Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'WindowsServiceHost' = '%APPDATA%\RuntimeBroker.exe'
Modifies file system
Creates the following files
- %TEMP%\dbfca055d9844316bc75d4f65978dfba.exe
- %APPDATA%\runtimebroker.exe
- %LOCALAPPDATA%\microsoft\clr_v4.0_32\usagelogs\dbfca055d9844316bc75d4f65978dfba.exe.log
- %LOCALAPPDATA%\microsoft\clr_v4.0\usagelogs\<File name>.exe.log
- %TEMP%\ratagentlog.txt
Sets the 'hidden' attribute to the following files
- %APPDATA%\runtimebroker.exe
Deletes following files that it created itself
- %TEMP%\dbfca055d9844316bc75d4f65978dfba.exe
Network activity
Connects to
- '65.##9.125.86':5445
Miscellaneous
Creates and executes the following
- '%TEMP%\dbfca055d9844316bc75d4f65978dfba.exe'
- '%APPDATA%\runtimebroker.exe' --moved
