Technical Information
Malicious functions
Executes the following
- '%WINDIR%\syswow64\taskkill.exe' /F /PID explorer.exe
Terminates or attempts to terminate
the following system processes:
- %WINDIR%\explorer.exe
Modifies file system
Creates the following files
- %TEMP%\rarsfx0\ms-dos.bat
- %TEMP%\rarsfx0\f11.vbs
- %TEMP%\rarsfx0\error.vbs
- %TEMP%\rarsfx0\colors.bat
- %TEMP%\rarsfx0\cleanmbr.exe
- %TEMP%\rarsfx0\c.vbs
- %TEMP%\rarsfx0\a.vbs
- %TEMP%\rarsfx0\0008.exe
- %TEMP%\rarsfx0\0007.exe
- %TEMP%\rarsfx0\0006.exe
- %TEMP%\rarsfx0\0005.exe
- %TEMP%\rarsfx0\0004.exe
- %TEMP%\rarsfx0\0003.exe
- %TEMP%\rarsfx0\0001.exe
- %TEMP%\rarsfx0\000.exe
- %TEMP%\rarsfx0\0000.exe
- %TEMP%\rarsfx0\w.vbs
- %TEMP%\rarsfx0\s.vbs
- %TEMP%\rarsfx0\music2.exe
- %TEMP%\rarsfx0\music1.exe
- %TEMP%\rarsfx0\j.vbs
- nul
Miscellaneous
Searches for the following windows
- ClassName: 'EDIT' WindowName: ''
- ClassName: '' WindowName: ''
Creates and executes the following
- '%WINDIR%\syswow64\wscript.exe' "%TEMP%\RarSFX0\f11.vbs"
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\RarSFX0\MS-DOS.bat" "
- '%WINDIR%\syswow64\chcp.com' 65001
- '%WINDIR%\syswow64\timeout.exe' 0 /nobreak
