Technical Information
To ensure autorun and distribution:
Creates or modifies the following files:
- %WINDIR%\Tasks\Flash Update.job
Malicious functions:
Creates and executes the following:
- '%TEMP%\is-OMCPG.tmp\RevoUninProSetup.tmp' /SL5="$40092,10060206,194048,%TEMP%\RevoUninProSetup.exe"
- '%TEMP%\RevoUninProSetup.exe'
Executes the following:
- '<SYSTEM32>\msiexec.exe' -Embedding BAD0DCCE4DC1DD81C7B71C42FC15C063
- '<SYSTEM32>\msiexec.exe' -Embedding 4647C1C4512200A5D085A7E4009953F6 M Global\MSI0000
- '<SYSTEM32>\msiexec.exe' /i "%APPDATA%\Revo Uninstaller Pro\Revo Uninstaller Pro 1.0.1\install\Revo Uninstaller Pro.msi" AI_SETUPEXEPATH=<Full path to virus> SETUPEXEDIR=<Current directory>\ EXE_CMD_LINE="/exenoupdates /exelang 0 /noprereqs "
- '<SYSTEM32>\msiexec.exe' /V
Terminates or attempts to terminate
the following user processes:
- iexplore.exe
- chrome.exe
Modifies file system :
Creates the following files:
- %WINDIR%\Installer\MSI5.tmp
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\OBJECTS.DATA
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\OBJECTS.MAP
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\RestorePointSize
- %WINDIR%\Installer\MSI6.tmp
- %WINDIR%\Installer\MSI4.tmp
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\INDEX.MAP
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\INDEX.BTR
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING.VER
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING2.MAP
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING1.MAP
- %WINDIR%\Installer\MSI7.tmp
- %WINDIR%\Installer\MSID.tmp
- %TEMP%\RevoUninProSetup.exe
- %WINDIR%\update.js
- %TEMP%\is-OMCPG.tmp\RevoUninProSetup.tmp
- %WINDIR%\Installer\MSIE.tmp
- %APPDATA%\Revo Uninstaller Pro\Revo Uninstaller Pro 1.0.1\install\disk1.cab
- %WINDIR%\Installer\MSI9.tmp
- %WINDIR%\Installer\MSI8.tmp
- C:\Config.Msi\2caac.rbs
- %WINDIR%\Installer\MSIC.tmp
- %WINDIR%\Installer\MSIB.tmp
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\$WinMgmt.CFG
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-18
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\rp.log
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-19
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-20
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-19
- %WINDIR%\Installer\MSI3.tmp
- %TEMP%\2a500.msi
- %APPDATA%\Revo Uninstaller Pro\Revo Uninstaller Pro 1.0.1\install\Revo Uninstaller Pro.msi
- %WINDIR%\Installer\2caa9.msi
- %WINDIR%\Installer\MSI2.tmp
- %WINDIR%\Installer\MSI1.tmp
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-20
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\ComDb.Dat
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SAM
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\domain.txt
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP15\drivetable.txt
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\drivetable.txt
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SYSTEM
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-21-2052111302-484763869-725345543-1003
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-21-2052111302-484763869-725345543-1003
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_.DEFAULT
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SOFTWARE
- C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SECURITY
Deletes the following files:
- C:\Config.Msi\2caac.rbs
- %WINDIR%\Installer\MSI6.tmp
- %WINDIR%\Installer\MSI4.tmp
- %WINDIR%\Installer\MSIE.tmp
- %WINDIR%\Installer\MSI5.tmp
- %APPDATA%\Revo Uninstaller Pro\Revo Uninstaller Pro 1.0.1\install\Revo Uninstaller Pro.msi
- %APPDATA%\Revo Uninstaller Pro\Revo Uninstaller Pro 1.0.1\install\disk1.cab
- %WINDIR%\Installer\2caa9.msi
- %TEMP%\2a500.msi
- %WINDIR%\Installer\MSI3.tmp
- %WINDIR%\Installer\MSI7.tmp
- %WINDIR%\Installer\MSI1.tmp
- %WINDIR%\Installer\MSI2.tmp
- %WINDIR%\Installer\MSI8.tmp
- %WINDIR%\Installer\MSIC.tmp
- %WINDIR%\Installer\MSID.tmp
- %WINDIR%\Installer\MSI9.tmp
- %WINDIR%\Installer\MSIB.tmp
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
Adds a root certificate
Modifies value of AutoConfigURL parameter
