Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'Antimalware Service Executable.exe' = '"%ALLUSERSPROFILE%\Antimalware Service Executable.exe" ..'
- [HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'Antimalware Service Executable.exe' = '"%ALLUSERSPROFILE%\Antimalware Service Executable.exe" ..'
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\antimalware service executable.exe
- %APPDATA%\microsoft\windows\start menu\programs\startup\antimalware service executable.url
Creates the following files on removable media
- <Drive name for removable media>:\antimalware service executable.exe
Malicious functions
To complicate detection of its presence in the operating system,
adds antivirus exclusion:
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "Add-MpPreference -ExclusionPath 'C:\'"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "Add-MpPreference -ExclusionPath 'X:\'"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "Add-MpPreference -ExclusionPath 'W:\'"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "Add-MpPreference -ExclusionPath 'V:\'"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "Add-MpPreference -ExclusionPath 'U:\'"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "Add-MpPreference -ExclusionPath 'T:\'"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "Add-MpPreference -ExclusionPath 'S:\'"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "Add-MpPreference -ExclusionPath 'R:\'"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "Add-MpPreference -ExclusionPath 'Q:\'"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "Add-MpPreference -ExclusionPath 'P:\'"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "Add-MpPreference -ExclusionPath 'O:\'"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "Add-MpPreference -ExclusionPath 'N:\'"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "Add-MpPreference -ExclusionPath 'M:\'"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "Add-MpPreference -ExclusionPath 'L:\'"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "Add-MpPreference -ExclusionPath 'K:\'"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "Add-MpPreference -ExclusionPath 'J:\'"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "Add-MpPreference -ExclusionPath 'I:\'"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "Add-MpPreference -ExclusionPath 'H:\'"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "Add-MpPreference -ExclusionPath 'G:\'"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "Add-MpPreference -ExclusionPath '<Drive name for removable media>:\'"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "Add-MpPreference -ExclusionPath 'E:\'"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "Add-MpPreference -ExclusionPath 'D:\'"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "Add-MpPreference -ExclusionPath 'Y:\'"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -Command "Add-MpPreference -ExclusionPath 'Z:\'"
Executes the following
- '%WINDIR%\syswow64\taskkill.exe' /f im Antimalware Service Executable
Modifies file system
Creates the following files
- %TEMP%\rarsfx0\yandex.bat
- %TEMP%\rarsfx0\explorer.exe
- %TEMP%\rarsfx0\1.bat
- %TEMP%\rarsfx1\explorer.exe
- %TEMP%\rarsfx1\1.bat
- %TEMP%\rarsfx2\client.exe
- C:\antimalware service executable.exe
- D:\antimalware service executable.exe
- %ALLUSERSPROFILE%\antimalware service executable.exe
Sets the 'hidden' attribute to the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\antimalware service executable.exe
- %ALLUSERSPROFILE%\antimalware service executable.exe
Deletes the following files
- %TEMP%\rarsfx1\1.bat
- %TEMP%\rarsfx1\explorer.exe
- %TEMP%\rarsfx2\client.exe
Miscellaneous
Searches for the following windows
- ClassName: 'EDIT' WindowName: ''
Creates and executes the following
- '%TEMP%\rarsfx0\explorer.exe' -p4987
- '%TEMP%\rarsfx1\explorer.exe' -p9999
- '%TEMP%\rarsfx2\client.exe'
- '%ALLUSERSPROFILE%\antimalware service executable.exe'
Executes the following
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\RarSFX0\Yandex.bat" "
- '<SYSTEM32>\cmd.exe' /K "1.bat" -p4987
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\RarSFX1\1.bat" "
- '%WINDIR%\syswow64\cmd.exe' /C choice /C Y /N /D Y /T 5 & Del "%TEMP%\RarSFX2\Client.exe"
- '%WINDIR%\syswow64\choice.exe' /C Y /N /D Y /T 5
- '%WINDIR%\syswow64\schtasks.exe' /delete /tn "Antimalware Service Executable" /f
- '%WINDIR%\syswow64\schtasks.exe' /create /sc minute /mo 1 /tn "Antimalware Service Executable" /tr %ALLUSERSPROFILE%\Antimalware Service Executable.exe
- '%WINDIR%\syswow64\cmd.exe' /C choice /C Y /N /D Y /T 5 & Del "%TEMP%\RarSFX2\Client.exe"' (with hidden window)
- '%WINDIR%\syswow64\taskkill.exe' /f im Antimalware Service Executable' (with hidden window)
- '%WINDIR%\syswow64\schtasks.exe' /delete /tn "Antimalware Service Executable" /f' (with hidden window)
- '%WINDIR%\syswow64\schtasks.exe' /create /sc minute /mo 1 /tn "Antimalware Service Executable" /tr %ALLUSERSPROFILE%\Antimalware Service Executable.exe' (with hidden window)
