Technical Information
Malicious functions:
Executes the following:
- '%APPDATA%\wmsrvcs.exe' <Full path to virus>
Terminates or attempts to terminate
the following user processes:
- webmoney.exe
Searches for registry branches where third party applications store passwords:
- [<HKCU>\Software\RIT\The Bat!]
Modifies file system:
Creates the following files:
- %APPDATA%\0_formhistory.sqlite
- %APPDATA%\0_signons.sqlite
- %APPDATA%\0_cookies.sqlite
- %APPDATA%\webmoney.exe
- <Current directory>\tmp
- %APPDATA%\passes.xm
- %APPDATA%\listfiles.txt
- %APPDATA%\wmsrvcs.exe
- %APPDATA%\set.dat
- %APPDATA%\0_cert8.db
- %APPDATA%\0_key3.db
- %APPDATA%\0_secmod.db
Sets the 'hidden' attribute to the following files:
- %APPDATA%\set.dat
Deletes the following files:
- %APPDATA%\0_cookies.sqlite
- %APPDATA%\0_cert8.db
- %APPDATA%\0_formhistory.sqlite
- %APPDATA%\0_signons.sqlite
- %APPDATA%\listfiles.txt
- <Current directory>\tmp
- %APPDATA%\0_key3.db
- %APPDATA%\0_secmod.db
Miscellaneous:
Searches for the following windows:
- ClassName: 'MS_WINHELP' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
