Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] 'LoadAppInit_DLLs' = '00000001'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] 'AppInit_DLLs' = 'C:\Users\Public\$77-771ca14c28d5467c9622cc6fe0782dd2-x64.dll'
Creates or modifies the following files
- <SYSTEM32>\tasks\audiohd
- <SYSTEM32>\tasks\esme
Malicious functions
Terminates or attempts to terminate
the following system processes:
- <SYSTEM32>\cmd.exe
Modifies file system
Creates the following files
- %TEMP%\rarsfx0\reference assemblies\64\tablet pc\v6.0\iawinfx.xml
- C:\users\public\$77p\esmerouter.exe
- C:\users\public\$77p\del.bat
- C:\users\public\$77p\command.vbs
- C:\users\public\$77p\command.bat
- C:\users\public\$77p\autoupdate.vbs
- %TEMP%\nsf4a9a.tmp\betternetforwindows.msi
- %TEMP%\nsf4a9a.tmp\system.dll
- %TEMP%\3d0c.tmp\3d0d.tmp\3d1e.bat
- %TEMP%\rarsfx0\reference assemblies\64\fsharp\.netframework\v4.0\4.3.0.0\type providers\task.vbs
- %TEMP%\rarsfx0\reference assemblies\64\fsharp\.netframework\v4.0\4.3.0.0\type providers\run.vbs
- %TEMP%\rarsfx0\reference assemblies\64\fsharp\.netframework\v4.0\4.3.0.0\type providers\nvrtc64.vbs
- %TEMP%\rarsfx0\reference assemblies\64\fsharp\.netframework\v4.0\4.3.0.0\type providers\import.vbs
- %TEMP%\rarsfx0\reference assemblies\64\fsharp\.netframework\v4.0\4.3.0.0\type providers\kernel\mon\$77p\command.vbs
- %TEMP%\rarsfx0\reference assemblies\64\fsharp\.netframework\v4.0\4.3.0.0\type providers\kernel\mon\$77p\autoupdate.vbs
- %TEMP%\rarsfx0\reference assemblies\64\fsharp\.netframework\v4.0\4.3.0.0\type providers\def.reg
- %TEMP%\rarsfx0\reference assemblies\64\fsharp\.netframework\v4.0\4.3.0.0\type providers\backup.reg
- %TEMP%\rarsfx0\setup.exe
- %TEMP%\rarsfx0\reference assemblies\64\wmi\v1.0\nt.exe
- %TEMP%\rarsfx0\reference assemblies\64\fsharp\.netframework\v4.0\4.3.0.0\type providers\kernel\mon\$77p\esmerouter.exe
- %TEMP%\rarsfx0\reference assemblies\64\fsharp\.netframework\v4.0\4.3.0.0\type providers\kernel\esme\esme.exe
- %TEMP%\rarsfx0\reference assemblies\64\fsharp\.netframework\v4.0\4.3.0.0\type providers\task.bat
- %TEMP%\rarsfx0\reference assemblies\64\fsharp\.netframework\v4.0\4.3.0.0\type providers\run.bat
- %TEMP%\rarsfx0\reference assemblies\64\fsharp\.netframework\v4.0\4.3.0.0\type providers\kernel\mon\$77p\run.bat
- %TEMP%\rarsfx0\reference assemblies\64\fsharp\.netframework\v4.0\4.3.0.0\type providers\nvrtc64.bat
- %TEMP%\rarsfx0\reference assemblies\64\fsharp\.netframework\v4.0\4.3.0.0\type providers\import.bat
- %TEMP%\rarsfx0\reference assemblies\64\fsharp\.netframework\v4.0\4.3.0.0\type providers\kernel\mon\$77p\del.bat
- %TEMP%\rarsfx0\reference assemblies\64\fsharp\.netframework\v4.0\4.3.0.0\type providers\kernel\mon\$77p\command.bat
- C:\users\public\$77p\run.bat
- C:\users\public\esme.exe
Deletes the following files
- %TEMP%\3d0c.tmp\3d0d.tmp\3d1e.bat
- %TEMP%\rarsfx0\setup.exe
Miscellaneous
Searches for the following windows
- ClassName: 'EDIT' WindowName: ''
Creates and executes the following
- '%TEMP%\rarsfx0\setup.exe'
- '%TEMP%\rarsfx0\reference assemblies\64\wmi\v1.0\nt.exe'
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\RarSFX0\Reference Assemblies\64\FSharp\.NETFramework\v4.0\4.3.0.0\Type Providers\run.bat" "' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\RarSFX0\Reference Assemblies\64\FSharp\.NETFramework\v4.0\4.3.0.0\Type Providers\nvrtc64.bat" "' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\RarSFX0\Reference Assemblies\64\FSharp\.NETFramework\v4.0\4.3.0.0\Type Providers\task.bat" "' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\RarSFX0\Reference Assemblies\64\FSharp\.NETFramework\v4.0\4.3.0.0\Type Providers\import.bat" "' (with hidden window)
Executes the following
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\3D0C.tmp\3D0D.tmp\3D1E.bat %TEMP%\RarSFX0\Setup.exe"
- '<SYSTEM32>\reg.exe' import "%TEMP%\RarSFX0\Reference Assemblies\64\FSharp\.NETFramework\v4.0\4.3.0.0\Type Providers\\def.reg"
- '<SYSTEM32>\schtasks.exe' /Create /SC ONLOGON /TN AudioHD /TR C:\Users\Public\$77p\esmeRouter.exe
- '<SYSTEM32>\reg.exe' import "%TEMP%\RarSFX0\Reference Assemblies\64\FSharp\.NETFramework\v4.0\4.3.0.0\Type Providers\\backup.reg"
- '<SYSTEM32>\xcopy.exe' /s /i "%TEMP%\RarSFX0\Reference Assemblies\64\FSharp\.NETFramework\v4.0\4.3.0.0\Type Providers\\Kernel\esme" "C:\Users\Public" /Y
- '<SYSTEM32>\xcopy.exe' /s /i "%TEMP%\RarSFX0\Reference Assemblies\64\FSharp\.NETFramework\v4.0\4.3.0.0\Type Providers\\Kernel\mon" "C:\Users\Public" /Y
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\RarSFX0\Reference Assemblies\64\FSharp\.NETFramework\v4.0\4.3.0.0\Type Providers\import.bat" "
- '<SYSTEM32>\reg.exe' import "%TEMP%\RarSFX0\Reference Assemblies\64\FSharp\.NETFramework\v4.0\4.3.0.0\Type Providers\\esme.reg"
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\RarSFX0\Reference Assemblies\64\FSharp\.NETFramework\v4.0\4.3.0.0\Type Providers\task.bat" "
- '<SYSTEM32>\wscript.exe' "%TEMP%\RarSFX0\Reference Assemblies\64\FSharp\.NETFramework\v4.0\4.3.0.0\Type Providers\task.vbs"
- '<SYSTEM32>\wscript.exe' "%TEMP%\RarSFX0\Reference Assemblies\64\FSharp\.NETFramework\v4.0\4.3.0.0\Type Providers\import.vbs"
- '<SYSTEM32>\wscript.exe' "%TEMP%\RarSFX0\Reference Assemblies\64\FSharp\.NETFramework\v4.0\4.3.0.0\Type Providers\nvrtc64.vbs"
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\RarSFX0\Reference Assemblies\64\FSharp\.NETFramework\v4.0\4.3.0.0\Type Providers\run.bat" "
- '%WINDIR%\syswow64\msiexec.exe' /I "%TEMP%\nsf4A9A.tmp\BetternetForWindows.msi"
- '<SYSTEM32>\wscript.exe' "%TEMP%\RarSFX0\Reference Assemblies\64\FSharp\.NETFramework\v4.0\4.3.0.0\Type Providers\run.vbs"
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\RarSFX0\Reference Assemblies\64\FSharp\.NETFramework\v4.0\4.3.0.0\Type Providers\nvrtc64.bat" "
- '<SYSTEM32>\schtasks.exe' /Create /SC ONLOGON /TN ESME /TR C:\Users\Public\esme.exe
