Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKCU\Software\VOS\RaidCall\PendingChangesHKLM\SOFTWARE\Classes\raidcall\shell\open\command] '' = '[#CAMEYO-VAR#]"%Program Files%\RaidCall\StartRC.exe" "%1"'
Malicious functions
Injects code into
the following user processes:
- raidcall.exe
Modifies file system
Creates the following files
- %APPDATA%\vos\raidcall\appvirtdll_raidcall.dll
- %APPDATA%\vos\raidcall\manif.2684.new.xml
- %APPDATA%\vos\raidcall\manif.2684.org.xml
- %APPDATA%\vos\raidcall\changes\virtfiles.db.1324.tmp
- %APPDATA%\vos\raidcall\changes\virtfiles.db.2288.tmp
- %APPDATA%\vos\raidcall\changes\%profile%\appdata\locallow\raidcall\miscid.tmp
- %APPDATA%\vos\raidcall\changes\virtreg.dat.log1
- %APPDATA%\vos\raidcall\changes\virtfiles.db.1952.tmp
- %APPDATA%\vos\raidcall\changes\%profile%\appdata\locallow\raidcall\config.cfg
- %APPDATA%\vos\raidcall\changes\%profile%\appdata\locallow\raidcall\log\raidcall_7.3.0.log
- %APPDATA%\vos\raidcall\changes\%profile%\appdata\locallow\raidcall\decoration.xml
- %APPDATA%\vos\raidcall\prog\%program files%\raidcall\theme\palette\preview.png
- %APPDATA%\vos\raidcall\changes\%program files%\raidcall\theme\palette\preview.png
- %APPDATA%\vos\raidcall\prog\%program files%\raidcall\theme\user_defined\preview.png
- %APPDATA%\vos\raidcall\changes\%program files%\raidcall\theme\user_defined\preview.png
- %APPDATA%\vos\raidcall\prog\%program files%\raidcall\theme\palette\config.xml
- %APPDATA%\vos\raidcall\changes\%program files%\raidcall\theme\palette\config.xml
- %APPDATA%\vos\raidcall\prog\%program files%\raidcall\theme\user_defined\config.xml
- %APPDATA%\vos\raidcall\enginestamps\zipcache.20131215-193323.875.stamp
- %APPDATA%\vos\raidcall\changes\%program files%\raidcall\theme\user_defined\config.xml
- %APPDATA%\vos\raidcall\zipcache
- %APPDATA%\vos\raidcall\prog\icons\raidcall.exe.ico
- %APPDATA%\vos\raidcall\enginestamps\appvirtdll_raidcall.dll.20131215-193323.859.stamp
- %APPDATA%\vos\raidcall\appvirtdll64_raidcall.dll
- %APPDATA%\vos\raidcall\enginestamps\appvirtdll64_raidcall.dll.20131215-193323.859.stamp
- %APPDATA%\vos\raidcall\raidcall.exe
- %APPDATA%\vos\raidcall\enginestamps\raidcall.exe.20131215-193323.875.stamp
- %APPDATA%\vos\raidcall\raidcall64.exe
- %APPDATA%\vos\raidcall\enginestamps\raidcall64.exe.20131215-193323.875.stamp
- %APPDATA%\vos\raidcall\virtfiles.prog.db
- %APPDATA%\vos\raidcall\enginestamps\virtfiles.prog.db.20131215-193605.109.stamp
- %APPDATA%\vos\raidcall\sandboxcfg.db
- %APPDATA%\vos\raidcall\enginestamps\sandboxcfg.db.20131215-193604.953.stamp
- %APPDATA%\vos\raidcall\virtreg.prog.dat
- %APPDATA%\vos\raidcall\enginestamps\virtreg.prog.dat.20131215-193604.953.stamp
- %APPDATA%\vos\raidcall\changes\virtfiles.db
- %APPDATA%\vos\raidcall\changes\virtreg.dat
- %APPDATA%\vos\raidcall\changes\virtfiles.db.552.tmp
- %APPDATA%\vos\raidcall\prog\%program files%\raidcall\microsoft.vc90.crt\microsoft.vc90.crt.manifest
- %APPDATA%\vos\raidcall\prog\icons\uninst.exe.ico
- %APPDATA%\vos\raidcall\prog\%program files%\raidcall\interface.dat
Deletes the following files
- %APPDATA%\vos\raidcall\changes\virtfiles.db
- %APPDATA%\vos\raidcall\manif.2684.org.xml
- %APPDATA%\vos\raidcall\manif.2684.new.xml
Substitutes the following files
- %APPDATA%\vos\raidcall\changes\virtfiles.db
- %APPDATA%\vos\raidcall\changes\virtfiles.db.552.tmp
Network activity
Connects to
- 'ad#.##idtalk.com':80
- 'up####.raidcall.com':80
- 'up####.raidtalk.com':80
TCP
HTTP GET requests
- http://up####.raidcall.com/check_new.php?ve####################################
UDP
- DNS ASK ap#.##idtalk.com
- DNS ASK ad#.##idtalk.com
- DNS ASK up####.raidcall.com
- DNS ASK ra###alk.com
- DNS ASK up####.raidtalk.com
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: 'GFXSVR'
- ClassName: 'RcGameBox_gamebox_' WindowName: ''
Creates and executes the following
- '%APPDATA%\vos\raidcall\raidcall.exe'
- '%APPDATA%\vos\raidcall\raidcall.exe' --check --version=7.3.0-1.0.10926.49
- '%APPDATA%\vos\raidcall\raidcall.exe' "checkDx"
- '%APPDATA%\vos\raidcall\raidcall.exe' --check --version=7.3.0-1.0.10926.49' (with hidden window)
- '%APPDATA%\vos\raidcall\raidcall.exe' "checkDx"' (with hidden window)
