searches for the following windows:
- ClassName: 'EDIT' WindowName: ''
Creates and executes the following:
- '%TEMP%\RarSFX0\SetupUnificato.exe' RunFromCD RunFromMenu InstallAndRunAggInternet:YES
- '%TEMP%\RarSFX0\REGOCX32.EXE'
