Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\msecurity.lnk
Modifies file system
Creates the following files
- %TEMP%\rarsfx0\database.ini
- %TEMP%\rarsfx0\system.runtime.compilerservices.unsafe.dll
- %TEMP%\rarsfx0\system.security.principal.windows.dll
- %TEMP%\rarsfx0\system.serviceprocess.servicecontroller.dll
- %TEMP%\rarsfx0\system.text.encodings.web.dll
- %TEMP%\rarsfx0\service\system.threading.tasks.extensions.dll
- %TEMP%\rarsfx0\runtimes\win-x86\native\webview2loader.dll
- %TEMP%\rarsfx0\runtimes\win-arm64\native\webview2loader.dll
- %TEMP%\rarsfx0\runtimes\win-x64\native\webview2loader.dll
- %TEMP%\rarsfx0\winformanimation.dll
- %TEMP%\rarsfx0\inf\x64\msecantdrv.sys
- %TEMP%\rarsfx0\inf\x64\fsfilter.cat
- %TEMP%\rarsfx0\logo.ico
- %TEMP%\rarsfx0\msecuritylab.ico
- %TEMP%\rarsfx0\deviceid.windows.dll
- %TEMP%\rarsfx0\x86.lnk
- %TEMP%\rarsfx0\fonts\shannonstd-book.otf
- %TEMP%\rarsfx0\fonts\opensans-bold.ttf
- %TEMP%\rarsfx0\fonts\opensans-bolditalic.ttf
- %TEMP%\rarsfx0\fonts\opensans-extrabold.ttf
- %TEMP%\rarsfx0\fonts\opensans-extrabolditalic.ttf
- %TEMP%\rarsfx0\fonts\opensans-italic.ttf
- %TEMP%\rarsfx0\fonts\opensans-light.ttf
- %TEMP%\rarsfx0\fonts\opensans-lightitalic.ttf
- %TEMP%\rarsfx0\fonts\opensans-regular.ttf
- %TEMP%\rarsfx0\fonts\opensans-semibold.ttf
- %TEMP%\rarsfx0\fonts\opensans-semibolditalic.ttf
- %TEMP%\rarsfx0\yara.yar
- %TEMP%\rarsfx0\logopng.png
- %TEMP%\rarsfx0\system.numerics.vectors.dll
- %TEMP%\rarsfx0\service\system.runtime.compilerservices.unsafe.dll
- %TEMP%\rarsfx0\system.memory.dll
- %TEMP%\rarsfx0\system.diagnostics.eventlog.dll
- %TEMP%\rarsfx0\system.buffers.dll
- %TEMP%\rarsfx0\autoupdatertest.exe
- %TEMP%\rarsfx0\exit.exe
- %TEMP%\rarsfx0\msecurity pt.exe
- %TEMP%\rarsfx0\msecurity start.exe
- %TEMP%\rarsfx0\msecurity uinstall.exe
- %TEMP%\rarsfx0\msecuritylabant.exe
- %TEMP%\rarsfx0\service\msecurityservice.exe
- %TEMP%\rarsfx0\service\msecurityvulnerabilities.exe
- %TEMP%\rarsfx0\vc_redist.x64.exe
- %TEMP%\rarsfx0\service\aqua.dll
- %TEMP%\rarsfx0\service\aqua.newtonsoft.json.dll
- %TEMP%\rarsfx0\autoupdater.net.dll
- %TEMP%\rarsfx0\circularprogressbar.dll
- %HOMEPATH%\desktop\msecurity.lnk
- %TEMP%\rarsfx0\fonts\proxima-nova.otf
- %TEMP%\rarsfx0\deviceid.dll
- %TEMP%\rarsfx0\guna.ui2.dll
- %TEMP%\rarsfx0\libyara.net.dll
- %TEMP%\rarsfx0\service\libyara.net.dll
- %TEMP%\rarsfx0\loadingindicator.winforms.dll
- %TEMP%\rarsfx0\service\microsoft.bcl.asyncinterfaces.dll
- %TEMP%\rarsfx0\microsoft.visualbasic.powerpacks.vs.dll
- %TEMP%\rarsfx0\microsoft.web.webview2.core.dll
- %TEMP%\rarsfx0\microsoft.web.webview2.winforms.dll
- %TEMP%\rarsfx0\microsoft.web.webview2.wpf.dll
- %TEMP%\rarsfx0\service\newtonsoft.json.dll
- %TEMP%\rarsfx0\newtonsoft.json.dll
- %TEMP%\rarsfx0\service\remote.linq.dll
- %TEMP%\rarsfx0\service\remote.linq.newtonsoft.json.dll
- %TEMP%\rarsfx0\inf\x64\fsfilter.inf
- %TEMP%\rarsfx0\deviceid.windows.wmi.dll
- %APPDATA%\microsoft\windows\start menu\programs\msecurity.lnk
Miscellaneous
Searches for the following windows
- ClassName: 'EDIT' WindowName: ''
Creates and executes the following
- '%TEMP%\rarsfx0\msecurity pt.exe'
