Technical Information
To ensure autorun and distribution
Creates the following files on removable media
- <Drive name for removable media>:\revengerat\chrome.exe
- <Drive name for removable media>:\delete.avi
- <Drive name for removable media>:\delete.avi.exe
- <Drive name for removable media>:\join.avi
- <Drive name for removable media>:\join.avi.exe
- <Drive name for removable media>:\000814251_video_01.avi
- <Drive name for removable media>:\correct.avi
- <Drive name for removable media>:\archer.avi
Malicious functions
Injects code into
the following system processes:
- %WINDIR%\microsoft.net\framework\v4.0.30319\aspnet_compiler.exe
Modifies file system
Creates the following files
- %TEMP%\dfrtnhui.txt
- %TEMP%\g4w00hvk.0.vb
- D:\revengerat\chrome.exe
- C:\totalcmd.exe
- %TEMP%\res6f19.tmp
- %TEMP%\vbcb5cff51dd29946df819339f35a6944e.tmp
- %TEMP%\vbcc192b86aa6504ed5a9bd56b75050df1c.tmp
- %TEMP%\c0gbrxbu.out
- %TEMP%\c0gbrxbu.cmdline
- %TEMP%\c0gbrxbu.0.vb
- C:\recovery.exe
- %TEMP%\res6a65.tmp
- %TEMP%\vbc9a2fe80c46dc48e1a65fdeddd6eecf4f.tmp
- %TEMP%\vbce5f33e06c7c84a0292f9fb6fbd247ab.tmp
- %TEMP%\g4kqic5p.out
- %TEMP%\g4kqic5p.cmdline
- %TEMP%\g4kqic5p.0.vb
- %ProgramFiles%.exe
- %TEMP%\g4w00hvk.cmdline
- %TEMP%\g4w00hvk.out
- %TEMP%\vbc52d28ce4358341fb9c98656e2986626.tmp
- %TEMP%\vbc8b34620b66664d70865170ee12353fcb.tmp
- %TEMP%\qoxi55vb.0.vb
- %PROGRAMDATA%\revengerat\000814251_video_01.ico
- %TEMP%\res831e.tmp
- %TEMP%\vbcdf30e57e6015442db750f7425f1fd4b.tmp
- %TEMP%\vbc9275c12d50d24c798a1ec797cc6fb7ea.tmp
- %TEMP%\urhsiokn.out
- %TEMP%\urhsiokn.cmdline
- %TEMP%\urhsiokn.0.vb
- %TEMP%\res7bf9.tmp
- %PROGRAMDATA%\revengerat\join.ico
- %TEMP%\vbc9957729b29e74b25b5cd9c69b6b76fb3.tmp
- %TEMP%\vbc2763c907aa344beaaa90204e7eecd81.tmp
- %TEMP%\kdvth30b.out
- %TEMP%\kdvth30b.cmdline
- %TEMP%\kdvth30b.0.vb
- %PROGRAMDATA%\revengerat\delete.ico
- D:\$recycle.bin.exe
- %TEMP%\res72a3.tmp
- %TEMP%\qoxi55vb.cmdline
- %TEMP%\res671a.tmp
- %TEMP%\vbc9e7ca385e24a45928742dcefa5c7bc42.tmp
- %TEMP%\vbcab67412821a6434887586d7554d9cfb.tmp
- %TEMP%\usilhg5i.0.vb
- C:\documents and settings.exe
- %TEMP%\res593f.tmp
- %TEMP%\vbcb283a197db3549eba157cbf548b42a41.tmp
- %TEMP%\vbcc8fbf4a8ffed4ebfb9746966206dfb9.tmp
- %TEMP%\virswxjk.out
- %TEMP%\virswxjk.cmdline
- %TEMP%\virswxjk.0.vb
- C:\$recycle.bin.exe
- %TEMP%\res55b5.tmp
- %TEMP%\vbcf412d4dcf42740449d143d3e724dce2.tmp
- %TEMP%\vbc157dc684c65449009340309a4970ced3.tmp
- %TEMP%\fmd1va3t.out
- %TEMP%\fmd1va3t.cmdline
- %TEMP%\fmd1va3t.0.vb
- %PROGRAMDATA%\revengerat\iowruug.ico
- C:\revengerat\chrome.exe
- %TEMP%\usilhg5i.cmdline
- %TEMP%\usilhg5i.out
- %TEMP%\vbc249c5cb62a7d4e298d64b3ccee9ae7b0.tmp
- %TEMP%\vbcee8817fefb34de8874858baf332248.tmp
- %TEMP%\2m0nltsz.cmdline
- %TEMP%\2m0nltsz.0.vb
- C:\perflogs.exe
- %TEMP%\res6380.tmp
- %TEMP%\vbc177a1f102f08429095a3f5971a7f3751.tmp
- %TEMP%\vbc4c818802b48441719617f329113c4297.tmp
- %TEMP%\pzx3zo4v.out
- %TEMP%\pzx3zo4v.cmdline
- C:\msocache.exe
- %TEMP%\pzx3zo4v.0.vb
- %TEMP%\res6024.tmp
- %TEMP%\vbc8eba3592fa5e4dcbb0c54fa1bee24169.tmp
- %TEMP%\vbc7464193b1ab24031b1a66587a4a9cb7.tmp
- %TEMP%\g42to5kv.out
- %TEMP%\g42to5kv.cmdline
- %TEMP%\g42to5kv.0.vb
- C:\far2.exe
- %TEMP%\res5c9a.tmp
- %TEMP%\2m0nltsz.out
- %TEMP%\qoxi55vb.out
Sets the 'hidden' attribute to the following files
- C:\revengerat\chrome.exe
- D:\revengerat\chrome.exe
- <Drive name for removable media>:\revengerat\chrome.exe
Deletes the following files
- %TEMP%\res55b5.tmp
- %TEMP%\res6a65.tmp
- %TEMP%\vbc9a2fe80c46dc48e1a65fdeddd6eecf4f.tmp
- %TEMP%\vbce5f33e06c7c84a0292f9fb6fbd247ab.tmp
- %TEMP%\g4kqic5p.0.vb
- %TEMP%\g4kqic5p.out
- %TEMP%\g4kqic5p.cmdline
- %TEMP%\res6f19.tmp
- %TEMP%\vbcb5cff51dd29946df819339f35a6944e.tmp
- %TEMP%\vbcc192b86aa6504ed5a9bd56b75050df1c.tmp
- %TEMP%\c0gbrxbu.cmdline
- %TEMP%\c0gbrxbu.out
- %TEMP%\c0gbrxbu.0.vb
- %TEMP%\res72a3.tmp
- %TEMP%\vbc8b34620b66664d70865170ee12353fcb.tmp
- %TEMP%\vbc52d28ce4358341fb9c98656e2986626.tmp
- %TEMP%\g4w00hvk.0.vb
- %TEMP%\g4w00hvk.out
- %TEMP%\qoxi55vb.0.vb
- %TEMP%\urhsiokn.out
- %TEMP%\urhsiokn.0.vb
- %TEMP%\urhsiokn.cmdline
- %TEMP%\vbc9275c12d50d24c798a1ec797cc6fb7ea.tmp
- %TEMP%\vbcdf30e57e6015442db750f7425f1fd4b.tmp
- %TEMP%\kdvth30b.0.vb
- %TEMP%\res831e.tmp
- %TEMP%\kdvth30b.out
- %TEMP%\kdvth30b.cmdline
- %TEMP%\vbc2763c907aa344beaaa90204e7eecd81.tmp
- %TEMP%\vbc9957729b29e74b25b5cd9c69b6b76fb3.tmp
- %TEMP%\res7bf9.tmp
- %TEMP%\g4w00hvk.cmdline
- %TEMP%\qoxi55vb.cmdline
- %TEMP%\2m0nltsz.out
- %TEMP%\2m0nltsz.cmdline
- %TEMP%\2m0nltsz.0.vb
- %TEMP%\vbcf412d4dcf42740449d143d3e724dce2.tmp
- %TEMP%\vbc157dc684c65449009340309a4970ced3.tmp
- %TEMP%\fmd1va3t.cmdline
- %TEMP%\fmd1va3t.out
- %TEMP%\fmd1va3t.0.vb
- %TEMP%\res593f.tmp
- %TEMP%\vbcb283a197db3549eba157cbf548b42a41.tmp
- %TEMP%\vbcc8fbf4a8ffed4ebfb9746966206dfb9.tmp
- %TEMP%\virswxjk.cmdline
- %TEMP%\virswxjk.out
- %TEMP%\virswxjk.0.vb
- %TEMP%\res5c9a.tmp
- %TEMP%\vbcee8817fefb34de8874858baf332248.tmp
- %TEMP%\vbc249c5cb62a7d4e298d64b3ccee9ae7b0.tmp
- %TEMP%\usilhg5i.0.vb
- %TEMP%\usilhg5i.cmdline
- %TEMP%\usilhg5i.out
- %TEMP%\vbc9e7ca385e24a45928742dcefa5c7bc42.tmp
- %TEMP%\res671a.tmp
- %TEMP%\pzx3zo4v.cmdline
- %TEMP%\pzx3zo4v.out
- %TEMP%\pzx3zo4v.0.vb
- %TEMP%\vbc4c818802b48441719617f329113c4297.tmp
- %TEMP%\res6380.tmp
- %TEMP%\vbc177a1f102f08429095a3f5971a7f3751.tmp
- %TEMP%\g42to5kv.cmdline
- %TEMP%\g42to5kv.out
- %TEMP%\g42to5kv.0.vb
- %TEMP%\vbc7464193b1ab24031b1a66587a4a9cb7.tmp
- %TEMP%\vbc8eba3592fa5e4dcbb0c54fa1bee24169.tmp
- %TEMP%\res6024.tmp
- %TEMP%\vbcab67412821a6434887586d7554d9cfb.tmp
- %TEMP%\qoxi55vb.out
Network activity
Connects to
- 'os####014.ddns.net':5550
UDP
- DNS ASK os####014.ddns.net
Miscellaneous
Creates and executes the following
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\fmd1va3t.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\nbxioyaf.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES29AE.tmp" "%TEMP%\vbcC5D698DECC5A4777A8D9787ADF7B8DDD.TMP"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\qoxi55vb.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES831E.tmp" "%TEMP%\vbcDF30E57E6015442DB750F7425F1FD4B.TMP"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\urhsiokn.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES7BF9.tmp" "%TEMP%\vbc9957729B29E74B25B5CD9C69B6B76FB3.TMP"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\kdvth30b.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES72A3.tmp" "%TEMP%\vbc8B34620B66664D70865170EE12353FCB.TMP"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\g4w00hvk.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES6F19.tmp" "%TEMP%\vbcB5CFF51DD29946DF819339F35A6944E.TMP"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\c0gbrxbu.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES9057.tmp" "%TEMP%\vbcFAF3032AE5F945BBAF1BCE45637848A.TMP"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES6A65.tmp" "%TEMP%\vbc9A2FE80C46DC48E1A65FDEDDD6EECF4F.TMP"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES671A.tmp" "%TEMP%\vbc9E7CA385E24A45928742DCEFA5C7BC42.TMP"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\2m0nltsz.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES6380.tmp" "%TEMP%\vbc177A1F102F08429095A3F5971A7F3751.TMP"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\pzx3zo4v.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES6024.tmp" "%TEMP%\vbc8EBA3592FA5E4DCBB0C54FA1BEE24169.TMP"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\g42to5kv.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES5C9A.tmp" "%TEMP%\vbcEE8817FEFB34DE8874858BAF332248.TMP"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\usilhg5i.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES593F.tmp" "%TEMP%\vbcB283A197DB3549EBA157CBF548B42A41.TMP"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\virswxjk.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES55B5.tmp" "%TEMP%\vbcF412D4DCF42740449D143D3E724DCE2.TMP"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\g4kqic5p.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\f1v1eql0.cmdline"' (with hidden window)
Executes the following
- '%WINDIR%\microsoft.net\framework\v4.0.30319\aspnet_compiler.exe'
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\nbxioyaf.cmdline"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES29AE.tmp" "%TEMP%\vbcC5D698DECC5A4777A8D9787ADF7B8DDD.TMP"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\qoxi55vb.cmdline"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES831E.tmp" "%TEMP%\vbcDF30E57E6015442DB750F7425F1FD4B.TMP"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\urhsiokn.cmdline"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES7BF9.tmp" "%TEMP%\vbc9957729B29E74B25B5CD9C69B6B76FB3.TMP"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\kdvth30b.cmdline"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES72A3.tmp" "%TEMP%\vbc8B34620B66664D70865170EE12353FCB.TMP"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\g4w00hvk.cmdline"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES6F19.tmp" "%TEMP%\vbcB5CFF51DD29946DF819339F35A6944E.TMP"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\c0gbrxbu.cmdline"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES6A65.tmp" "%TEMP%\vbc9A2FE80C46DC48E1A65FDEDDD6EECF4F.TMP"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\g4kqic5p.cmdline"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES671A.tmp" "%TEMP%\vbc9E7CA385E24A45928742DCEFA5C7BC42.TMP"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\2m0nltsz.cmdline"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES6380.tmp" "%TEMP%\vbc177A1F102F08429095A3F5971A7F3751.TMP"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\pzx3zo4v.cmdline"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES6024.tmp" "%TEMP%\vbc8EBA3592FA5E4DCBB0C54FA1BEE24169.TMP"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\g42to5kv.cmdline"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES5C9A.tmp" "%TEMP%\vbcEE8817FEFB34DE8874858BAF332248.TMP"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\usilhg5i.cmdline"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES593F.tmp" "%TEMP%\vbcB283A197DB3549EBA157CBF548B42A41.TMP"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\virswxjk.cmdline"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES55B5.tmp" "%TEMP%\vbcF412D4DCF42740449D143D3E724DCE2.TMP"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\fmd1va3t.cmdline"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES9057.tmp" "%TEMP%\vbcFAF3032AE5F945BBAF1BCE45637848A.TMP"
- '%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe' /noconfig @"%TEMP%\f1v1eql0.cmdline"
