Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'VistaSlave' = '"%ProgramFiles(x86)%\NetToolEnergyClient\vistaslave.exe"'
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\st6unst uninstaller.lnk
Creates the following services
- [<HKLM>\System\CurrentControlSet\Services\EnergyClient] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\EnergyClient] 'ImagePath' = '%ProgramFiles(x86)%\NetToolEnergyClient\nettoolenergyclient.exe'
Malicious functions
Executes the following
- '%WINDIR%\syswow64\netsh.exe' firewall add allowedprogram "%ProgramFiles(x86)%\NetToolEnergyClient\nettoolenergyclient.exe" "Nettool Energyx Client" enable
- '%WINDIR%\syswow64\netsh.exe' firewall add allowedprogram "%ProgramFiles(x86)%\NetToolEnergyClient\vistaslave.exe" "Nettool Energyx VistaSlave" enable
Modifies file system
Creates the following files
- %TEMP%\rarsfx0\support\advpack.dll
- %TEMP%\rarsfx0\setup.lst
- %TEMP%\rarsfx0\energy.log.txt
- %WINDIR%\st6unst.000
- %WINDIR%\setup.lst
- %WINDIR%\nettoolenergyclient.cab
- %TEMP%\msftqws.pdw\st6unst.exe
- %WINDIR%\temp.000
- %TEMP%\msftqws.pdw\vb6stkit.dll
- %TEMP%\msftqws.pdw\vb6de.dll
- %WINDIR%\syswow64\temp.000
- %WINDIR%\setup1.exe
- %ProgramFiles(x86)%\nettoolenergyclient\temp.000
- %ProgramFiles(x86)%\nettoolenergyclient\st6unst.log
- %TEMP%\msftqws.pdw\startservice.exe
- %TEMP%\msftqws.pdw\ntsvcx.ocx
- %TEMP%\msftqws.pdw\winskde.dll
- %TEMP%\msftqws.pdw\mswinsck.ocx
- %TEMP%\msftqws.pdw\getcoretempinfo.dll
- %TEMP%\msftqws.pdw\powrprof.dll
- %TEMP%\msftqws.pdw\wlanapi.dll
- %TEMP%\msftqws.pdw\iphlpapi.dll
- %TEMP%\msftqws.pdw\advpack.dll
- %TEMP%\msftqws.pdw\nettoolenergyclient.exe
- %PROGRAMDATA%\microsoft\windows\start menu\programs\nettool\nettool energy-x client.lnk
- %TEMP%\rarsfx0\setup.exu
- %TEMP%\msftqws.pdw\vistaslave.exe
- %TEMP%\rarsfx0\nettoolenergyclient.cab
- %TEMP%\rarsfx0\support\oleaut32.dll
- %TEMP%\rarsfx0\support\asycfilt.dll
- %TEMP%\rarsfx0\support\comcat.dll
- %TEMP%\rarsfx0\support\getcoretempinfo.dll
- %TEMP%\rarsfx0\support\iphlpapi.dll
- %TEMP%\rarsfx0\support\msvbvm60.dll
- %TEMP%\rarsfx0\support\mswinsck.ocx
- %TEMP%\rarsfx0\support\nettoolenergyclient.bat
- %TEMP%\rarsfx0\support\nettoolenergyclient.ddf
- %TEMP%\rarsfx0\support\nettoolenergyclient.exe
- %TEMP%\rarsfx0\support\ntsvc.ocx
- %TEMP%\rarsfx0\support\ntsvcx.ocx
- %TEMP%\rarsfx0\support\olepro32.dll
- %TEMP%\rarsfx0\support\wlanapi.dll
- %TEMP%\rarsfx0\support\powrprof.dll
- %TEMP%\rarsfx0\support\setup.exe
- %TEMP%\rarsfx0\support\setup.lst
- %TEMP%\rarsfx0\support\setup1.exe
- %TEMP%\rarsfx0\support\st6unst.exe
- %TEMP%\rarsfx0\support\startservice.exe
- %TEMP%\rarsfx0\support\stdole2.tlb
- %TEMP%\rarsfx0\support\vb6de.dll
- %TEMP%\rarsfx0\support\vb6stkit.dll
- %TEMP%\rarsfx0\support\vistaslave.exe
- %TEMP%\rarsfx0\support\winskde.dll
- %TEMP%\rarsfx0\install.exe
- %WINDIR%\temp\~df6766a17da7c0e8a3.tmp
Deletes the following files
- %TEMP%\msftqws.pdw\vb6stkit.dll
- %TEMP%\msftqws.pdw\st6unst.exe
- %WINDIR%\nettoolenergyclient.cab
- %TEMP%\msftqws.pdw\nettoolenergyclient.exe
- %TEMP%\msftqws.pdw\advpack.dll
- %TEMP%\msftqws.pdw\iphlpapi.dll
- %TEMP%\msftqws.pdw\wlanapi.dll
- %TEMP%\msftqws.pdw\powrprof.dll
- %TEMP%\msftqws.pdw\getcoretempinfo.dll
- %TEMP%\msftqws.pdw\mswinsck.ocx
- %TEMP%\msftqws.pdw\winskde.dll
- %TEMP%\msftqws.pdw\ntsvcx.ocx
- %TEMP%\msftqws.pdw\startservice.exe
- %TEMP%\msftqws.pdw\vistaslave.exe
- %APPDATA%\microsoft\windows\start menu\programs\startup\st6unst uninstaller.lnk
- %TEMP%\msftqws.pdw\vb6de.dll
- %WINDIR%\st6unst.000
- %WINDIR%\setup.lst
Moves the following files
- from %WINDIR%\temp.000 to %WINDIR%\st6unst.exe
- from %WINDIR%\syswow64\temp.000 to %WINDIR%\syswow64\vb6stkit.dll
- from %WINDIR%\syswow64\temp.000 to %WINDIR%\syswow64\vb6de.dll
- from %ProgramFiles(x86)%\nettoolenergyclient\temp.000 to %ProgramFiles(x86)%\nettoolenergyclient\vistaslave.exe
- from %ProgramFiles(x86)%\nettoolenergyclient\vistaslave.exe to %ProgramFiles(x86)%\nettoolenergyclient\vistaslave.exe
- from %ProgramFiles(x86)%\nettoolenergyclient\temp.000 to %ProgramFiles(x86)%\nettoolenergyclient\startservice.exe
- from %WINDIR%\syswow64\temp.000 to %WINDIR%\syswow64\ntsvcx.ocx
- from %WINDIR%\syswow64\temp.000 to %WINDIR%\syswow64\winskde.dll
- from %WINDIR%\syswow64\temp.000 to %WINDIR%\syswow64\mswinsck.ocx
- from %WINDIR%\syswow64\temp.000 to %WINDIR%\syswow64\getcoretempinfo.dll
- from %ProgramFiles(x86)%\nettoolenergyclient\temp.000 to %ProgramFiles(x86)%\nettoolenergyclient\nettoolenergyclient.exe
Substitutes the following files
- %WINDIR%\syswow64\temp.000
- %ProgramFiles(x86)%\nettoolenergyclient\temp.000
- %ProgramFiles(x86)%\nettoolenergyclient\startservice.exe
- %WINDIR%\syswow64\ntsvcx.ocx
- %WINDIR%\syswow64\winskde.dll
- %WINDIR%\syswow64\mswinsck.ocx
- %WINDIR%\syswow64\getcoretempinfo.dll
- %ProgramFiles(x86)%\nettoolenergyclient\nettoolenergyclient.exe
Network activity
UDP
- '<LOCALNET>.59.51':9577
- '255.255.255.255':9580
- '<LOCALNET>.59.51':9578
Miscellaneous
Searches for the following windows
- ClassName: 'EDIT' WindowName: ''
- ClassName: 'GVBSetupInit' WindowName: ''
Creates and executes the following
- '%TEMP%\rarsfx0\install.exe'
- '%TEMP%\rarsfx0\setup.exu' /s %TEMP%\RarSFX0\energy.log.txt
- '%WINDIR%\setup1.exe' /s "%TEMP%\RarSFX0\energy.log.txt" "%TEMP%\RarSFX0\" "%WINDIR%\ST6UNST.000" "%WINDIR%\st6unst.exe"
- '%ProgramFiles(x86)%\nettoolenergyclient\vistaslave.exe'
- '%WINDIR%\syswow64\netsh.exe' firewall add allowedprogram "%ProgramFiles(x86)%\NetToolEnergyClient\nettoolenergyclient.exe" "Nettool Energyx Client" enable' (with hidden window)
- '%WINDIR%\syswow64\netsh.exe' firewall add allowedprogram "%ProgramFiles(x86)%\NetToolEnergyClient\vistaslave.exe" "Nettool Energyx VistaSlave" enable' (with hidden window)
