Technical Information
Malicious functions
Executes the following
- '<SYSTEM32>\taskkill.exe' /F /IM chrome.exe
Modifies file system
Creates the following files
- %TEMP%\rarsfx0\msvcp140.dll
- %TEMP%\rarsfx0\msvcp140d.dll
- %TEMP%\rarsfx0\role
- %TEMP%\rarsfx0\run.exe
- %TEMP%\rarsfx0\secure.reg
- %TEMP%\rarsfx0\steamspot.reg
- %TEMP%\rarsfx0\ucrtbased.dll
- %TEMP%\rarsfx0\vcruntime140.dll
- %TEMP%\rarsfx0\vcruntime140_1.dll
- %TEMP%\rarsfx0\vcruntime140_1d.dll
- %TEMP%\rarsfx0\vcruntime140d.dll
- %TEMP%\rarsfx0\api-ms-win-crt-runtime-l1-1-0.dll
Network activity
Connects to
- 'ge#.#eojs.io':443
- 'lu###ate.xyz':80
TCP
HTTP GET requests
- http://lu###ate.xyz/cookie/useStatistics/count?us################
Other
- 'ge#.#eojs.io':443
UDP
- DNS ASK ge#.#eojs.io
- DNS ASK lu###ate.xyz
Miscellaneous
Searches for the following windows
- ClassName: 'EDIT' WindowName: ''
- ClassName: '' WindowName: ''
Creates and executes the following
- '%TEMP%\rarsfx0\run.exe'
- '<SYSTEM32>\taskkill.exe' /F /IM chrome.exe' (with hidden window)
Executes the following
- '<SYSTEM32>\cmd.exe' /c start chrome.exe --window-size=1366,768 --window-position=0,0 --force-device-scale-factor=1 "https://bismuni.com/j45w0z407h?key=4cd0821fdc45d81a646879f72e985a14"
- '%ProgramFiles(x86)%\google\chrome\application\chrome.exe' --window-size=1366,768 --window-position=0,0 --force-device-scale-factor=1 "https://bismuni.com/j45w0z407h?key=4cd0821fdc45d81a646879f72e985a14"
- '<SYSTEM32>\cmd.exe' /c start chrome.exe --start-maximized "www.go##le.com"
- '%ProgramFiles(x86)%\google\chrome\application\chrome.exe' --start-maximized "www.go##le.com"
- '%ProgramFiles(x86)%\google\chrome\application\chrome.exe' --type=gpu-process --channel="2608.0.1982375179\1222525148" --supports-dual-gpus=false --gpu-driver-bug-workarounds=1,19,42 --gpu-vendor-id=0x0000 --gpu-device-id=0x0000 --gpu-driver-vendor --g...
- '%ProgramFiles(x86)%\google\chrome\application\chrome.exe' --type=renderer --enable-deferred-image-decoding --lang=ru --force-fieldtrials="BackgroundRendererProcesses/Disallow/BrowserBlacklist/Enabled/*CTRequiredForEVTrial/RequirementEnforced/CaptivePo...
- '%ProgramFiles(x86)%\google\chrome\application\chrome.exe' --type=renderer --enable-deferred-image-decoding --lang=ru --force-fieldtrials="*BackgroundRendererProcesses/Disallow/*BrowserBlacklist/Enabled/*CTRequiredForEVTrial/RequirementEnforced/Captive...
