Technical Information
Malicious functions:
Executes the following:
- '%TEMP%\1.tmp\UnRAR.exe' e -o+ "%TEMP%\1.tmp\ADDS.rar" "%TEMP%\1.tmp"
- '<SYSTEM32>\attrib.exe' -H -S -A "%TEMP%\Latest-FastActivate.rar"
- '<SYSTEM32>\attrib.exe' -s -h patchYDG.exe
- '<SYSTEM32>\taskkill.exe' /f /im wget.exe
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\1.tmp\FastActivate.BAT" <Current directory>\"
- '<SYSTEM32>\taskkill.exe' /f /im tt8_keygen2.exe
- '<SYSTEM32>\taskkill.exe' /f /im tt8_mapcheck2.exe
Modifies file system:
Creates the following files:
- %TEMP%\1.tmp\patchYDG.exe
- %TEMP%\1.tmp\tt8_keygen2.exe
- %TEMP%\1.tmp\meta1.txt
- %TEMP%\1.tmp\gzip.exe
- %TEMP%\1.tmp\Menu.txt
- %TEMP%\1.tmp\Wselect.exe
- %TEMP%\UnRAR.exe
- %TEMP%\1.tmp\wget.exe
- %TEMP%\1.tmp\tt8_mapcheck2.exe
- %TEMP%\1.tmp\Wbusy.exe
- %TEMP%\1.tmp\Android.txt
- %TEMP%\1.tmp\Compact.exe
- %TEMP%\1.tmp\UnRAR.exe
- %TEMP%\1.tmp\FastActivate.BAT
- %TEMP%\1.tmp\ADDS.rar
- %TEMP%\1.tmp\FastActivate-Updater.exe
- %TEMP%\1.tmp\GPSMenu.txt
- %TEMP%\1.tmp\Extract.exe
- %TEMP%\1.tmp\cygwin1.dll
- %TEMP%\1.tmp\ee_meta.tlv
Deletes the following files:
- %TEMP%\1.tmp\Compact.exe
- %TEMP%\1.tmp\tt8_keygen2.exe
- %TEMP%\1.tmp\meta1.txt
- %TEMP%\1.tmp\Extract.exe
- %TEMP%\1.tmp\patchYDG.exe
- %TEMP%\1.tmp\tt8_mapcheck2.exe
- %TEMP%\1.tmp\gzip.exe
- %TEMP%\1.tmp\ADDS.rar
- %TEMP%\UnRAR.exe
- %TEMP%\1.tmp\ee_meta.tlv
- %TEMP%\wget.exe
- %TEMP%\1.tmp\UnRAR.exe
- %TEMP%\1.tmp\GPSMenu.txt
- %TEMP%\1.tmp\Wselect.exe
- %TEMP%\Wbusy.exe
Moves the following files:
- from %TEMP%\1.tmp\Wbusy.exe to %TEMP%\Wbusy.exe
- from %TEMP%\1.tmp\wget.exe to %TEMP%\wget.exe
Miscellaneous:
Searches for the following windows:
- ClassName: '' WindowName: ''
