Technical Information
To ensure autorun and distribution
Creates the following files on removable media
- <Drive name for removable media>:\revengerat\system.exe
- <Drive name for removable media>:\join.avi
- <Drive name for removable media>:\join.avi.exe
- <Drive name for removable media>:\000814251_video_01.avi
- <Drive name for removable media>:\dashborder_96.bmp
- <Drive name for removable media>:\dashborder_192.bmp
Modifies file system
Creates the following files
- C:\revengerat\system.exe
- %TEMP%\vbcd330.tmp
- %TEMP%\resd331.tmp
- %ProgramFiles%.exe
- %TEMP%\iw7jx3mk.0.vb
- %TEMP%\iw7jx3mk.cmdline
- %TEMP%\iw7jx3mk.out
- %TEMP%\vbcd812.tmp
- %TEMP%\resd823.tmp
- C:\recovery.exe
- %TEMP%\ueeokzwo.0.vb
- %TEMP%\ueeokzwo.cmdline
- %TEMP%\ueeokzwo.out
- %TEMP%\vbcddcf.tmp
- %TEMP%\resdde0.tmp
- D:\revengerat\system.exe
- %TEMP%\fovmvv6x.cmdline
- %TEMP%\kjw8n0_g.0.vb
- %TEMP%\kjw8n0_g.cmdline
- %TEMP%\kjw8n0_g.out
- %TEMP%\vbce34d.tmp
- %TEMP%\rese34e.tmp
- D:\$recycle.bin.exe
- %PROGRAMDATA%\revengerat\join.ico
- %TEMP%\f3d8opgw.0.vb
- %TEMP%\f3d8opgw.cmdline
- %TEMP%\f3d8opgw.out
- %TEMP%\vbceb6b.tmp
- %TEMP%\reseb7c.tmp
- %PROGRAMDATA%\revengerat\000814251_video_01.ico
- %TEMP%\fovmvv6x.0.vb
- %TEMP%\0x8cbmov.out
- C:\totalcmd.exe
- %TEMP%\0x8cbmov.cmdline
- %TEMP%\t4fjdz64.cmdline
- %PROGRAMDATA%\revengerat\fdtjwst.ico
- %TEMP%\3tgrcqc1.0.vb
- %TEMP%\3tgrcqc1.cmdline
- %TEMP%\3tgrcqc1.out
- %TEMP%\vbcbab7.tmp
- %TEMP%\resbab8.tmp
- C:\$recycle.bin.exe
- %TEMP%\l_seusmw.0.vb
- %TEMP%\l_seusmw.cmdline
- %TEMP%\l_seusmw.out
- %TEMP%\vbcbf5a.tmp
- %TEMP%\resbf5b.tmp
- C:\documents and settings.exe
- %TEMP%\t4fjdz64.0.vb
- %TEMP%\t4fjdz64.out
- C:\perflogs.exe
- %TEMP%\vbcc43c.tmp
- %TEMP%\resc43d.tmp
- C:\far2.exe
- %TEMP%\nbi0ac2a.0.vb
- %TEMP%\nbi0ac2a.cmdline
- %TEMP%\nbi0ac2a.out
- %TEMP%\vbcc8d0.tmp
- %TEMP%\resc8d1.tmp
- C:\msocache.exe
- %TEMP%\6jals9gv.0.vb
- %TEMP%\6jals9gv.cmdline
- %TEMP%\6jals9gv.out
- %TEMP%\vbccd83.tmp
- %TEMP%\rescd84.tmp
- %TEMP%\0x8cbmov.0.vb
- %TEMP%\fovmvv6x.out
Sets the 'hidden' attribute to the following files
- C:\revengerat\system.exe
- D:\revengerat\system.exe
- <Drive name for removable media>:\revengerat\system.exe
Deletes the following files
- %TEMP%\resbab8.tmp
- %TEMP%\0x8cbmov.0.vb
- %TEMP%\0x8cbmov.out
- %TEMP%\resd823.tmp
- %TEMP%\vbcd812.tmp
- %TEMP%\iw7jx3mk.0.vb
- %TEMP%\iw7jx3mk.cmdline
- %TEMP%\iw7jx3mk.out
- %TEMP%\resdde0.tmp
- %TEMP%\vbcddcf.tmp
- %TEMP%\ueeokzwo.out
- %TEMP%\ueeokzwo.0.vb
- %TEMP%\ueeokzwo.cmdline
- %TEMP%\rese34e.tmp
- %TEMP%\vbce34d.tmp
- %TEMP%\kjw8n0_g.0.vb
- %TEMP%\kjw8n0_g.out
- %TEMP%\kjw8n0_g.cmdline
- %TEMP%\reseb7c.tmp
- %TEMP%\vbceb6b.tmp
- %TEMP%\f3d8opgw.cmdline
- %TEMP%\f3d8opgw.out
- %TEMP%\f3d8opgw.0.vb
- %TEMP%\fovmvv6x.cmdline
- %TEMP%\0x8cbmov.cmdline
- %TEMP%\fovmvv6x.0.vb
- %TEMP%\vbcd330.tmp
- %TEMP%\6jals9gv.cmdline
- %TEMP%\vbcbab7.tmp
- %TEMP%\3tgrcqc1.out
- %TEMP%\3tgrcqc1.0.vb
- %TEMP%\3tgrcqc1.cmdline
- %TEMP%\resbf5b.tmp
- %TEMP%\vbcbf5a.tmp
- %TEMP%\l_seusmw.0.vb
- %TEMP%\l_seusmw.out
- %TEMP%\l_seusmw.cmdline
- %TEMP%\resc43d.tmp
- %TEMP%\vbcc43c.tmp
- %TEMP%\t4fjdz64.out
- %TEMP%\t4fjdz64.cmdline
- %TEMP%\t4fjdz64.0.vb
- %TEMP%\resc8d1.tmp
- %TEMP%\vbcc8d0.tmp
- %TEMP%\nbi0ac2a.out
- %TEMP%\nbi0ac2a.0.vb
- %TEMP%\nbi0ac2a.cmdline
- %TEMP%\rescd84.tmp
- %TEMP%\vbccd83.tmp
- %TEMP%\6jals9gv.0.vb
- %TEMP%\6jals9gv.out
- %TEMP%\resd331.tmp
- %TEMP%\fovmvv6x.out
Network activity
Connects to
- 'yj###.#1.luyouxia.net':20645
UDP
- DNS ASK yj###.#1.luyouxia.net
Miscellaneous
Creates and executes the following
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\3tgrcqc1.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\cnzpyn1t.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESAE3F.tmp" "%TEMP%\vbcAE3E.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\fovmvv6x.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESEB7C.tmp" "%TEMP%\vbcEB6B.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\f3d8opgw.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESE34E.tmp" "%TEMP%\vbcE34D.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\kjw8n0_g.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESDDE0.tmp" "%TEMP%\vbcDDCF.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\ueeokzwo.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESD823.tmp" "%TEMP%\vbcD812.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES6059.tmp" "%TEMP%\vbc6048.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\iw7jx3mk.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\0x8cbmov.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESCD84.tmp" "%TEMP%\vbcCD83.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\6jals9gv.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESC8D1.tmp" "%TEMP%\vbcC8D0.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\nbi0ac2a.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESC43D.tmp" "%TEMP%\vbcC43C.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\t4fjdz64.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESBF5B.tmp" "%TEMP%\vbcBF5A.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\l_seusmw.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESBAB8.tmp" "%TEMP%\vbcBAB7.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESD331.tmp" "%TEMP%\vbcD330.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\ggtap9bh.cmdline"' (with hidden window)
Executes the following
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\3tgrcqc1.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\cnzpyn1t.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESAE3F.tmp" "%TEMP%\vbcAE3E.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\fovmvv6x.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESEB7C.tmp" "%TEMP%\vbcEB6B.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\f3d8opgw.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESE34E.tmp" "%TEMP%\vbcE34D.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\kjw8n0_g.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESDDE0.tmp" "%TEMP%\vbcDDCF.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\ueeokzwo.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESD823.tmp" "%TEMP%\vbcD812.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES6059.tmp" "%TEMP%\vbc6048.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\iw7jx3mk.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\0x8cbmov.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESCD84.tmp" "%TEMP%\vbcCD83.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\6jals9gv.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESC8D1.tmp" "%TEMP%\vbcC8D0.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\nbi0ac2a.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESC43D.tmp" "%TEMP%\vbcC43C.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\t4fjdz64.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESBF5B.tmp" "%TEMP%\vbcBF5A.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\l_seusmw.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESBAB8.tmp" "%TEMP%\vbcBAB7.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESD331.tmp" "%TEMP%\vbcD330.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\ggtap9bh.cmdline"
