Technical Information
Malicious functions:
Creates and executes the following:
- '%PROGRAM_FILES%\rprotect\rprotect.exe'
- '%PROGRAM_FILES%\rprotect\rprotect.exe' (downloaded from the Internet)
Executes the following:
- '<SYSTEM32>\cmd.exe' /c C:\$$wefdddddwefgfhfsdf3322098.bat
Modifies file system :
Creates the following files:
- %PROGRAM_FILES%\rprotect\rprotect.exe
- C:\$$wefdddddwefgfhfsdf3322098.bat
- %CommonProgramFiles%\rprotect\rpuninst.exe
- %PROGRAM_FILES%\rprotect\rpthook.dll
- %PROGRAM_FILES%\rprotect\rp_updater.exe
Deletes itself.
Network activity:
Connects to:
- 'www.rp###ect.co.kr':80
- 'do##.#protect.co.kr':80
TCP:
HTTP GET requests:
- http://do##.#protect.co.kr/rprotect/rpuninst.exe
- http://do##.#protect.co.kr/rprotect/rprotect.exe
- http://www.rp###ect.co.kr/app_linkage/app_install.php?ad##############################
- http://do##.#protect.co.kr/rprotect/update.php
- http://do##.#protect.co.kr/rprotect/rpthook.dll
- http://do##.#protect.co.kr/rprotect/rp_updater.exe
UDP:
- DNS ASK www.rp###ect.co.kr
- DNS ASK do##.#protect.co.kr
Miscellaneous:
Searches for the following windows:
- ClassName: 'MS_WINHELP' WindowName: ''
- ClassName: '' WindowName: 'ѕЛЗБ·ОЕШЖ®'
- ClassName: '' WindowName: '??????????'
