Technical Information
Malicious functions
Executes the following
- '%WINDIR%\syswow64\taskkill.exe' /f /im reg.exe
- '%WINDIR%\syswow64\taskkill.exe' /f /im taskkill.exe
Modifies file system
Creates the following files
- %TEMP%\jrt\erunt\erunt.exe.manifest
- %TEMP%\jrt\ffxpi.dat
- %TEMP%\jrt\ffxml.dat
- %TEMP%\jrt\ffregkey_x86.dat
- %TEMP%\jrt\ffregkey_x64.dat
- %TEMP%\jrt\ffprefs.dat
- %TEMP%\jrt\ffplugins.dat
- %TEMP%\jrt\ffpluginreg.dat
- %TEMP%\jrt\ffextensions.dat
- %TEMP%\jrt\ffbrowsermngr.dat
- %TEMP%\jrt\ext.dat
- %TEMP%\jrt\elevationpolicy_clsid.dat
- %TEMP%\jrt\cut.dat
- %TEMP%\jrt\clsid_clsid.dat
- %TEMP%\jrt\choice.dat
- %TEMP%\jrt\bho_name.dat
- %TEMP%\jrt\bho_clsid.dat
- %TEMP%\jrt\badappinit.dat
- %TEMP%\jrt\askservices.dat
- %TEMP%\jrt\askregvalue_x86.dat
- %TEMP%\jrt\askregvalue_x64.dat
- %TEMP%\jrt\askregkey_x86.dat
- %TEMP%\jrt\askregkey_x64.dat
- %TEMP%\jrt\askclsid.dat
- %TEMP%\jrt\apppaths.dat
- %TEMP%\jrt\approvedextensions_clsid.dat
- %TEMP%\jrt\fwclsid.dat
- %TEMP%\jrt\ifeo.dat
- %TEMP%\jrt\erunt\erunt.loc
- %TEMP%\jrt\erunt\erdntwin.loc
- %TEMP%\jrt\erunt\erdntdos.loc
- %TEMP%\jrt\erunt\erdnt.e_e
- %TEMP%\jrt\wow6432node.dat
- %TEMP%\jrt\wget.dat
- %TEMP%\jrt\upgradecodes.dat
- %TEMP%\jrt\uninstall.dat
- %TEMP%\jrt\typelib_clsid.dat
- %TEMP%\jrt\tracing.dat
- %TEMP%\jrt\stats_clsid.dat
- %TEMP%\jrt\settings_clsid.dat
- %TEMP%\jrt\chr_extensions.cfg
- %TEMP%\jrt\services.dat
- %TEMP%\jrt\sed.dat
- %TEMP%\jrt\s1518components.dat
- %TEMP%\jrt\products.dat
- %TEMP%\jrt\preapproved_clsid.dat
- %TEMP%\jrt\notify.dat
- %TEMP%\jrt\nircmd.dat
- %TEMP%\jrt\moduleservices.dat
- %TEMP%\jrt\modules.dat
- %TEMP%\jrt\menuext.dat
- %TEMP%\jrt\interface_clsid.dat
- %TEMP%\jrt\appid_files.dat
- %TEMP%\jrt\appid_clsid.dat
- %TEMP%\jrt\serviceseventlog.cfg
- %TEMP%\jrt\appinit_null.reg
- %TEMP%\jrt\appinit64_null.reg
- %TEMP%\jrt\sednewline.txt
- %TEMP%\jrt\erunt\readme.txt
- %TEMP%\jrt\newmd5.txt
- %TEMP%\jrt\currentmd5.txt
- %TEMP%\jrt\clean_shortcut.vbs
- %TEMP%\jrt\tdl4.bat
- %TEMP%\jrt\searchlnk.bat
- %TEMP%\jrt\runvalues.bat
- %TEMP%\jrt\prelim.bat
- %TEMP%\jrt\misc.bat
- %TEMP%\jrt\medfos.bat
- %TEMP%\jrt\iexplore.bat
- %TEMP%\jrt\get.bat
- %TEMP%\jrt\fwpolicy.bat
- %TEMP%\jrt\firefox.bat
- %TEMP%\jrt\ev_clear.bat
- %TEMP%\jrt\delorphans.bat
- %TEMP%\jrt\delfolders.bat
- %TEMP%\jrt\chrome.bat
- %TEMP%\jrt\ask.bat
- %TEMP%\jrt\chr_open_x86.reg
- %TEMP%\jrt\datamngr_del.reg
- %TEMP%\jrt\chr_open_x64.reg
- %TEMP%\jrt\ff_open_x64.reg
- %TEMP%\jrt\runvalues_x86.cfg
- %TEMP%\jrt\ff_open_x86.reg
- %TEMP%\jrt\runvalues_x64.cfg
- %TEMP%\jrt\registryusersid.cfg
- %TEMP%\jrt\reghklm_software_classes.cfg
- %TEMP%\jrt\reghkcu_software_microsoft.cfg
- %TEMP%\jrt\reghkcu_software_appdatalow.cfg
- %TEMP%\jrt\reghkcu_and_hklm_software.cfg
- %TEMP%\jrt\reghkcu_and_hklm_allow.cfg
- %TEMP%\jrt\reghcr.cfg
- %TEMP%\jrt\iewhtlst.cfg
- %TEMP%\jrt\ffwhtlist.cfg
- %TEMP%\jrt\shortcut.dat
- %TEMP%\jrt\erunt\erunt.exe
- %TEMP%\jrt\chrregkey_x86.cfg
- %TEMP%\jrt\chrregkey_x64.cfg
- %TEMP%\jrt\browsermngr_values.cfg
- %TEMP%\jrt\browsermngr_keys.cfg
- %TEMP%\jrt\badvalues.cfg
- %TEMP%\jrt\badlnk.cfg
- %TEMP%\jrt\badfoldersstart.cfg
- %TEMP%\jrt\badfolderscom.cfg
- %TEMP%\jrt\badfolders.cfg
- %TEMP%\jrt\ie_open_x86.reg
- %TEMP%\jrt\ie_open_x64.reg
- %TEMP%\jrt\defaultscope.cfg
- nul
Deletes the following files
- %TEMP%\jrt\newmd5.txt
Substitutes the following files
- %TEMP%\jrt\newmd5.txt
Network activity
Connects to
- 'th###sudax.org':80
UDP
- DNS ASK google.com
- DNS ASK th###sudax.org
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: ''
Creates and executes the following
- '%TEMP%\jrt\nircmd.dat' killprocess reg.exe
- '%TEMP%\jrt\wget.dat' "http://th###sudax.org/downloads/md5/newmd5.txt"
- '%TEMP%\jrt\choice.dat' /c:yn /n "Update Now? [y,n] "
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\jrt\get.bat" "
- '%WINDIR%\syswow64\ping.exe' -n 1 www.google.com
- '%WINDIR%\syswow64\fc.exe' "%TEMP%\jrt\newmd5.txt" "%TEMP%\jrt\currentmd5.txt"
