Technical Information
To ensure autorun and distribution:
Creates or modifies the following files:
- %HOMEPATH%\Start Menu\Programs\Startup\ST5UNST Uninstaller.LNK
Malicious functions:
Creates and executes the following:
- %WINDIR%\setup1.exe "%TEMP%\RarSFX0\" "%WINDIR%\ST5UNST.000" "%WINDIR%\ST5UNST.EXE"
- %TEMP%\RarSFX0\SETUP.EXE
Modifies file system :
Creates the following files:
- %TEMP%\RarSFX0\Piped 16-Bit.kn_
- %TEMP%\RarSFX0\ReadMe.rt_
- %TEMP%\RarSFX0\Ribbon 16-Bit.kn_
- %TEMP%\RarSFX0\Pal256.gi_
- %TEMP%\RarSFX0\OleAut32.dl_
- %TEMP%\RarSFX0\OlePro32.dl_
- %TEMP%\RarSFX0\Open-Ended 16-Bit.kn_
- %TEMP%\RarSFX0\Sample3.kw_
- %TEMP%\RarSFX0\setup1.ex_
- %TEMP%\RarSFX0\SETUP.EXE
- %TEMP%\RarSFX0\Sample2.kw_
- %TEMP%\RarSFX0\RoseThorn 16-Bit.kn_
- %TEMP%\RarSFX0\RubberBand 32-Bit.kn_
- %TEMP%\RarSFX0\Sample1.kw_
- %TEMP%\RarSFX0\Nice Curve 16-Bit.kn_
- %TEMP%\RarSFX0\Malleable 16-Bit.kn_
- %TEMP%\RarSFX0\MatchStick 8-Bit.kn_
- %TEMP%\RarSFX0\MatchStick 16-Bit.kn_
- %TEMP%\RarSFX0\LongBoat 24-Bit.kn_
- %TEMP%\RarSFX0\kwhelp.pd_
- %TEMP%\RarSFX0\Lancelot 16-Bit.kn_
- %TEMP%\RarSFX0\Lattice 16-Bit.kn_
- %TEMP%\RarSFX0\Minaret Thin 8-Bit.kn_
- %TEMP%\RarSFX0\MSVBVM50.dl_
- %TEMP%\RarSFX0\Nice Curve 2 16-Bit.kn_
- %TEMP%\RarSFX0\Minaret Medium 16-Bit.kn_
- %TEMP%\RarSFX0\Minaret 8-Bit.kn_
- %TEMP%\RarSFX0\Minaret 16-Bit.kn_
- %TEMP%\RarSFX0\Minaret Medium 8-Bit.kn_
- %TEMP%\RarSFX0\Tipofday.tx_
- %TEMP%\RarSFX0\Trace Lancelot 16-Bit.kn_
- %TEMP%\RarSFX0\Trace Malleable 16-Bit.kn_
- %TEMP%\RarSFX0\ThinThread 8-Bit.kn_
- %TEMP%\RarSFX0\Stitch 8-Bit.kn_
- %TEMP%\RarSFX0\Swift 16-Bit.kn_
- %TEMP%\RarSFX0\ThickThatch 16-Bit.kn_
- %WINDIR%\SETUP.LST
- <SYSTEM32>\temp.000
- %WINDIR%\temp.000
- %TEMP%\RarSFX0\Trace Sleek 8-Bit.kn_
- %TEMP%\RarSFX0\VB5StKit.dl_
- %WINDIR%\ST5UNST.000
- %TEMP%\RarSFX0\Steel Pipe 16-Bit.kn_
- %TEMP%\RarSFX0\Smooth 32-Bit.kn_
- %TEMP%\RarSFX0\Solid 8-Bit.kn_
- %TEMP%\RarSFX0\ST5UNST.EX_
- %TEMP%\RarSFX0\SlimLine 16-Bit.kn_
- %TEMP%\RarSFX0\SETUP.LST
- %TEMP%\RarSFX0\Sleek 8-Bit.kn_
- %TEMP%\RarSFX0\Sleek 24-Bit.kn_
- %TEMP%\RarSFX0\Standard Medium 8-Bit.kn_
- %TEMP%\RarSFX0\Standard Outline 24-Bit.kn_
- %TEMP%\RarSFX0\StdOle2.tl_
- %TEMP%\RarSFX0\Standard 32-Bit.kn_
- %TEMP%\RarSFX0\Standard 8-Bit.kn_
- %TEMP%\RarSFX0\Standard 16-Bit.kn_
- %TEMP%\RarSFX0\Standard 24-Bit.kn_
- %TEMP%\RarSFX0\kwhelp.ht_
- %TEMP%\RarSFX0\Curved 16-Bit.kn_
- %TEMP%\RarSFX0\Curved 24-Bit.kn_
- %TEMP%\RarSFX0\Curved Slim 8-Bit.kn_
- %TEMP%\RarSFX0\Curved 8-Bit.kn_
- %TEMP%\RarSFX0\COMCTL32.OC_
- %TEMP%\RarSFX0\COMDLG32.OC_
- %TEMP%\RarSFX0\Ctl3d32.dl_
- %TEMP%\RarSFX0\Formal 16-Bit.kn_
- %TEMP%\RarSFX0\Formal Medium 8-Bit.kn_
- %TEMP%\RarSFX0\Formal Medium 16-Bit.kn_
- %TEMP%\RarSFX0\Formal 8-Bit.kn_
- %TEMP%\RarSFX0\Cutlass 8-Bit.kn_
- %TEMP%\RarSFX0\Discreet 8-Bit.kn_
- %TEMP%\RarSFX0\Elegant 8-Bit.kn_
- %TEMP%\RarSFX0\ComCat.dl_
- %TEMP%\RarSFX0\32Bit.kb_
- %TEMP%\RarSFX0\ArmWrestler 24-Bit.kn_
- %TEMP%\RarSFX0\AsycFilt.dl_
- %TEMP%\RarSFX0\24Bit.kb_
- %TEMP%\RarSFX0\3D 16-Bit.kn_
- %TEMP%\RarSFX0\8Bit.kb_
- %TEMP%\RarSFX0\16Bit.kb_
- %TEMP%\RarSFX0\CentreStripe Slim 16-Bit.kn_
- %TEMP%\RarSFX0\Clockwork 32-Bit.kn_
- %TEMP%\RarSFX0\Cloistered 8-Bit.kn_
- %TEMP%\RarSFX0\CentreStripe Med 16-Bit.kn_
- %TEMP%\RarSFX0\CentreStripe 8-Bit.kn_
- %TEMP%\RarSFX0\CentreStripe 16-Bit.kn_
- %TEMP%\RarSFX0\CentreStripe 32-Bit.kn_
- %TEMP%\RarSFX0\image008.gi_
- %TEMP%\RarSFX0\image009.gi_
- %TEMP%\RarSFX0\image010.gi_
- %TEMP%\RarSFX0\image007.gi_
- %TEMP%\RarSFX0\image004.gi_
- %TEMP%\RarSFX0\image005.gi_
- %TEMP%\RarSFX0\image006.gi_
- %TEMP%\RarSFX0\KnotWorker.cn_
- %TEMP%\RarSFX0\KnotWorker.ex_
- %TEMP%\RarSFX0\KnotWorker.hl_
- %TEMP%\RarSFX0\image014.gi_
- %TEMP%\RarSFX0\image011.gi_
- %TEMP%\RarSFX0\image012.gi_
- %TEMP%\RarSFX0\image013.gi_
- %TEMP%\RarSFX0\image003.gi_
- %TEMP%\RarSFX0\Formal Thin 24-Bit.kn_
- %TEMP%\RarSFX0\Frame 8-Bit.kn_
- %TEMP%\RarSFX0\Frame 16-Bit.kn_
- %TEMP%\RarSFX0\Formal Outline Med 16-Bit.kn_
- %TEMP%\RarSFX0\Formal Outline 8-Bit.kn_
- %TEMP%\RarSFX0\Formal Outline 16-Bit.kn_
- %TEMP%\RarSFX0\Formal Outline 32-Bit.kn_
- %TEMP%\RarSFX0\Group Tester 24-Bit.kn_
- %TEMP%\RarSFX0\image001.gi_
- %TEMP%\RarSFX0\image002.gi_
- %TEMP%\RarSFX0\Group Tester 16-Bit.kn_
- %TEMP%\RarSFX0\Gossamer 8-Bit.kn_
- %TEMP%\RarSFX0\Group Tester 2 16-Bit.kn_
- %TEMP%\RarSFX0\Group Tester 8-Bit.kn_
Moves the following files:
- from <SYSTEM32>\temp.000 to <SYSTEM32>\VB5StKit.dll
- from %WINDIR%\temp.000 to %WINDIR%\setup1.exe
- from %WINDIR%\temp.000 to %WINDIR%\ST5UNST.EXE
Miscellaneous:
Searches for the following windows:
- ClassName: 'GVBSetupInit' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'EDIT' WindowName: ''
