Technical Information
Malicious functions
Executes the following
- '<SYSTEM32>\taskkill.exe' /F /IM chrome.exe
Modifies file system
Creates the following files
- %TEMP%\rarsfx0\chrome.reg
- %TEMP%\bd5b.tmp
- %TEMP%\b6d5.tmp
- %TEMP%\8ad2.tmp
- %TEMP%\rarsfx0\vcruntime140_1.dll
- %TEMP%\rarsfx0\plugins-edge.crx
- %TEMP%\rarsfx0\plugins-chrome.crx
- %TEMP%\rarsfx0\main.exe
- %TEMP%\rarsfx0\id-edge.txt
- %TEMP%\scoped_dir_772_5988\b6d5.tmp
- %TEMP%\rarsfx0\id-chrome.txt
- %TEMP%\rarsfx0\edge-set.reg
- %TEMP%\rarsfx0\edge86.bat
- %TEMP%\rarsfx0\edge64.bat
- %TEMP%\rarsfx0\edge.reg
- %TEMP%\rarsfx0\chrome-set.reg
- %TEMP%\rarsfx0\chrome86.bat
- %TEMP%\rarsfx0\chrome64.bat
- %TEMP%\rarsfx0\chrome7.bat
- %TEMP%\rarsfx0\id.txt
- %TEMP%\scoped_dir_772_5988\crx_install\manifest.json
Deletes the following files
- %TEMP%\8ad2.tmp
- %TEMP%\bd5b.tmp
- %TEMP%\scoped_dir_772_5988\b6d5.tmp
- %TEMP%\scoped_dir_772_5988\decoded_images
- %TEMP%\scoped_dir_772_5988\decoded_message_catalogs
- %TEMP%\b6d5.tmp
Network activity
Connects to
- 'ge#.#eojs.io':443
- '35.##0.162.170':8080
- '35.##0.162.170':8070
- 'pl#####notification.com':80
- 'clients4.google.com':443
- 'tr######e.googleapis.com':443
- 'go##le.ru':80
- 'clients3.google.com':443
- 're####ctor.gvt1.com':80
- 'r4######5hnekn7z.gvt1.com':80
- 'ss#.#static.com':443
- 'ac#####s.youtube.com':443
- 'fo###.gstatic.com':443
TCP
HTTP GET requests
- http://www.gs##tic.com/chrome/profile_avatars/NothingToDownload
UDP
- DNS ASK ge#.#eojs.io
- DNS ASK ac#####s.youtube.com
- DNS ASK ss#.#static.com
- DNS ASK accounts.google.com
- DNS ASK r4######5hnekn7z.gvt1.com
- DNS ASK re####ctor.gvt1.com
- DNS ASK clients3.google.com
- DNS ASK fo###.gstatic.com
- DNS ASK gs##tic.com
- DNS ASK pl#####notification.com
- DNS ASK go###eapis.com
- DNS ASK go##le.ru
- DNS ASK google.com
- DNS ASK clients4.google.com
- DNS ASK clients2.google.com
- DNS ASK tr######e.googleapis.com
- 'accounts.google.com':443
- 'google.com':443
Miscellaneous
Searches for the following windows
- ClassName: 'EDIT' WindowName: ''
- ClassName: 'RegEdit_RegEdit' WindowName: ''
- ClassName: '' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
- ClassName: 'Chrome_MessageWindow' WindowName: '%LOCALAPPDATA%\Google\Chrome\User Data'
Creates and executes the following
- '%TEMP%\rarsfx0\main.exe'
- '<SYSTEM32>\taskkill.exe' /F /IM chrome.exe' (with hidden window)
- '%WINDIR%\regedit.exe' /s chrome.reg' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c chrome86.bat' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\RarSFX0\chrome86.bat" h"' (with hidden window)
- '%WINDIR%\regedit.exe' /s chrome-set.reg' (with hidden window)
Executes the following
- '%WINDIR%\regedit.exe' /s chrome.reg
- '<SYSTEM32>\cmd.exe' /c chrome86.bat
- '<SYSTEM32>\mshta.exe' vbscript:createobject("wscript.shell").run("chrome86.bat h",0)(window.close)
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\RarSFX0\chrome86.bat" h"
- '%ProgramFiles(x86)%\google\chrome\application\chrome.exe'
- '%WINDIR%\regedit.exe' /s chrome-set.reg
- '%ProgramFiles(x86)%\google\chrome\application\chrome.exe' --type=gpu-process --channel="772.0.1907876082\1326668065" --supports-dual-gpus=false --gpu-driver-bug-workarounds=1,19,42 --gpu-vendor-id=0x0000 --gpu-device-id=0x0000 --gpu-driver-vendor --gp...
- '%ProgramFiles(x86)%\google\chrome\application\chrome.exe' --type=renderer --enable-deferred-image-decoding --lang=ru --force-fieldtrials="BackgroundRendererProcesses/Disallow/BrowserBlacklist/Enabled/*CTRequiredForEVTrial/RequirementEnforced/CaptivePo...
- '%ProgramFiles(x86)%\google\chrome\application\chrome.exe' --type=renderer --enable-deferred-image-decoding --lang=ru --force-fieldtrials="BackgroundRendererProcesses/Disallow/*BrowserBlacklist/Enabled/*CTRequiredForEVTrial/RequirementEnforced/CaptiveP...
- '%ProgramFiles(x86)%\google\chrome\application\chrome.exe' --type=renderer --enable-deferred-image-decoding --lang=ru --force-fieldtrials="*BackgroundRendererProcesses/Disallow/*BrowserBlacklist/Enabled/*CTRequiredForEVTrial/RequirementEnforced/Captive...
