Win32.HLLW.Autoruner2.34267

Technical Information

To ensure autorun and distribution:

Creates the following files on removable media:

<Drive name for removable media>:\RoboForm\AiRoboForm-Portable.bin
<Drive name for removable media>:\PortableRoboForm.exe
<Drive name for removable media>:\AutoRun.inf
<Drive name for removable media>:\My RoboForm Data\Default Profile\license.rfo
<Drive name for removable media>:\RoboForm\_x.xxx
<Drive name for removable media>:\_x.xxx
<Drive name for removable media>:\My RoboForm Data\Default Profile\options.rfo
<Drive name for removable media>:\My RoboForm Data\Default Profile\RoboFormDataHere.txt

Malicious functions:

Executes the following:

'%ProgramFiles%\Internet Explorer\IEXPLORE.EXE' http://www.ro###orm.com/test-pass.html?aa########################################################################################################################################################...

Modifies file system:

Creates the following files:

%TEMP%\RoboForm\license-cn.txt
%TEMP%\RoboForm\br-Brasilian.rfi
%TEMP%\RoboForm\license-cz.txt
%TEMP%\RoboForm\cn-Chinese.rfi
%TEMP%\RoboForm\license-br.txt
%TEMP%\RoboForm\en-english.rfi
%TEMP%\RoboForm\license-en.txt
%TEMP%\RoboForm\ar-Arabic.rfi
%TEMP%\RoboForm\license-ar.txt
%TEMP%\RoboForm\es-Spanish.rfi
%TEMP%\RoboForm\license-es.txt
%TEMP%\RoboForm\fi-Finnish.rfi
%TEMP%\RoboForm\license-fi.txt
%TEMP%\RoboForm\dk-Danish.rfi
%TEMP%\RoboForm\license-de.txt
%TEMP%\RoboForm\cz-Czech.rfi
%TEMP%\RoboForm\license-dk.txt
%TEMP%\RoboForm\de-German.rfi
%TEMP%\RoboForm\Firefox\components\rfproxy_31.dll
%TEMP%\RoboForm\robotaskbaricon.exe
%TEMP%\RoboForm\roboform.dll
%TEMP%\RoboForm\safenotes.exe
%TEMP%\RoboForm\identities.exe
%TEMP%\RoboForm\install.bmp
%TEMP%\affid.txt
%TEMP%\roboform.dll
%TEMP%\RoboForm\rfwipeout.exe
%TEMP%\options.rfo
%TEMP%\RoboForm\Firefox\chrome\roboform.jar
%TEMP%\RoboForm\Firefox\chrome.manifest
%TEMP%\RoboForm\Firefox\components\rfhelper.js
%TEMP%\RoboForm\Firefox\components\rfproxy_31.xpt
%TEMP%\RoboForm\Firefox\install.rdf
%TEMP%\RoboForm\passwordgenerator.exe
%TEMP%\RoboForm\passcards.exe
%TEMP%\RoboForm\rfmozhlp.dll
%TEMP%\RoboForm\dndhandle.gif
%TEMP%\RoboForm\sc-Serbian.rfi
%TEMP%\RoboForm\license-sc.txt
%TEMP%\RoboForm\se-Swedish.rfi
%TEMP%\RoboForm\license-se.txt
%TEMP%\RoboForm\sb-Serbian.rfi
%TEMP%\RoboForm\license-ru.txt
%TEMP%\RoboForm\pl-Polish.rfi
%TEMP%\RoboForm\license-sb.txt
%TEMP%\RoboForm\ru-Russian.rfi
%TEMP%\RoboForm\zh-Chinese.rfi
%TEMP%\RoboForm\license-zh.txt
%TEMP%\RoboForm\PortableRoboForm.exe
%TEMP%\RoboForm\affid.txt
%TEMP%\RoboForm\ua-Ukrainian.rfi
%TEMP%\RoboForm\license-tr.txt
%TEMP%\RoboForm\sk-Slovak.rfi
%TEMP%\RoboForm\license-ua.txt
%TEMP%\RoboForm\tr-Turkish.rfi
%TEMP%\RoboForm\license-pl.txt
%TEMP%\RoboForm\hu-Hungarian.rfi
%TEMP%\RoboForm\hr-Croatian.rfi
%TEMP%\RoboForm\it-Italian.rfi
%TEMP%\RoboForm\license-it.txt
%TEMP%\RoboForm\license-hr.txt
%TEMP%\RoboForm\fr-French.rfi
%TEMP%\RoboForm\license-fr.txt
%TEMP%\RoboForm\he-Hebrew.rfi
%TEMP%\RoboForm\license-he.txt
%TEMP%\RoboForm\license-nl.txt
%TEMP%\RoboForm\lt-Lithuanian.rfi
%TEMP%\RoboForm\no-Norwegian.rfi
%TEMP%\RoboForm\nl-Dutch.rfi
%TEMP%\RoboForm\license-lt.txt
%TEMP%\RoboForm\jp-Japanese.rfi
%TEMP%\RoboForm\license-jp.txt
%TEMP%\RoboForm\kr-Korean.rfi
%TEMP%\RoboForm\license-kr.txt
%TEMP%\RFS313.tmp\license-cn.txt
%TEMP%\RFS313.tmp\br-Brasilian.rfi
%TEMP%\RFS313.tmp\license-cz.txt
%TEMP%\RFS313.tmp\cn-Chinese.rfi
%TEMP%\RFS313.tmp\license-br.txt
%TEMP%\RFS313.tmp\en-english.rfi
%TEMP%\RFS313.tmp\license-en.txt
%TEMP%\RFS313.tmp\ar-Arabic.rfi
%TEMP%\RFS313.tmp\license-ar.txt
%TEMP%\RFS313.tmp\es-Spanish.rfi
%TEMP%\RFS313.tmp\license-es.txt
%TEMP%\RFS313.tmp\fi-Finnish.rfi
%TEMP%\RFS313.tmp\license-fi.txt
%TEMP%\RFS313.tmp\dk-Danish.rfi
%TEMP%\RFS313.tmp\license-de.txt
%TEMP%\RFS313.tmp\cz-Czech.rfi
%TEMP%\RFS313.tmp\license-dk.txt
%TEMP%\RFS313.tmp\de-German.rfi
%TEMP%\RFS313.tmp\Firefox\components\rfproxy_31.dll
%TEMP%\RFS313.tmp\robotaskbaricon.exe
%TEMP%\RFS313.tmp\roboform.dll
%TEMP%\RFS313.tmp\safenotes.exe
%TEMP%\RFS313.tmp\identities.exe
%TEMP%\RFS313.tmp\install.bmp
<Current directory>\AiRoboForm-Portable-roma1.exe
%TEMP%\aut1.tmp
%TEMP%\RFS313.tmp\rfwipeout.exe
%TEMP%\_rf.log
%TEMP%\RFS313.tmp\Firefox\chrome\roboform.jar
%TEMP%\RFS313.tmp\Firefox\chrome.manifest
%TEMP%\RFS313.tmp\Firefox\components\rfhelper.js
%TEMP%\RFS313.tmp\Firefox\components\rfproxy_31.xpt
%TEMP%\RFS313.tmp\Firefox\install.rdf
%TEMP%\RFS313.tmp\passwordgenerator.exe
%TEMP%\RFS313.tmp\passcards.exe
%TEMP%\RFS313.tmp\rfmozhlp.dll
%TEMP%\RFS313.tmp\dndhandle.gif
%TEMP%\RFS313.tmp\sc-Serbian.rfi
%TEMP%\RFS313.tmp\license-sc.txt
%TEMP%\RFS313.tmp\se-Swedish.rfi
%TEMP%\RFS313.tmp\license-se.txt
%TEMP%\RFS313.tmp\sb-Serbian.rfi
%TEMP%\RFS313.tmp\license-ru.txt
%TEMP%\RFS313.tmp\pl-Polish.rfi
%TEMP%\RFS313.tmp\license-sb.txt
%TEMP%\RFS313.tmp\ru-Russian.rfi
%TEMP%\RFS313.tmp\zh-Chinese.rfi
%TEMP%\RFS313.tmp\license-zh.txt
%TEMP%\identities.exe
%TEMP%\RFS313.tmp\affid.txt
%TEMP%\RFS313.tmp\ua-Ukrainian.rfi
%TEMP%\RFS313.tmp\license-tr.txt
%TEMP%\RFS313.tmp\sk-Slovak.rfi
%TEMP%\RFS313.tmp\license-ua.txt
%TEMP%\RFS313.tmp\tr-Turkish.rfi
%TEMP%\RFS313.tmp\license-pl.txt
%TEMP%\RFS313.tmp\hu-Hungarian.rfi
%TEMP%\RFS313.tmp\hr-Croatian.rfi
%TEMP%\RFS313.tmp\it-Italian.rfi
%TEMP%\RFS313.tmp\license-it.txt
%TEMP%\RFS313.tmp\license-hr.txt
%TEMP%\RFS313.tmp\fr-French.rfi
%TEMP%\RFS313.tmp\license-fr.txt
%TEMP%\RFS313.tmp\he-Hebrew.rfi
%TEMP%\RFS313.tmp\license-he.txt
%TEMP%\RFS313.tmp\license-nl.txt
%TEMP%\RFS313.tmp\lt-Lithuanian.rfi
%TEMP%\RFS313.tmp\no-Norwegian.rfi
%TEMP%\RFS313.tmp\nl-Dutch.rfi
%TEMP%\RFS313.tmp\license-lt.txt
%TEMP%\RFS313.tmp\jp-Japanese.rfi
%TEMP%\RFS313.tmp\license-jp.txt
%TEMP%\RFS313.tmp\kr-Korean.rfi
%TEMP%\RFS313.tmp\license-kr.txt

Deletes the following files:

%TEMP%\RFS313.tmp\license-se.txt
%TEMP%\RFS313.tmp\license-tr.txt
%TEMP%\RFS313.tmp\license-sb.txt
%TEMP%\RFS313.tmp\license-sc.txt
%TEMP%\RFS313.tmp\license-ua.txt
%TEMP%\RFS313.tmp\nl-Dutch.rfi
%TEMP%\RFS313.tmp\no-Norwegian.rfi
%TEMP%\RFS313.tmp\license-zh.txt
%TEMP%\RFS313.tmp\lt-Lithuanian.rfi
%TEMP%\RFS313.tmp\license-ru.txt
%TEMP%\RFS313.tmp\license-hr.txt
%TEMP%\RFS313.tmp\license-it.txt
%TEMP%\RFS313.tmp\license-fr.txt
%TEMP%\RFS313.tmp\license-he.txt
%TEMP%\RFS313.tmp\license-jp.txt
%TEMP%\RFS313.tmp\license-nl.txt
%TEMP%\RFS313.tmp\license-pl.txt
%TEMP%\RFS313.tmp\license-kr.txt
%TEMP%\RFS313.tmp\license-lt.txt
%TEMP%\RFS313.tmp\sk-Slovak.rfi
%TEMP%\RFS313.tmp\tr-Turkish.rfi
%TEMP%\RFS313.tmp\sc-Serbian.rfi
%TEMP%\RFS313.tmp\se-Swedish.rfi
%TEMP%\RFS313.tmp\ua-Ukrainian.rfi
%TEMP%\roboform.dll
%TEMP%\affid.txt
%TEMP%\RFS313.tmp\zh-Chinese.rfi
%TEMP%\identities.exe
%TEMP%\RFS313.tmp\sb-Serbian.rfi
%TEMP%\RFS313.tmp\pl-Polish.rfi
%TEMP%\RFS313.tmp\rfmozhlp.dll
%TEMP%\RFS313.tmp\passcards.exe
%TEMP%\RFS313.tmp\passwordgenerator.exe
%TEMP%\RFS313.tmp\rfwipeout.exe
%TEMP%\RFS313.tmp\ru-Russian.rfi
%TEMP%\RFS313.tmp\safenotes.exe
%TEMP%\RFS313.tmp\roboform.dll
%TEMP%\RFS313.tmp\robotaskbaricon.exe
%TEMP%\RFS313.tmp\es-Spanish.rfi
%TEMP%\RFS313.tmp\fi-Finnish.rfi
%TEMP%\RFS313.tmp\dndhandle.gif
%TEMP%\RFS313.tmp\en-english.rfi
%TEMP%\RFS313.tmp\Firefox\chrome\roboform.jar
%TEMP%\RFS313.tmp\Firefox\components\rfproxy_31.dll
%TEMP%\RFS313.tmp\Firefox\components\rfproxy_31.xpt
%TEMP%\RFS313.tmp\Firefox\chrome.manifest
%TEMP%\RFS313.tmp\Firefox\components\rfhelper.js
%TEMP%\RFS313.tmp\dk-Danish.rfi
<Drive name for removable media>:\RoboForm\_x.xxx
%TEMP%\RFS313.tmp\affid.txt
%TEMP%\aut1.tmp
<Drive name for removable media>:\_x.xxx
%TEMP%\RFS313.tmp\ar-Arabic.rfi
%TEMP%\RFS313.tmp\cz-Czech.rfi
%TEMP%\RFS313.tmp\de-German.rfi
%TEMP%\RFS313.tmp\br-Brasilian.rfi
%TEMP%\RFS313.tmp\cn-Chinese.rfi
%TEMP%\RFS313.tmp\license-cn.txt
%TEMP%\RFS313.tmp\license-cz.txt
%TEMP%\RFS313.tmp\license-ar.txt
%TEMP%\RFS313.tmp\license-br.txt
%TEMP%\RFS313.tmp\license-de.txt
%TEMP%\RFS313.tmp\license-es.txt
%TEMP%\RFS313.tmp\license-fi.txt
%TEMP%\RFS313.tmp\license-dk.txt
%TEMP%\RFS313.tmp\license-en.txt
%TEMP%\RFS313.tmp\kr-Korean.rfi
%TEMP%\RFS313.tmp\he-Hebrew.rfi
%TEMP%\RFS313.tmp\hr-Croatian.rfi
%TEMP%\RFS313.tmp\Firefox\install.rdf
%TEMP%\RFS313.tmp\fr-French.rfi
%TEMP%\RFS313.tmp\hu-Hungarian.rfi
%TEMP%\RFS313.tmp\it-Italian.rfi
%TEMP%\RFS313.tmp\jp-Japanese.rfi
%TEMP%\RFS313.tmp\identities.exe
%TEMP%\RFS313.tmp\install.bmp

Network activity:

Connects to:

'ro###orm.com':80
'localhost':1039

TCP:

HTTP GET requests:

http://www.ro###orm.com/test-pass.html?aa########################################################################################################################################################...

UDP:

DNS ASK www.ro###orm.com

Miscellaneous:

Searches for the following windows:

ClassName: 'Afx3145017' WindowName: ''
ClassName: 'YbrTabHost class' WindowName: ''
ClassName: 'MS_WebcheckMonitor' WindowName: ''
ClassName: '' WindowName: ''
ClassName: 'MS_AutodialMonitor' WindowName: ''

Creates and executes the following:

'<Drive name for removable media>:\PortableRoboForm.exe'
'%TEMP%\RoboForm\robotaskbaricon.exe'
'%TEMP%\RoboForm\passcards.exe' -bc
'<Current directory>\AiRoboForm-Portable-roma1.exe'
'%TEMP%\RFS313.tmp\rfwipeout.exe' pp
'%TEMP%\identities.exe' -fp

Technologies

Terminology

Training and education

Myths

Technical Information