Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\'winrar'
Modifies file system
Creates the following files
- %TEMP%\winrar-x64-591esp.exe
- %TEMP%\winrar-x64-591es.exe
- %TEMP%\winrar.exe
- %TEMP%\tmp9359.tmp.bat
- nul
Network activity
TCP
- '20#.#7.156.108':9700
Miscellaneous
Searches for the following windows
- ClassName: 'EDIT' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
Creates and executes the following
- '%TEMP%\winrar-x64-591esp.exe'
- '%TEMP%\winrar-x64-591es.exe'
- '%TEMP%\winrar.exe'
- '<SYSTEM32>\schtasks.exe' /create /f /sc ONLOGON /RL HIGHEST /tn "'WinRAR"' /tr "'%TEMP%\WinRAR.exe"'' (with hidden window)
Executes the following
- '<SYSTEM32>\schtasks.exe' /create /f /sc ONLOGON /RL HIGHEST /tn "'WinRAR"' /tr "'%TEMP%\WinRAR.exe"'
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\tmp9359.tmp.bat""
- '<SYSTEM32>\timeout.exe' 3
