Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'RichSunfire Control' = 'D:\RichSunfire_Control\setup.exe'
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\richsunfire control.lnk
Modifies file system
Creates the following files
- D:\richsunfire_control\setup.exe
- D:\richsunfire_control\richsunfire.fdb
- D:\richsunfire_control.fdb
- D:\richsunfire_control\control.exe
Deletes the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\richsunfire control.lnk
Network activity
Connects to
- 'localhost':2110
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: 'ÆóÒµÐÅÏ¢¼à ¿ГВ№ГњВјГ’ - ½¾Ñô°ì¹«ÈГВјГѕ - ¿Í»§¶Ë'
Creates and executes the following
- 'D:\richsunfire_control\setup.exe'
- 'D:\richsunfire_control\control.exe'
Executes the following
- '<SYSTEM32>\rundll32.exe' <SYSTEM32>\FirewallControlPanel.dll,ShowNotificationDialog /configure /ETOnly 0 /OnProfiles 6 /OtherAllowed 0 /OtherBlocked 0 /OtherEdgeAllowed 0 /NewBlocked 4 "<Full path to file>"
- '<SYSTEM32>\rundll32.exe' <SYSTEM32>\FirewallControlPanel.dll,ShowNotificationDialog /configure /ETOnly 0 /OnProfiles 6 /OtherAllowed 0 /OtherBlocked 0 /OtherEdgeAllowed 0 /NewBlocked 4 "D:\richsunfire_control\setup.exe...
