Technical Information
Malicious functions
Executes the following
- '<SYSTEM32>\taskkill.exe' /IM 360chromex.exe /T /F
- '<SYSTEM32>\taskkill.exe' /IM 360cse.exe /T /F
- '<SYSTEM32>\taskkill.exe' /IM 360se.exe /T /F
- '<SYSTEM32>\taskkill.exe' /IM BugReport.exe /T /F
- '<SYSTEM32>\taskkill.exe' /IM chrome.exe /T /F
- '<SYSTEM32>\taskkill.exe' /IM firefox.exe /T /F
- '<SYSTEM32>\taskkill.exe' /IM msedge.exe /T /F
- '<SYSTEM32>\taskkill.exe' /IM MicrosoftEdgeUpdate.exe /T /F
- '<SYSTEM32>\taskkill.exe' /IM QQBrowser.exe /T /F
- '<SYSTEM32>\taskkill.exe' /IM sesvc.exe /T /F
- '<SYSTEM32>\taskkill.exe' /IM sesvr.exe /T /F
- '<SYSTEM32>\taskkill.exe' /IM SogouExplorer.exe /T /F
- '<SYSTEM32>\taskkill.exe' /IM TsService.exe /T /F
Terminates or attempts to terminate
the following system processes:
- <SYSTEM32>\cmd.exe
the following user processes:
- firefox.exe
Modifies file system
Creates the following files
- %TEMP%\rarsfx0\bookmarksloader.exe
- %LOCALAPPDATA%\microsoft\edge\user data\default\local storage\leveldb\log
- %LOCALAPPDATA%\microsoft\edge\user data\default\local storage\leveldb\current
- %LOCALAPPDATA%\microsoft\edge\user data\default\local storage\leveldb\000003.log
- %LOCALAPPDATA%\microsoft\edge\user data\default\databases\databases.db
- %LOCALAPPDATA%\microsoft\edge\user data\default\secure preferences
- %LOCALAPPDATA%\microsoft\edge\user data\default\preferences
- %LOCALAPPDATA%\microsoft\edge\user data\default\edge profile.ico
- %LOCALAPPDATA%\microsoft\edge\user data\default\bookmarks
- %LOCALAPPDATA%\microsoft\edge\user data\variations
- %LOCALAPPDATA%\microsoft\edge\user data\local state
- %TEMP%\81ad.tmp\81bd.tmp\81ce.bat
- %LOCALAPPDATA%\microsoft\edge\user data\default\local storage\leveldb\log.old
- %TEMP%\rarsfx0\reg\edge.reg
- %TEMP%\rarsfx0\local\microsoft\edge\user data\default\edge profile.ico
- %TEMP%\rarsfx0\local\microsoft\edge\user data\default\databases\databases.db
- %TEMP%\rarsfx0\local\microsoft\edge\user data\variations
- %TEMP%\rarsfx0\local\microsoft\edge\user data\default\secure preferences
- %TEMP%\rarsfx0\local\microsoft\edge\user data\default\preferences
- %TEMP%\rarsfx0\local\microsoft\edge\user data\default\local storage\leveldb\manifest-000001
- %TEMP%\rarsfx0\local\microsoft\edge\user data\default\local storage\leveldb\log
- %TEMP%\rarsfx0\local\microsoft\edge\user data\local state
- %TEMP%\rarsfx0\local\microsoft\edge\user data\default\local storage\leveldb\current
- %TEMP%\rarsfx0\local\microsoft\edge\user data\default\bookmarks
- %TEMP%\rarsfx0\local\microsoft\edge\user data\default\local storage\leveldb\000003.log
- %TEMP%\rarsfx0\local\microsoft\edge\user data\default\local storage\leveldb\log.old
- %LOCALAPPDATA%\microsoft\edge\user data\default\local storage\leveldb\manifest-000001
Deletes the following files
- %TEMP%\rarsfx0\local\microsoft\edge\user data\default\bookmarks
- %TEMP%\rarsfx0\local\microsoft\edge\user data\default\databases\databases.db
- %TEMP%\rarsfx0\local\microsoft\edge\user data\default\local storage\leveldb\000003.log
- %TEMP%\rarsfx0\local\microsoft\edge\user data\default\local storage\leveldb\current
- %TEMP%\rarsfx0\local\microsoft\edge\user data\default\local storage\leveldb\log
- %TEMP%\rarsfx0\local\microsoft\edge\user data\default\local storage\leveldb\log.old
- %TEMP%\rarsfx0\local\microsoft\edge\user data\default\local storage\leveldb\manifest-000001
- %TEMP%\rarsfx0\local\microsoft\edge\user data\default\preferences
- %TEMP%\rarsfx0\local\microsoft\edge\user data\default\secure preferences
- %TEMP%\rarsfx0\local\microsoft\edge\user data\local state
- %TEMP%\rarsfx0\local\microsoft\edge\user data\variations
- %TEMP%\rarsfx0\reg\edge.reg
- %TEMP%\81ad.tmp\81bd.tmp\81ce.bat
- %TEMP%\rarsfx0\bookmarksloader.exe
Miscellaneous
Searches for the following windows
- ClassName: 'EDIT' WindowName: ''
- ClassName: '' WindowName: ''
- ClassName: 'RegEdit_RegEdit' WindowName: ''
Creates and executes the following
- '%TEMP%\rarsfx0\bookmarksloader.exe'
Executes the following
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\81AD.tmp\81BD.tmp\81CE.bat %TEMP%\RarSFX0\BookmarksLoader.exe"
- '<SYSTEM32>\chcp.com' 936
- '<SYSTEM32>\cmd.exe' /S /D /c" ver "
- '<SYSTEM32>\find.exe' "5.1."
- '<SYSTEM32>\attrib.exe' -r -s -h "%LOCALAPPDATA%" /D
- '<SYSTEM32>\xcopy.exe' /e /c /h /i /r /y "Local" "%LOCALAPPDATA%"
- '<SYSTEM32>\reg.exe' import reg\edge.reg
- '%WINDIR%\regedit.exe' /s reg\edge.reg
- '%TEMP%\rarsfx0\bookmarksloader.exe' ' (with hidden window)
