Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\system services.exe
Creates the following files on removable media
- <Drive name for removable media>:\revengerat\client.exe
- <Drive name for removable media>:\fi51.doc
- <Drive name for removable media>:\sdksampleunprivdeveloper.cer
- <Drive name for removable media>:\testee.cer
- <Drive name for removable media>:\testcertificate.cer
- <Drive name for removable media>:\sdksampleprivdeveloper.cer
- <Drive name for removable media>:\pmd.cer
- <Drive name for removable media>:\sdkfailsafeemulator.cer
- <Drive name for removable media>:\contoso_1.cer
- <Drive name for removable media>:\contosoroot.cer
- <Drive name for removable media>:\dashborder_144.bmp.exe
- <Drive name for removable media>:\dashborder_144.bmp
- <Drive name for removable media>:\tileimage.bmp.exe
- <Drive name for removable media>:\tileimage.bmp
- <Drive name for removable media>:\dashborder_192.bmp.exe
- <Drive name for removable media>:\dashborder_192.bmp
- <Drive name for removable media>:\dialmap.bmp.exe
- <Drive name for removable media>:\dialmap.bmp
- <Drive name for removable media>:\default.bmp.exe
- <Drive name for removable media>:\default.bmp
- <Drive name for removable media>:\delete.avi.exe
- <Drive name for removable media>:\delete.avi
- <Drive name for removable media>:\cveuropeo.doc
- <Drive name for removable media>:\february_catalogue__2015.doc
Malicious functions
Injects code into
the following system processes:
- %WINDIR%\microsoft.net\framework\v4.0.30319\regasm.exe
Modifies file system
Creates the following files
- %TEMP%\vawrhjfwfh.txt
- %TEMP%\2xhpd05m.0.vb
- %TEMP%\2xhpd05m.cmdline
- %TEMP%\2xhpd05m.out
- %TEMP%\vbc14933e3e9774161bb2138b4c441964.tmp
- %TEMP%\vbcdd31d87d926148ce98b11e86f4904b1d.tmp
- %TEMP%\res6822.tmp
- %PROGRAMDATA%\revengerat\tileimage.ico
- %TEMP%\km51m0a2.0.vb
- %TEMP%\km51m0a2.out
- %TEMP%\vbce86f1bb463c445b28614b3adade04119.tmp
- %TEMP%\vbcacfa3b01cc474656bdee62a25bf29ac2.tmp
- %TEMP%\vbc2e7000857fca4956b947ffeb6410ff8e.tmp
- %TEMP%\res71b7.tmp
- %PROGRAMDATA%\revengerat\dashborder_144.ico
- %TEMP%\tvracxix.0.vb
- %TEMP%\tvracxix.cmdline
- %TEMP%\tvracxix.out
- %TEMP%\vbc9cefc2d21c54891b871d2c5b7fc4c11.tmp
- %PROGRAMDATA%\revengerat\dashborder_192.ico
- %TEMP%\km51m0a2.cmdline
- %TEMP%\res616b.tmp
- %TEMP%\afpfpz1k.0.vb
- %PROGRAMDATA%\revengerat\delete.ico
- %TEMP%\0od1rokz.0.vb
- %TEMP%\0od1rokz.cmdline
- %TEMP%\0od1rokz.out
- %TEMP%\vbc1637c6e3fab4e8599585a727b3f66d.tmp
- %TEMP%\vbce01ed5cc3da44d6a9c85d8abb164d765.tmp
- %TEMP%\res548a.tmp
- %PROGRAMDATA%\revengerat\default.ico
- %TEMP%\afpfpz1k.cmdline
- %TEMP%\vbc325228d41f74a1d80ac3755ed7daa1.tmp
- %TEMP%\afpfpz1k.out
- %TEMP%\vbc62d25a172b694d219eb87f789c78e1d.tmp
- %TEMP%\vbcfa2fd20edc864540bff3da1fe92ffb89.tmp
- %TEMP%\res5ac4.tmp
- %PROGRAMDATA%\revengerat\dialmap.ico
- %TEMP%\4t15khbk.0.vb
- %TEMP%\4t15khbk.cmdline
- %TEMP%\4t15khbk.out
- %TEMP%\vbc39e64b3774934370a91581c5abc2f022.tmp
- %TEMP%\res7b0e.tmp
Sets the 'hidden' attribute to the following files
- <Drive name for removable media>:\revengerat\client.exe
Deletes the following files
- %TEMP%\res548a.tmp
- %TEMP%\2xhpd05m.cmdline
- %TEMP%\2xhpd05m.out
- %TEMP%\2xhpd05m.0.vb
- %TEMP%\res71b7.tmp
- %TEMP%\vbc2e7000857fca4956b947ffeb6410ff8e.tmp
- %TEMP%\vbcdd31d87d926148ce98b11e86f4904b1d.tmp
- %TEMP%\vbc14933e3e9774161bb2138b4c441964.tmp
- %TEMP%\vbcacfa3b01cc474656bdee62a25bf29ac2.tmp
- %TEMP%\km51m0a2.cmdline
- %TEMP%\res7b0e.tmp
- %TEMP%\vbce86f1bb463c445b28614b3adade04119.tmp
- %TEMP%\vbc9cefc2d21c54891b871d2c5b7fc4c11.tmp
- %TEMP%\tvracxix.cmdline
- %TEMP%\km51m0a2.0.vb
- %TEMP%\km51m0a2.out
- %TEMP%\res6822.tmp
- %TEMP%\4t15khbk.0.vb
- %TEMP%\4t15khbk.out
- %TEMP%\vbc1637c6e3fab4e8599585a727b3f66d.tmp
- %TEMP%\0od1rokz.out
- %TEMP%\0od1rokz.0.vb
- %TEMP%\0od1rokz.cmdline
- %TEMP%\res5ac4.tmp
- %TEMP%\vbcfa2fd20edc864540bff3da1fe92ffb89.tmp
- %TEMP%\vbce01ed5cc3da44d6a9c85d8abb164d765.tmp
- %TEMP%\vbc62d25a172b694d219eb87f789c78e1d.tmp
- %TEMP%\afpfpz1k.0.vb
- %TEMP%\afpfpz1k.cmdline
- %TEMP%\res616b.tmp
- %TEMP%\vbc39e64b3774934370a91581c5abc2f022.tmp
- %TEMP%\vbc325228d41f74a1d80ac3755ed7daa1.tmp
- %TEMP%\4t15khbk.cmdline
- %TEMP%\afpfpz1k.out
- %TEMP%\tvracxix.out
- %TEMP%\tvracxix.0.vb
Network activity
Connects to
- 'localhost':1337
UDP
- DNS ASK ce#####s1980.hopto.org
Miscellaneous
Creates and executes the following
- '%APPDATA%\microsoft\windows\start menu\programs\startup\system services.exe'
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\0od1rokz.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\tqrbrhso.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES398B.tmp" "%TEMP%\vbc134043620ED4F5A83F9D35324A4CB.TMP"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\e51xguuc.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES368E.tmp" "%TEMP%\vbc6DE80A5EF74E4AA8AD2B6945EFAC41B9.TMP"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\x5r1jhr2.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES340D.tmp" "%TEMP%\vbc7BDBFF6F50FB47F2A6653EA3791549.TMP"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\aznozdrm.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES30A2.tmp" "%TEMP%\vbcC175D1C3C80C4A9C80D3B8D4C19E8B7B.TMP"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\l1lzfcc2.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES2DF3.tmp" "%TEMP%\vbcB3C4C9363F2F4267BE22D84CA874FB5.TMP"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\oezk4zlc.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES2B43.tmp" "%TEMP%\vbcE5482BC51BBE4F15A757AA1DED96AB99.TMP"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\cklfoj1j.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES2855.tmp" "%TEMP%\vbcAB5A7DF3B865483EB3D213E23050C0AA.TMP"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\csgxk0qm.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES24EA.tmp" "%TEMP%\vbc9257EBB07F141E1AFAF6BFD9D475FC7.TMP"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\f4jxgrcd.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES7B0E.tmp" "%TEMP%\vbcE86F1BB463C445B28614B3ADADE04119.TMP"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\tvracxix.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES71B7.tmp" "%TEMP%\vbc2E7000857FCA4956B947FFEB6410FF8E.TMP"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\km51m0a2.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES6822.tmp" "%TEMP%\vbcDD31D87D926148CE98B11E86F4904B1D.TMP"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\2xhpd05m.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES616B.tmp" "%TEMP%\vbc39E64B3774934370A91581C5ABC2F022.TMP"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\4t15khbk.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES5AC4.tmp" "%TEMP%\vbcFA2FD20EDC864540BFF3DA1FE92FFB89.TMP"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\afpfpz1k.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES548A.tmp" "%TEMP%\vbcE01ED5CC3DA44D6A9C85D8ABB164D765.TMP"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES3C3B.tmp" "%TEMP%\vbc7F84AEA682D94EB8BD292E3A4144CB.TMP"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\ab4dtwa0.cmdline"' (with hidden window)
Executes the following
- '%WINDIR%\microsoft.net\framework\v4.0.30319\regasm.exe'
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\tqrbrhso.cmdline"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES398B.tmp" "%TEMP%\vbc134043620ED4F5A83F9D35324A4CB.TMP"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\e51xguuc.cmdline"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES368E.tmp" "%TEMP%\vbc6DE80A5EF74E4AA8AD2B6945EFAC41B9.TMP"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\x5r1jhr2.cmdline"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES340D.tmp" "%TEMP%\vbc7BDBFF6F50FB47F2A6653EA3791549.TMP"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\aznozdrm.cmdline"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES30A2.tmp" "%TEMP%\vbcC175D1C3C80C4A9C80D3B8D4C19E8B7B.TMP"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\l1lzfcc2.cmdline"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES2DF3.tmp" "%TEMP%\vbcB3C4C9363F2F4267BE22D84CA874FB5.TMP"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\oezk4zlc.cmdline"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES2B43.tmp" "%TEMP%\vbcE5482BC51BBE4F15A757AA1DED96AB99.TMP"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\cklfoj1j.cmdline"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES2855.tmp" "%TEMP%\vbcAB5A7DF3B865483EB3D213E23050C0AA.TMP"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\csgxk0qm.cmdline"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES24EA.tmp" "%TEMP%\vbc9257EBB07F141E1AFAF6BFD9D475FC7.TMP"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\f4jxgrcd.cmdline"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES7B0E.tmp" "%TEMP%\vbcE86F1BB463C445B28614B3ADADE04119.TMP"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\tvracxix.cmdline"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES71B7.tmp" "%TEMP%\vbc2E7000857FCA4956B947FFEB6410FF8E.TMP"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\km51m0a2.cmdline"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES6822.tmp" "%TEMP%\vbcDD31D87D926148CE98B11E86F4904B1D.TMP"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\2xhpd05m.cmdline"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES616B.tmp" "%TEMP%\vbc39E64B3774934370A91581C5ABC2F022.TMP"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\4t15khbk.cmdline"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES5AC4.tmp" "%TEMP%\vbcFA2FD20EDC864540BFF3DA1FE92FFB89.TMP"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\afpfpz1k.cmdline"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES548A.tmp" "%TEMP%\vbcE01ED5CC3DA44D6A9C85D8ABB164D765.TMP"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\0od1rokz.cmdline"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES3C3B.tmp" "%TEMP%\vbc7F84AEA682D94EB8BD292E3A4144CB.TMP"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\ab4dtwa0.cmdline"
