Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'MyApplication' = '%TEMP%\RarSFX0\XW33322XXient.exe'
Malicious functions
Injects code into
the following system processes:
- %WINDIR%\explorer.exe
Patches code
in AMSI dll
- explorer.exe process, Amsi.dll module
Modifies file system
Creates the following files
- %TEMP%\rarsfx0\logo.png
- %TEMP%\rarsfx0\sfx.conf
- %TEMP%\rarsfx0\xw33322xxient.exe
Network activity
Connects to
- '45.##7.98.100':6000
- '<LOCALNET>..47.2':6000
Miscellaneous
Searches for the following windows
- ClassName: 'EDIT' WindowName: ''
- ClassName: 'NarratorUIClass' WindowName: ''
Creates and executes the following
- '%TEMP%\rarsfx0\xw33322xxient.exe'
Executes the following
- '<SYSTEM32>\svchost.exe' -k appmodel -p -s camsvc
