Technical Information
Malicious functions:
Executes the following:
- '<SYSTEM32>\taskkill.exe' /F /IM "CyberGhost.exe"
- '<SYSTEM32>\taskkill.exe' /F /IM "CyberGhost.Service.exe"
Modifies file system:
Creates the following files:
- %TEMP%\RarSFX0\Setup.bat
- %TEMP%\RarSFX0\1.exe
- %TEMP%\RarSFX0\2.exe
- %TEMP%\RarSFX1\1.bat
Deletes the following files:
- %TEMP%\RarSFX1\1.bat
Miscellaneous:
Searches for the following windows:
- ClassName: 'EDIT' WindowName: ''
- ClassName: '' WindowName: ''
Creates and executes the following:
- '%TEMP%\RarSFX0\1.exe'
Executes the following:
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\RarSFX0\Setup.bat" "
- '<SYSTEM32>\mode.com' 84,26
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\RarSFX1\1.bat" "
