Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\driverupdate
Modifies file system
Creates the following files
- %TEMP%\rarsfx0\yes_-_copy.bat
- nul
- %APPDATA%\sysinfo.txt
- %APPDATA%\netuser.txt
- %APPDATA%\cmdkey.txt
- %APPDATA%\ipconfig.txt
- C:\users\public\documents\0.bat
- C:\users\public\documents\0.vbs
Sets the 'hidden' attribute to the following files
- C:\users\public\documents\0.vbs
- C:\users\public\documents\0.bat
Deletes the following files
- %APPDATA%\sysinfo.txt
- %APPDATA%\netuser.txt
- %APPDATA%\cmdkey.txt
- %APPDATA%\ipconfig.txt
- %TEMP%\rarsfx0\yes_-_copy.bat
Miscellaneous
Searches for the following windows
- ClassName: 'EDIT' WindowName: ''
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\RarSFX0\yes_-_Copy.bat" "
- '%WINDIR%\syswow64\cmd.exe' /S /D /c" echo steamclient.dll"
- '%WINDIR%\syswow64\cmd.exe' /S /D /c" echo steamapps"
- '%WINDIR%\syswow64\cmd.exe' /S /D /c" echo Steam2.dll"
- '%WINDIR%\syswow64\cmd.exe' /S /D /c" echo Steam.exe.old"
- '%WINDIR%\syswow64\cmd.exe' /S /D /c" echo Steam.exe"
- '%WINDIR%\syswow64\cmd.exe' /S /D /c" echo Steam.dll"
- '%WINDIR%\syswow64\cmd.exe' /S /D /c" echo steam"
- '%WINDIR%\syswow64\cmd.exe' /S /D /c" echo skins"
- '%WINDIR%\syswow64\cmd.exe' /S /D /c" echo servers"
- '%WINDIR%\syswow64\cmd.exe' /S /D /c" echo SDL2.dll"
- '%WINDIR%\syswow64\cmd.exe' /S /D /c" echo resource"
- '%WINDIR%\syswow64\cmd.exe' /S /D /c" echo remoteui"
- '%WINDIR%\syswow64\cmd.exe' /S /D /c" echo public"
- '%WINDIR%\syswow64\cmd.exe' /S /D /c" echo package"
- '%WINDIR%\syswow64\cmd.exe' /S /D /c" echo logs"
- '%WINDIR%\syswow64\cmd.exe' /S /D /c" echo libx264-142.dll.md5"
- '%WINDIR%\syswow64\cmd.exe' /S /D /c" echo libx264-142.dll.crypt"
- '%WINDIR%\syswow64\cmd.exe' /S /D /c" echo steamclient64.dll"
- '%WINDIR%\syswow64\cmd.exe' /S /D /c" echo steamerrorreporter.exe"
- '%WINDIR%\syswow64\cmd.exe' /S /D /c" echo steamerrorreporter64.exe"
- '%WINDIR%\syswow64\cmd.exe' /S /D /c" echo SteamUI.dll"
- '%WINDIR%\syswow64\attrib.exe' "C:\Users\Public\Documents\0.vbs" +h
- '%WINDIR%\syswow64\schtasks.exe' /create /f /sc Onidle /i 60 /tn "DriverUpdate" /tr "C:\Users\Public\Documents\0.vbs"
- '%WINDIR%\syswow64\attrib.exe' -h "C:\Users\Public\Documents\"
- '%WINDIR%\syswow64\cmd.exe' /c 2>NUL dir /b "%ProgramFiles%\Steam\"
- '%WINDIR%\syswow64\cmd.exe' /S /D /c" echo WriteMiniDump.exe"
- '%WINDIR%\syswow64\cmd.exe' /S /D /c" echo winh264.dll"
- '%WINDIR%\syswow64\cmd.exe' /S /D /c" echo vstdlib_s64.dll"
- '%WINDIR%\syswow64\cmd.exe' /S /D /c" echo vstdlib_s.dll"
- '%WINDIR%\syswow64\cmd.exe' /S /D /c" echo v8.dll"
- '%WINDIR%\syswow64\cmd.exe' /S /D /c" echo video.dll"
- '%WINDIR%\syswow64\cmd.exe' /S /D /c" echo uninstall.exe"
- '%WINDIR%\syswow64\cmd.exe' /S /D /c" echo tier0_s64.dll"
- '%WINDIR%\syswow64\cmd.exe' /S /D /c" echo tier0_s.dll"
- '%WINDIR%\syswow64\cmd.exe' /S /D /c" echo ThirdPartyLegalNotices.html"
- '%WINDIR%\syswow64\cmd.exe' /S /D /c" echo ThirdPartyLegalNotices.doc"
- '%WINDIR%\syswow64\cmd.exe' /S /D /c" echo ThirdPartyLegalNotices.css"
- '%WINDIR%\syswow64\cmd.exe' /S /D /c" echo tenfoot"
- '%WINDIR%\syswow64\cmd.exe' /S /D /c" echo streaming_client.exe"
- '%WINDIR%\syswow64\attrib.exe' "C:\Users\Public\Documents\0.bat" +h
- '%WINDIR%\syswow64\cmd.exe' /S /D /c" echo libswscale-3.dll"
- '%WINDIR%\syswow64\cmd.exe' /S /D /c" echo libav_h264-56.dll.md5"
- '%WINDIR%\syswow64\cmd.exe' /S /D /c" echo libav_h264-56.dll.crypt"
- '%WINDIR%\syswow64\cmd.exe' /S /D /c" echo appcache"
- '%WINDIR%\syswow64\find.exe' "ssfn"
- '%WINDIR%\syswow64\cmd.exe' /S /D /c" echo amf"
- '%WINDIR%\syswow64\cmd.exe' /c 2>NUL dir /b "%ProgramFiles(x86)%\Steam\"
- '%WINDIR%\syswow64\cmd.exe' /c 2>NUL dir /b "%APPDATA%\discord\Local Storage\leveldb\"
- '%WINDIR%\syswow64\cmd.exe' /c 2>NUL dir /b "%APPDATA%\Mozilla\Firefox\Profiles"
- '%WINDIR%\syswow64\timeout.exe' /t 2 /nobreak
- '%WINDIR%\syswow64\ipconfig.exe' /all
- '%WINDIR%\syswow64\cmdkey.exe' /list
- '%WINDIR%\syswow64\net1.exe' user
- '%WINDIR%\syswow64\net.exe' user
- '%WINDIR%\syswow64\systeminfo.exe'
- '%WINDIR%\syswow64\timeout.exe' /t 5 /nobreak
- '%WINDIR%\syswow64\attrib.exe' "C:\Users\Public\Documents\s.exe" +h
- '%WINDIR%\syswow64\findstr.exe' [
- '%WINDIR%\syswow64\ping.exe' -4 -n 1 rzcitoz
- '%WINDIR%\syswow64\cmd.exe' /c 2>NUL ping -4 -n 1 rzcitoz | findstr [
- '%WINDIR%\syswow64\cmd.exe' /S /D /c" echo AppOverlay.dll"
- '%WINDIR%\syswow64\cmd.exe' /S /D /c" echo AppOverlay64.dll"
- '%WINDIR%\syswow64\cmd.exe' /S /D /c" echo bin"
- '%WINDIR%\syswow64\cmd.exe' /S /D /c" echo config"
- '%WINDIR%\syswow64\cmd.exe' /S /D /c" echo libavresample-2.dll"
- '%WINDIR%\syswow64\cmd.exe' /S /D /c" echo libavformat-56.dll"
- '%WINDIR%\syswow64\cmd.exe' /S /D /c" echo libavcodec-56.dll"
- '%WINDIR%\syswow64\cmd.exe' /S /D /c" echo icuuc.dll"
- '%WINDIR%\syswow64\cmd.exe' /S /D /c" echo icui18n.dll"
- '%WINDIR%\syswow64\cmd.exe' /S /D /c" echo html5app"
- '%WINDIR%\syswow64\cmd.exe' /S /D /c" echo graphics"
- '%WINDIR%\syswow64\cmd.exe' /S /D /c" echo GameOverlayUI.exe"
- '%WINDIR%\syswow64\cmd.exe' /S /D /c" echo GameOverlayRenderer.dll"
- '%WINDIR%\syswow64\cmd.exe' /S /D /c" echo GameOverlayRenderer64.dll"
- '%WINDIR%\syswow64\cmd.exe' /S /D /c" echo friends"
- '%WINDIR%\syswow64\cmd.exe' /S /D /c" echo dbghelp.dll"
- '%WINDIR%\syswow64\cmd.exe' /S /D /c" echo d3dcompiler_46_64.dll"
- '%WINDIR%\syswow64\cmd.exe' /S /D /c" echo d3dcompiler_46.dll"
- '%WINDIR%\syswow64\cmd.exe' /S /D /c" echo CSERHelper.dll"
- '%WINDIR%\syswow64\cmd.exe' /S /D /c" echo crashhandler64.dll"
- '%WINDIR%\syswow64\cmd.exe' /S /D /c" echo crashhandler.dll"
- '%WINDIR%\syswow64\cmd.exe' /S /D /c" echo controller_base"
- '%WINDIR%\syswow64\cmd.exe' /S /D /c" echo libavutil-54.dll"
- '%WINDIR%\syswow64\attrib.exe' "C:\Users\Public\Documents\1.bat" +h
