Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\antimalware
Modifies file system
Creates the following files
- %TEMP%\ef6d.tmp\ef7d.tmp\ef7e.bat
- %APPDATA%\ark.exe
- %TEMP%\rarsfx0\1.com
- %TEMP%\rarsfx0\2.com
- %APPDATA%\antimalware.exe
- %TEMP%\tmp4bce.tmp.bat
- nul
Network activity
Connects to
- '45.#4.1.78':7779
TCP
- 'pa###bin.com':443
UDP
- DNS ASK pa###bin.com
Miscellaneous
Searches for the following windows
- ClassName: 'EDIT' WindowName: ''
Creates and executes the following
- '%APPDATA%\ark.exe' -pwa7g48wa4/gw8a4gw84gw8wa7g48wa4/gw8a4gw84gw8
- '%TEMP%\rarsfx0\2.com'
- '%TEMP%\rarsfx0\1.com'
- '%APPDATA%\antimalware.exe'
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\EF6D.tmp\EF7D.tmp\EF7E.bat <Full path to file>"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c schtasks /create /f /sc onlogon /rl highest /tn "Antimalware" /tr '"%APPDATA%\Antimalware.exe"' & exit' (with hidden window)
Executes the following
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\EF6D.tmp\EF7D.tmp\EF7E.bat <Full path to file>"
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath C:\
- '%WINDIR%\syswow64\cmd.exe' /c schtasks /create /f /sc onlogon /rl highest /tn "Antimalware" /tr '"%APPDATA%\Antimalware.exe"' & exit
- '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\tmp4BCE.tmp.bat""
- '%WINDIR%\syswow64\schtasks.exe' /create /f /sc onlogon /rl highest /tn "Antimalware" /tr '"%APPDATA%\Antimalware.exe"'
- '%WINDIR%\syswow64\timeout.exe' 3
