Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\Software\Classes\uTorrent\shell\open\command] '' = '"%TEMP%\RarSFX0\uTorrent.exe" "%1" /SHELLASSOC'
- [<HKCU>\Software\Classes\Magnet\shell\open\command] '' = '"%TEMP%\RarSFX0\uTorrent.exe" "%1" /SHELLASSOC'
- [<HKCU>\Software\Classes\bittorrent\shell\open\command] '' = '"%TEMP%\RarSFX0\uTorrent.exe" "%1" /SHELLASSOC'
Modifies file system
Creates the following files
- %TEMP%\rarsfx0\settings.dat
- %TEMP%\rarsfx0\updates\3.5.0_43804\utorrentie.exe
- %TEMP%\rarsfx0\updates\3.5.0_43804.exe
- %TEMP%\rarsfx0\updates\3.5.0_43916\utorrentie.exe
- %TEMP%\rarsfx0\updates\3.5.0_43916.exe
- %TEMP%\rarsfx0\updates\3.5.1_44332.exe
- %TEMP%\rarsfx0\43388-utorrent.6cf6.dmp
- %TEMP%\rarsfx0\dht.dat
- %TEMP%\rarsfx0\dht_feed.dat
- %TEMP%\rarsfx0\info.nfo
- %TEMP%\rarsfx0\resume.dat
- %TEMP%\rarsfx0\rss.dat
- %TEMP%\utt1a9e.tmp
- %APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\1f91d2d17ea675d4c2c3192e241743f9_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
- %APPDATA%\microsoft\windows\cookies\user@localhost[1].txt
- %TEMP%\rarsfx0\settings.dat.new
- %TEMP%\utt50e2.tmp
- <LS_APPDATA>low\utorrent\utorrent_2124_02787bf8_730418611
- <LS_APPDATA>\microsoft\windows\<INETFILES>\low\desktop.ini
- <LS_APPDATA>\microsoft\windows\<INETFILES>\low\content.ie5\desktop.ini
- <LS_APPDATA>\microsoft\windows\history\low\desktop.ini
- <LS_APPDATA>\microsoft\windows\history\low\history.ie5\desktop.ini
- <LS_APPDATA>\microsoft\windows\<INETFILES>\low\content.ie5\index.dat
- <LS_APPDATA>\microsoft\windows\<INETFILES>\low\content.ie5\i9p7kfp0\desktop.ini
- <LS_APPDATA>\microsoft\windows\<INETFILES>\low\content.ie5\to7vu44d\desktop.ini
- <LS_APPDATA>\microsoft\windows\<INETFILES>\low\content.ie5\2zzj38kz\desktop.ini
- <LS_APPDATA>\microsoft\windows\<INETFILES>\low\content.ie5\pk9km63x\desktop.ini
- %APPDATA%\microsoft\windows\cookies\low\index.dat
- <LS_APPDATA>\microsoft\windows\history\low\history.ie5\index.dat
- %APPDATA%\microsoft\windows\ietldcache\low\index.dat
- %TEMP%\rarsfx0\updates\3.5.0_43580.exe
- <LS_APPDATA>low\utorrent\utorrent_2124_02787b60_1896432535
- %TEMP%\rarsfx0\updates\3.5.0_43580\utorrentie.exe
- %TEMP%\rarsfx0\updates\3.4.9_43388\utorrentie.exe
- %TEMP%\rarsfx0\settings.dat.old
- %TEMP%\rarsfx0\updates.dat
- %TEMP%\rarsfx0\utorrent.exe
- %TEMP%\rarsfx0\utorrent.lng
- %TEMP%\rarsfx0\utorrent-343-39944.chm
- %TEMP%\rarsfx0\utorrent-help.zip
- %TEMP%\rarsfx0\windows 7 edition intГ©grale fr (boite) + crack d'activation.torrent
- %TEMP%\rarsfx0\windows 8 pro x86.torrent
- %TEMP%\rarsfx0\windows 8.1 pro (x86).torrent
- %TEMP%\rarsfx0\apps\72f0d3e2141065dacf6134d07a06a2df20590748\btapp
- %TEMP%\rarsfx0\apps\72f0d3e2141065dacf6134d07a06a2df20590748\icon.bmp
- %TEMP%\rarsfx0\apps\72f0d3e2141065dacf6134d07a06a2df20590748\index.html
- %TEMP%\rarsfx0\apps\72f0d3e2141065dacf6134d07a06a2df20590748\index.js
- %TEMP%\rarsfx0\apps\72f0d3e2141065dacf6134d07a06a2df20590748\main.css
- %TEMP%\rarsfx0\apps\d944b3378fab35793b7951fa53e41b2ab9cc462b\btapp
- %TEMP%\rarsfx0\apps\d944b3378fab35793b7951fa53e41b2ab9cc462b\empty_movie.gif
- %TEMP%\rarsfx0\apps\d944b3378fab35793b7951fa53e41b2ab9cc462b\index.html
- %TEMP%\rarsfx0\apps\d944b3378fab35793b7951fa53e41b2ab9cc462b\info_icon.png
- %TEMP%\rarsfx0\apps\d944b3378fab35793b7951fa53e41b2ab9cc462b\main.css
- %TEMP%\rarsfx0\apps\d944b3378fab35793b7951fa53e41b2ab9cc462b\vid_thumb.jpg
- %TEMP%\rarsfx0\apps\d944b3378fab35793b7951fa53e41b2ab9cc462b\x.png
- %TEMP%\rarsfx0\apps\featuredcontent.btapp
- %TEMP%\rarsfx0\apps\player.btapp
- %TEMP%\rarsfx0\apps\plus.btapp
- %TEMP%\rarsfx0\apps\welcome-upsell.btapp
- %TEMP%\rarsfx0\dlimagecache\10e6fbe4d921b475fa5fec6e9a535a540d6feed1
- %TEMP%\rarsfx0\dlimagecache\165f6ef40a81dd175ffaea69e77abfd30b27e71c
- %TEMP%\rarsfx0\updates\3.4.3_39944.exe
- %TEMP%\rarsfx0\updates\3.4.9_43295.exe
- %TEMP%\rarsfx0\updates\3.4.9_43388.exe
- %TEMP%\rarsfx0\maindoc.ico
Sets the 'hidden' attribute to the following files
- <LS_APPDATA>\microsoft\windows\<INETFILES>\low\desktop.ini
- <LS_APPDATA>\microsoft\windows\<INETFILES>\low\content.ie5\desktop.ini
- <LS_APPDATA>\microsoft\windows\<INETFILES>\low\content.ie5\i9p7kfp0\desktop.ini
- <LS_APPDATA>\microsoft\windows\<INETFILES>\low\content.ie5\to7vu44d\desktop.ini
- <LS_APPDATA>\microsoft\windows\<INETFILES>\low\content.ie5\2zzj38kz\desktop.ini
- <LS_APPDATA>\microsoft\windows\<INETFILES>\low\content.ie5\pk9km63x\desktop.ini
- <LS_APPDATA>\microsoft\windows\history\low\history.ie5\desktop.ini
- <LS_APPDATA>\microsoft\windows\history\low\desktop.ini
Deletes the following files
- %TEMP%\utt1a9e.tmp
- %TEMP%\rarsfx0\updates\3.5.0_43916.exe
- %TEMP%\utt50e2.tmp
Moves the following files
- from %TEMP%\rarsfx0\settings.dat to %TEMP%\rarsfx0\settings.dat.old
Substitutes the following files
- %TEMP%\rarsfx0\settings.dat
- %TEMP%\rarsfx0\settings.dat.new
- %TEMP%\rarsfx0\updates\3.5.0_43916.exe
Network activity
UDP
- DNS ASK ro####.bittorrent.com
- DNS ASK up####.bittorrent.com
- DNS ASK fr#####tracker.h33t.com
- DNS ASK cd#.##.bittorrent.com
- DNS ASK tr#####.coppersurfer.tk
- DNS ASK up####.utorrent.li
- DNS ASK ro####.utorrent.com
- DNS ASK i-##.#####16.ut.bench.utorrent.com
- DNS ASK cd#.###medianetwork.com
- '<LOCALNET>.91.9':60848
- '<LOCALNET>.91.1':5351
- '23#.#92.152.143':6771
- 'localhost':60848
- '23#.#55.255.250':1900
- '<LOCALNET>.1.10':60848
- '15#.#5.216.236':1113
- '82.##6.164.115':60848
- '<LOCALNET>.56.1':60848
Miscellaneous
Searches for the following windows
- ClassName: 'EDIT' WindowName: ''
- ClassName: 'ВµTorrent4823DF041B09' WindowName: ''
- ClassName: 'DDEMLMom' WindowName: ''
- ClassName: 'IEFrame' WindowName: ''
- ClassName: 'Static' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
Creates and executes the following
- '%TEMP%\rarsfx0\utorrent.exe'
- '%TEMP%\rarsfx0\updates\3.5.0_43916\utorrentie.exe' uTorrent_2124_02787BF8_730418611 ВµTorrent4823DF041B09 uTorrent
- '%TEMP%\rarsfx0\updates\3.5.0_43916\utorrentie.exe' uTorrent_2124_02787B60_1896432535 ВµTorrent4823DF041B09 uTorrent
Executes the following
- '<SYSTEM32>\rundll32.exe' <SYSTEM32>\FirewallControlPanel.dll,ShowNotificationDialog /configure /DynEdge /ETOnly 0 /OnProfiles 6 /OtherAllowed 0 /OtherBlocked 0 /OtherEdgeAllowed 0 /NewBlocked 2 "%TEMP%\rarsfx0\utorrent...
