Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Classes\WinRAR.REV\shell\open\command] '' = '"%PROGRAM_FILES%\WinRAR\WinRAR.exe" "%1"'
- [<HKLM>\SOFTWARE\Classes\WinRAR.ZIP\shell\open\command] '' = '"%PROGRAM_FILES%\WinRAR\WinRAR.exe" "%1"'
- [<HKLM>\SOFTWARE\Classes\WinRAR\shell\open\command] '' = '"%PROGRAM_FILES%\WinRAR\WinRAR.exe" "%1"'
Malicious functions:
Creates and executes the following:
- %TEMP%\RarSFX0\Temi.exe
- %TEMP%\RarSFX0\Settings.exe
- %TEMP%\RarSFX0\Crack.exe
- %TEMP%\RarSFX0\wrar371it.exe /S
- %PROGRAM_FILES%\WinRAR\Uninstall.Exe /setup
Executes the following:
- %WINDIR%\regedit.exe /S Settings.reg
- <SYSTEM32>\cmd.exe /c ""%TEMP%\RarSFX1\install.cmd" "
Modifies file system :
Creates the following files:
- %HOMEPATH%\Dati applicazioni\WinRAR\Themes\Vista_Ultimate_48x48\RAR.ico
- %HOMEPATH%\Dati applicazioni\WinRAR\Themes\Vista_Ultimate_48x48\RARSmall.bmp
- %HOMEPATH%\Dati applicazioni\WinRAR\Themes\Vista_Ultimate_48x48\PasswordOn.ico
- %HOMEPATH%\Dati applicazioni\WinRAR\Themes\Vista_Ultimate_48x48\PasswordOff.ico
- %ALLUSERSPROFILE%\Start Menu\Programs\WinRAR\Manuale di RAR in modalita carattere.lnk
- %HOMEPATH%\Dati applicazioni\WinRAR\Themes\Vista_Ultimate_48x48\REV.ico
- %HOMEPATH%\Dati applicazioni\WinRAR\Themes\Vista_Ultimate_48x48\SortDown.bmp
- %HOMEPATH%\Dati applicazioni\WinRAR\Themes\Vista_Ultimate_48x48\SortUp.bmp
- %HOMEPATH%\Dati applicazioni\WinRAR\Themes\Vista_Ultimate_48x48\SFXLogo.bmp
- %HOMEPATH%\Dati applicazioni\WinRAR\Themes\Vista_Ultimate_48x48\Setup.ico
- %HOMEPATH%\Dati applicazioni\WinRAR\Themes\Vista_Ultimate_48x48\SFX.ico
- %ALLUSERSPROFILE%\Start Menu\Programs\WinRAR\Guida a WinRAR.lnk
- %HOMEPATH%\Dati applicazioni\WinRAR\Themes\Vista_Ultimate_48x48\DragCopy.cur
- %HOMEPATH%\Dati applicazioni\WinRAR\Themes\Vista_Ultimate_48x48\DragMove.cur
- %HOMEPATH%\Start Menu\Programs\WinRAR\Guida a WinRAR.lnk
- %HOMEPATH%\Dati applicazioni\WinRAR\Themes\Vista_Ultimate_48x48\DiskOff.ico
- %HOMEPATH%\Dati applicazioni\WinRAR\Themes\Vista_Ultimate_48x48\DiskOn.ico
- %HOMEPATH%\Start Menu\Programs\WinRAR\Manuale di RAR in modalita carattere.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\WinRAR\WinRAR.lnk
- %HOMEPATH%\Dati applicazioni\WinRAR\Themes\Vista_Ultimate_48x48\FolderUp.bmp
- %HOMEPATH%\Dati applicazioni\WinRAR\Themes\Vista_Ultimate_48x48\File.ico
- %HOMEPATH%\Dati applicazioni\WinRAR\Themes\Vista_Ultimate_48x48\DragNo.cur
- %HOMEPATH%\Dati applicazioni\WinRAR\Themes\Vista_Ultimate_48x48\Estimate.bmp
- %HOMEPATH%\Dati applicazioni\WinRAR\Themes\Vista_Ultimate_48x48\Toolbar\Add.bmp
- %HOMEPATH%\Dati applicazioni\WinRAR\Themes\Vista_Ultimate_48x48\Toolbar\Test.bmp
- %HOMEPATH%\Dati applicazioni\WinRAR\Themes\Vista_Ultimate_48x48\Toolbar\View.bmp
- %HOMEPATH%\Dati applicazioni\WinRAR\Themes\Vista_Ultimate_48x48\Toolbar\SFX.bmp
- %HOMEPATH%\Dati applicazioni\WinRAR\Themes\Vista_Ultimate_48x48\Toolbar\Repair.bmp
- %HOMEPATH%\Dati applicazioni\WinRAR\Themes\Vista_Ultimate_48x48\Toolbar\Report.bmp
- %HOMEPATH%\Dati applicazioni\WinRAR\Themes\Vista_Ultimate_48x48\Toolbar\VirusScan.bmp
- %TEMP%\RarSFX1\Install.cmd
- %TEMP%\RarSFX1\Settings.reg
- %HOMEPATH%\Dati applicazioni\WinRAR\Themes\Vista_Ultimate_48x48\WizardLogo.bmp
- %HOMEPATH%\Dati applicazioni\WinRAR\Themes\Vista_Ultimate_48x48\Toolbar\Wizard.bmp
- %HOMEPATH%\Dati applicazioni\WinRAR\Themes\Vista_Ultimate_48x48\WinRAR_theme_description.txt
- %HOMEPATH%\Dati applicazioni\WinRAR\Themes\Vista_Ultimate_48x48\Toolbar\Protect.bmp
- %HOMEPATH%\Dati applicazioni\WinRAR\Themes\Vista_Ultimate_48x48\Toolbar\Delete.bmp
- %HOMEPATH%\Dati applicazioni\WinRAR\Themes\Vista_Ultimate_48x48\Toolbar\Exit.bmp
- %HOMEPATH%\Dati applicazioni\WinRAR\Themes\Vista_Ultimate_48x48\Toolbar\Convert.bmp
- %HOMEPATH%\Dati applicazioni\WinRAR\Themes\Vista_Ultimate_48x48\Toolbar\Benchmark.bmp
- %HOMEPATH%\Dati applicazioni\WinRAR\Themes\Vista_Ultimate_48x48\Toolbar\Comment.bmp
- %HOMEPATH%\Dati applicazioni\WinRAR\Themes\Vista_Ultimate_48x48\Toolbar\Extract.bmp
- %HOMEPATH%\Dati applicazioni\WinRAR\Themes\Vista_Ultimate_48x48\Toolbar\Lock.bmp
- %HOMEPATH%\Dati applicazioni\WinRAR\Themes\Vista_Ultimate_48x48\Toolbar\Print.bmp
- %HOMEPATH%\Dati applicazioni\WinRAR\Themes\Vista_Ultimate_48x48\Toolbar\Info.bmp
- %HOMEPATH%\Dati applicazioni\WinRAR\Themes\Vista_Ultimate_48x48\Toolbar\ExtractTo.bmp
- %HOMEPATH%\Dati applicazioni\WinRAR\Themes\Vista_Ultimate_48x48\Toolbar\Find.bmp
- %PROGRAM_FILES%\WinRAR\Ordina.htm
- %PROGRAM_FILES%\WinRAR\RarFiles.Lst
- %PROGRAM_FILES%\WinRAR\Ordin.htm
- %PROGRAM_FILES%\WinRAR\Rar.Txt
- %PROGRAM_FILES%\WinRAR\SorgUnRAR.Txt
- %PROGRAM_FILES%\WinRAR\Uninstall.Lst
- %PROGRAM_FILES%\WinRAR\UnRAR.exe
- %PROGRAM_FILES%\WinRAR\WinRAR.exe
- %PROGRAM_FILES%\WinRAR\Uninstall.Exe
- %PROGRAM_FILES%\WinRAR\RAR.exe
- %PROGRAM_FILES%\WinRAR\RarExtLoader.exe
- %PROGRAM_FILES%\WinRAR\Novita.Txt
- %TEMP%\RarSFX0\Temi.exe
- %PROGRAM_FILES%\WinRAR\File_Id.Diz
- %TEMP%\RarSFX0\Settings.exe
- %TEMP%\RarSFX0\wrar371it.exe
- %TEMP%\RarSFX0\Crack.exe
- %PROGRAM_FILES%\WinRAR\Formats\Descript.ion
- %PROGRAM_FILES%\WinRAR\Licenza.Txt
- %PROGRAM_FILES%\WinRAR\NoteTecniche.Txt
- %PROGRAM_FILES%\WinRAR\Leggimi_1a.Txt
- %PROGRAM_FILES%\WinRAR\Descript.ion
- %PROGRAM_FILES%\WinRAR\Leggimi.Txt
- %PROGRAM_FILES%\WinRAR\Formats\7zxa.dll
- %PROGRAM_FILES%\WinRAR\Default.SFX
- %PROGRAM_FILES%\WinRAR\WinCon.SFX
- %PROGRAM_FILES%\WinRAR\Formats\z.fmt
- %PROGRAM_FILES%\WinRAR\Formats\tar.fmt
- %PROGRAM_FILES%\WinRAR\Formats\uue.fmt
- %PROGRAM_FILES%\WinRAR\ZIP.SFX
- %HOMEPATH%\Start Menu\Programs\WinRAR\WinRAR.lnk
- %HOMEPATH%\Dati applicazioni\WinRAR\Themes\Vista_Ultimate_48x48\AboutLogo.bmp
- %PROGRAM_FILES%\WinRAR\rarreg.key
- %PROGRAM_FILES%\WinRAR\rarnew.dat
- %PROGRAM_FILES%\WinRAR\zipnew.dat
- %PROGRAM_FILES%\WinRAR\Formats\lzh.fmt
- %PROGRAM_FILES%\WinRAR\winrar.chm
- %PROGRAM_FILES%\WinRAR\Formats\7z.fmt
- %PROGRAM_FILES%\WinRAR\Formats\UNACEV2.DLL
- %PROGRAM_FILES%\WinRAR\RarExt.dll
- %PROGRAM_FILES%\WinRAR\RarExt64.dll
- %PROGRAM_FILES%\WinRAR\Formats\ace.fmt
- %PROGRAM_FILES%\WinRAR\Formats\gz.fmt
- %PROGRAM_FILES%\WinRAR\Formats\iso.fmt
- %PROGRAM_FILES%\WinRAR\Formats\cab.fmt
- %PROGRAM_FILES%\WinRAR\Formats\arj.fmt
- %PROGRAM_FILES%\WinRAR\Formats\bz2.fmt
Sets the 'hidden' attribute to the following files:
- %PROGRAM_FILES%\WinRAR\Descript.ion
- %PROGRAM_FILES%\WinRAR\Formats\Descript.ion
Deletes the following files:
- %TEMP%\RarSFX0\Settings.exe
- %TEMP%\RarSFX0\Temi.exe
- %TEMP%\RarSFX0\wrar371it.exe
- %TEMP%\RarSFX1\Install.cmd
- %TEMP%\RarSFX1\Settings.reg
- %TEMP%\RarSFX0\Crack.exe
Miscellaneous:
Searches for the following windows:
- ClassName: 'RegEdit_RegEdit' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'EDIT' WindowName: ''