Technical Information
Malicious functions
Executes the following
- '%WINDIR%\syswow64\net.exe' stop "NVIDIA Display Driver Service"
Modifies file system
Creates the following files
- %TEMP%\raqjbpi.exe
- %TEMP%\raqjbpi.dll
- %TEMP%\hivb22f.tmp
Deletes the following files
- %TEMP%\hivb22f.tmp
Substitutes the following files
- %TEMP%\hivb22f.tmp
Deletes itself.
Miscellaneous
Creates and executes the following
- '%TEMP%\raqjbpi.exe'
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c copy <Full path to file> %TEMP%\raqjbpi.exe >> NUL
- '%WINDIR%\syswow64\cmd.exe' /c %TEMP%\raqjbpi.exe>> NUL
- '%WINDIR%\syswow64\cmd.exe' /c del <Full path to file> >> NUL
- '%WINDIR%\syswow64\cmd.exe' /c net stop "NVIDIA Display Driver Service" >> NUL
- '%WINDIR%\syswow64\net1.exe' stop "NVIDIA Display Driver Service"
- '%WINDIR%\syswow64\cmd.exe' /c copy <Full path to file> %TEMP%\raqjbpi.exe >> NUL' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c %TEMP%\raqjbpi.exe>> NUL' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c del <Full path to file> >> NUL' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c net stop "NVIDIA Display Driver Service" >> NUL' (with hidden window)
