Technical Information
To ensure autorun and distribution
Sets the following service settings
- [<HKLM>\System\CurrentControlSet\Services\IKEEXT] 'Start' = '00000002'
Malicious functions
Executes the following
- '%WINDIR%\syswow64\taskkill.exe' /f /im msiexec.exe
Modifies file system
Creates the following files
- %TEMP%\rarsfx0\addfirewallrule.exe
- %TEMP%\rarsfx0\setupfiles\help\user.files\themedata.thmx
- %TEMP%\rarsfx0\setupfiles\help\user.files\props0030.xml
- %TEMP%\rarsfx0\setupfiles\help\user.files\item0029.xml
- %TEMP%\rarsfx0\setupfiles\help\user.files\image116.jpg
- %TEMP%\rarsfx0\setupfiles\help\user.files\image114.jpg
- %TEMP%\rarsfx0\setupfiles\help\user.files\image107.jpg
- %TEMP%\rarsfx0\setupfiles\help\user.files\user_clip_image002.jpg
- %TEMP%\rarsfx0\setupfiles\help\user.files\image106.jpg
- %TEMP%\rarsfx0\setupfiles\help\user.files\image040.jpg
- %TEMP%\rarsfx0\setupfiles\help\user.files\image039.jpg
- %TEMP%\rarsfx0\setupfiles\help\user.files\image038.jpg
- %TEMP%\rarsfx0\setupfiles\help\user.files\image037.jpg
- %TEMP%\rarsfx0\setupfiles\help\user.files\image036.jpg
- %TEMP%\rarsfx0\setupfiles\help\user.files\image035.jpg
- %TEMP%\rarsfx0\setupfiles\help\user.files\image101.jpg
- %TEMP%\rarsfx0\setupfiles\images\hotfixinstall.gif
- %TEMP%\rarsfx0\setupfiles\logviewer.exe
- %TEMP%\rarsfx0\setupfiles\help\user.files\user_clip_image008.jpg
- %TEMP%\rarsfx0\setupfiles\lockscreen.exe
- %TEMP%\rarsfx0\setupfiles\linkworkhds2.exe
- %TEMP%\rarsfx0\setupfiles\libeay32.dll
- %TEMP%\rarsfx0\setupfiles\installdriverx64.exe
- %TEMP%\rarsfx0\setupfiles\inject.dll
- %TEMP%\rarsfx0\setupfiles\images\ruleok.gif
- %TEMP%\rarsfx0\setupfiles\help\user.files\image034.jpg
- %TEMP%\rarsfx0\setupfiles\images\ruleerror.gif
- %TEMP%\rarsfx0\setupfiles\hotfixmgr.dll
- %TEMP%\rarsfx0\setupfiles\hotfixagent.exe
- %TEMP%\rarsfx0\setupfiles\hostname.dll
- %TEMP%\rarsfx0\setupfiles\hodmgr.dll
- %TEMP%\rarsfx0\setupfiles\help\user.htm
- %TEMP%\rarsfx0\setupfiles\help\user.files\user_clip_image010.jpg
- %TEMP%\rarsfx0\setupfiles\help\user.files\user_clip_image004.jpg
- %TEMP%\rarsfx0\setupfiles\help\user.files\user_clip_image006.jpg
- %TEMP%\rarsfx0\setupfiles\help\user.files\image033.jpg
- %TEMP%\rarsfx0\setupfiles\help\user.files\image015.jpg
- %TEMP%\rarsfx0\setupfiles\help\user.files\image012.jpg
- %TEMP%\rarsfx0\setupfiles\help\user.files\image011.jpg
- %TEMP%\rarsfx0\setupfiles\help\user.files\image010.jpg
- %TEMP%\rarsfx0\setupfiles\help\user.files\image009.jpg
- %TEMP%\rarsfx0\setupfiles\help\user.files\image008.jpg
- %TEMP%\rarsfx0\setupfiles\help\user.files\image007.jpg
- %TEMP%\rarsfx0\setupfiles\help\user.files\image013.jpg
- %TEMP%\rarsfx0\setupfiles\help\user.files\image006.jpg
- %TEMP%\rarsfx0\setupfiles\help\user.files\image004.jpg
- %TEMP%\rarsfx0\setupfiles\help\user.files\image003.jpg
- %TEMP%\rarsfx0\setupfiles\help\user.files\image002.jpg
- %TEMP%\rarsfx0\setupfiles\help\user.files\image001.jpg
- %TEMP%\rarsfx0\setupfiles\help\user.files\header.htm
- %TEMP%\rarsfx0\setupfiles\help\user.files\filelist.xml
- %TEMP%\rarsfx0\setupfiles\help\user.files\image005.jpg
- %TEMP%\rarsfx0\setupfiles\help\user.files\image023.jpg
- %TEMP%\rarsfx0\setupfiles\help\user.files\image031.jpg
- %TEMP%\rarsfx0\setupfiles\help\user.files\image016.jpg
- %TEMP%\rarsfx0\setupfiles\help\user.files\image030.jpg
- %TEMP%\rarsfx0\setupfiles\help\user.files\image029.jpg
- %TEMP%\rarsfx0\setupfiles\help\user.files\image028.jpg
- %TEMP%\rarsfx0\setupfiles\help\user.files\image027.jpg
- %TEMP%\rarsfx0\setupfiles\help\user.files\image026.jpg
- %TEMP%\rarsfx0\setupfiles\help\user.files\image025.jpg
- %TEMP%\rarsfx0\setupfiles\help\user.files\image032.jpg
- %TEMP%\rarsfx0\setupfiles\help\user.files\image024.jpg
- %TEMP%\rarsfx0\setupfiles\help\user.files\image022.jpg
- %TEMP%\rarsfx0\setupfiles\help\user.files\image021.jpg
- %TEMP%\rarsfx0\setupfiles\help\user.files\image020.jpg
- %TEMP%\rarsfx0\setupfiles\help\user.files\image019.jpg
- %TEMP%\rarsfx0\setupfiles\help\user.files\image018.jpg
- %TEMP%\rarsfx0\setupfiles\help\user.files\image017.jpg
- %TEMP%\rarsfx0\setupfiles\help\user.files\image014.jpg
- %TEMP%\rarsfx0\setupfiles\reghook.dll
- %TEMP%\rarsfx0\venus .cer
- %TEMP%\rarsfx0\setupfiles\mfc80.dll
- %TEMP%\rarsfx0\setupfiles\sso_logo.bmp
- %TEMP%\rarsfx0\setupfiles\ssleay32.dll
- %TEMP%\rarsfx0\setupfiles\sqlite3.dll
- %TEMP%\rarsfx0\setupfiles\sporder.dll
- %TEMP%\rarsfx0\setupfiles\smsmgr.dll
- %TEMP%\rarsfx0\setupfiles\shutdown.dll
- %TEMP%\rarsfx0\setupfiles\startccmon.exe
- %TEMP%\rarsfx0\setupfiles\setwindowsfirewall.dll
- %TEMP%\rarsfx0\setupfiles\setup.ini
- %TEMP%\rarsfx0\setupfiles\setup.exe
- %TEMP%\rarsfx0\setupfiles\setipinwin7.dll
- %TEMP%\rarsfx0\setupfiles\servcom.dll
- %TEMP%\rarsfx0\setupfiles\secretaudit.dll
- %TEMP%\rarsfx0\setupfiles\secedit.exe
- %TEMP%\rarsfx0\setupfiles\setupframerestx.dll
- %TEMP%\rarsfx0\setupfiles\wlanapis.dll
- %TEMP%\rarsfx0\setupfiles\mfc42.dll
- %TEMP%\rarsfx0\setupfiles\storageview.exe
- %TEMP%\rarsfx0\setupframerestx.dll
- %TEMP%\rarsfx0\setupfiles\zip32.dll
- %TEMP%\rarsfx0\setupfiles\xpfirewall2.exe
- %TEMP%\rarsfx0\setupfiles\xpfirewall.exe
- %TEMP%\rarsfx0\setupfiles\xmlwrapper.dll
- %TEMP%\rarsfx0\setupfiles\wtsbox.exe
- %TEMP%\rarsfx0\setupfiles\secdata.dll
- %TEMP%\rarsfx0\setupfiles\wmigethotfixlist.exe
- %TEMP%\rarsfx0\setupfiles\wirelessconfigtool.exe
- %TEMP%\rarsfx0\setupfiles\winfw.dll
- %TEMP%\rarsfx0\setupfiles\wineventlog.dll
- %TEMP%\rarsfx0\setupfiles\versionconfig.ini
- %TEMP%\rarsfx0\setupfiles\unzip32.dll
- %TEMP%\rarsfx0\setupfiles\unicows.dll
- %TEMP%\rarsfx0\setupfiles\statusdialog.exe
- %TEMP%\rarsfx0\setupfiles\help\user.files\colorschememapping.xml
- %TEMP%\rarsfx0\setupfiles\secdata\hardwareconfig.xml
- %TEMP%\rarsfx0\setupfiles\peap.xml
- %TEMP%\rarsfx0\setupfiles\msvcr90.dll
- %TEMP%\rarsfx0\setupfiles\msvcr80.dll
- %TEMP%\rarsfx0\setupfiles\msvcp90.dll
- %TEMP%\rarsfx0\setupfiles\msvcp80.dll
- %TEMP%\rarsfx0\setupfiles\msvcp60.dll
- %TEMP%\rarsfx0\setupfiles\msvcm90.dll
- %TEMP%\rarsfx0\setupfiles\msvcrt.dll
- %TEMP%\rarsfx0\setupfiles\msvcm80.dll
- %TEMP%\rarsfx0\setupfiles\microsoft.vc90.crt.manifest
- %TEMP%\rarsfx0\setupfiles\microsoft.vc80.mfc.manifest
- %TEMP%\rarsfx0\setupfiles\microsoft.vc80.crt.manifest
- %TEMP%\rarsfx0\setupfiles\mfcm80u.dll
- %TEMP%\rarsfx0\setupfiles\mfcm80.dll
- %TEMP%\rarsfx0\setupfiles\mfc80u.dll
- %TEMP%\rarsfx0\setupfiles\mseapcltc.dll
- %TEMP%\rarsfx0\setupfiles\logviewer.exe.manifest
- %TEMP%\rarsfx0\setupfiles\sdagent.exe
- %TEMP%\rarsfx0\setupfiles\peap2.xml
- %TEMP%\rarsfx0\setupfiles\scrnsave.scr
- %TEMP%\rarsfx0\setupfiles\scriptobject.tlb
- %TEMP%\rarsfx0\setupfiles\schook.dll
- %TEMP%\rarsfx0\setupfiles\resource\cconline.ico
- %TEMP%\rarsfx0\setupfiles\resource\ccoffline.ico
- %TEMP%\rarsfx0\setupfiles\resource\ccalert.ico
- %TEMP%\rarsfx0\setupfiles\sdagent.ini
- %TEMP%\rarsfx0\setupfiles\reghook.sys
- %TEMP%\rarsfx0\setupfiles\ptdecrypt.ini
- %TEMP%\rarsfx0\setupfiles\ptdecrypt.exe
- %TEMP%\rarsfx0\setupfiles\printaudithook.dll
- %TEMP%\rarsfx0\setupfiles\printaudit.dll
- %TEMP%\rarsfx0\setupfiles\pluginlist.xml
- %TEMP%\rarsfx0\setupfiles\peripheral.dll
- %TEMP%\rarsfx0\setupfiles\outlinkmon.dll
- %TEMP%\rarsfx0\setupfiles\storagemgr.dll
- %TEMP%\rarsfx0\setupfiles\fwsetup.dll
- %TEMP%\rarsfx0\setupfiles\epolccsetup.dll
- %TEMP%\rarsfx0\setupfiles\dll\x32\epolgina.dll
- %TEMP%\rarsfx0\setupfiles\dll\x32\epolcredentialprovider.dll
- %TEMP%\rarsfx0\setupfiles\disksn32.dll
- %TEMP%\rarsfx0\setupfiles\disablewindowseapol.dll
- %TEMP%\rarsfx0\setupfiles\directop.dll
- %TEMP%\rarsfx0\setupfiles\dialupmon.dll
- %TEMP%\rarsfx0\setupfiles\dll\x64\epolcredentialprovider.dll
- %TEMP%\rarsfx0\setupfiles\dialspy.dll
- %TEMP%\rarsfx0\setupfiles\dbghelp.dll
- %TEMP%\rarsfx0\setupfiles\control.ini
- %TEMP%\rarsfx0\setupfiles\commonfunc.dll
- %TEMP%\rarsfx0\setupfiles\clientregister.dll
- %TEMP%\rarsfx0\setupfiles\clientmgr.dll
- %TEMP%\rarsfx0\setupfiles\checksoftware.dll
- %TEMP%\rarsfx0\setupfiles\devicecontrol.exe
- %TEMP%\rarsfx0\setupfiles\driver-x64\eposdf.sys
- %TEMP%\rarsfx0\setupfiles\drvsetup\netsf.inf
- %TEMP%\rarsfx0\setupfiles\driver\eposdf.inf
- %TEMP%\rarsfx0\setupfiles\drvsetup\lpsimd.dl_
- %TEMP%\rarsfx0\setupfiles\drvsetup\installdrv.bat
- %TEMP%\rarsfx0\setupfiles\drvsetup\drvsetup.exe
- %TEMP%\rarsfx0\setupfiles\drivercommunication.dll
- %TEMP%\rarsfx0\setupfiles\driver-x64\eposfsf.sys
- %TEMP%\rarsfx0\setupfiles\driver-x64\eposfsf.inf
- %TEMP%\rarsfx0\setupfiles\checkntadmin.dll
- %TEMP%\rarsfx0\setupfiles\driver-x64\eposfsf.cat
- %TEMP%\rarsfx0\setupfiles\driver-x64\eposdf.inf
- %TEMP%\rarsfx0\setupfiles\driver-x64\eposdf.cat
- %TEMP%\rarsfx0\setupfiles\driver\eposfsf.sys
- %TEMP%\rarsfx0\setupfiles\driver\eposfsf.inf
- %TEMP%\rarsfx0\setupfiles\driver\eposfsf.cat
- %TEMP%\rarsfx0\setupfiles\driver\eposdf.sys
- %TEMP%\rarsfx0\setupfiles\dll\x64\epolgina.dll
- %TEMP%\rarsfx0\setupfiles\driver\eposdf.cat
- %TEMP%\rarsfx0\setupfiles\ccmon.exe
- %TEMP%\rarsfx0\setupfiles\3rdparty\windowsupdateagent20-x86.exe
- %TEMP%\rarsfx0\setupfiles\3rdparty\msxml4sp2\msxml4a.dll
- %TEMP%\rarsfx0\setupfiles\3rdparty\msxml4sp2\msxml4.dll
- %TEMP%\rarsfx0\setup.ini
- %TEMP%\rarsfx0\setup.exe
- %TEMP%\rarsfx0\mseapcltc.dll
- %TEMP%\rarsfx0\license.txt
- %TEMP%\rarsfx0\setupfiles\3rdparty\msxml4sp2\msxml4r.dll
- %TEMP%\rarsfx0\installdriverx64.exe
- %TEMP%\rarsfx0\fwsetup-x64.dll
- %TEMP%\rarsfx0\eposfsfsetup.dll
- %TEMP%\rarsfx0\eposfsfsetup-x64.dll
- %TEMP%\rarsfx0\epolccsetup.dll
- %TEMP%\rarsfx0\disablewindowseapol.dll
- %TEMP%\rarsfx0\checkntadmin.dll
- %TEMP%\rarsfx0\fwsetup.dll
- %TEMP%\rarsfx0\setupfiles\baseservice.dll
- %TEMP%\rarsfx0\setupfiles\cc.ini
- %TEMP%\rarsfx0\setupfiles\advhotfixlist.dll
- %TEMP%\rarsfx0\setupfiles\cad.exe
- %TEMP%\rarsfx0\setupfiles\burnaudit.dll
- %TEMP%\rarsfx0\setupfiles\boot\ntldr.d
- %TEMP%\rarsfx0\setupfiles\basevirus.dll
- %TEMP%\rarsfx0\setupfiles\baseuserenv.dll
- %TEMP%\rarsfx0\setupfiles\basesoft.dll
- %TEMP%\rarsfx0\setupfiles\cccontrolrestx.dll
- %TEMP%\rarsfx0\setupfiles\baseshareres.dll
- %TEMP%\rarsfx0\setupfiles\baseregfun.dll
- %TEMP%\rarsfx0\setupfiles\baseproc.dll
- %TEMP%\rarsfx0\setupfiles\baselocalsec.dll
- %TEMP%\rarsfx0\setupfiles\authenmgr.dll
- %TEMP%\rarsfx0\setupfiles\assetid.js
- %TEMP%\rarsfx0\setupfiles\appadmission.dll
- %TEMP%\rarsfx0\setupfiles\3rdparty\scr56chs-2k.exe
- %TEMP%\rarsfx0\setupfiles\drvsetup\winxp\netsf_m.inf
- %TEMP%\rarsfx0\setupfiles\firewall.dll
- %TEMP%\rarsfx0\setupfiles\drvsetup\win2000\lpsimd.sys
- %TEMP%\rarsfx0\setupfiles\eap\eseap.dll
- %TEMP%\rarsfx0\setupfiles\eap\eap_epol.dll
- %TEMP%\rarsfx0\setupfiles\drvsetup-x64\winvista\tdifw_drv.sys
- %TEMP%\rarsfx0\setupfiles\drvsetup-x64\winvista\netsf_m.inf
- %TEMP%\rarsfx0\setupfiles\drvsetup-x64\winvista\netsf_m.cat
- %TEMP%\rarsfx0\setupfiles\drvsetup-x64\winvista\netsf.inf
- %TEMP%\rarsfx0\setupfiles\eap\eseap64.dll
- %TEMP%\rarsfx0\setupfiles\drvsetup-x64\winvista\netsf.cat
- %TEMP%\rarsfx0\setupfiles\drvsetup-x64\winvista\lpsimd.dl_
- %TEMP%\rarsfx0\setupfiles\drvsetup-x64\win2003\tdifw_drv.sys
- %TEMP%\rarsfx0\setupfiles\drvsetup-x64\win2003\netsf_m.inf
- %TEMP%\rarsfx0\setupfiles\drvsetup-x64\win2003\netsf_m.cat
- %TEMP%\rarsfx0\setupfiles\drvsetup-x64\win2003\netsf.inf
- %TEMP%\rarsfx0\setupfiles\drvsetup-x64\win2003\netsf.cat
- %TEMP%\rarsfx0\setupfiles\drvsetup-x64\winvista\lpsimd.sys
- %TEMP%\rarsfx0\setupfiles\escccontrol.exe
- %TEMP%\rarsfx0\setupfiles\drvsetup\win2000\lpsimd.dl_
- %TEMP%\rarsfx0\setupfiles\epolupdate363.exe
- %TEMP%\rarsfx0\setupfiles\filemgr.dll
- %TEMP%\rarsfx0\setupfiles\filekeywordaudit.mdb
- %TEMP%\rarsfx0\setupfiles\fileaudit.dll
- %TEMP%\rarsfx0\setupfiles\ext_route.dll
- %TEMP%\rarsfx0\setupfiles\ext_hotfix.dll
- %TEMP%\rarsfx0\setupfiles\ext_account.dll
- %TEMP%\rarsfx0\setupfiles\drvsetup-x64\win2003\lpsimd.sys
- %TEMP%\rarsfx0\setupfiles\excludeaudiprolist.xml
- %TEMP%\rarsfx0\setupfiles\escc.exe
- %TEMP%\rarsfx0\setupfiles\eposfsfsetup.dll
- %TEMP%\rarsfx0\setupfiles\eposfsfsetup-x64.dll
- %TEMP%\rarsfx0\setupfiles\eposfsf.dll
- %TEMP%\rarsfx0\setupfiles\eposdfapi.dll
- %TEMP%\rarsfx0\setupfiles\epolwlnf.dll
- %TEMP%\rarsfx0\setupfiles\emcclient.exe
- %TEMP%\rarsfx0\setupfiles\fwsetup-x64.dll
- %TEMP%\rarsfx0\setupfiles\drvsetup-x64\win2003\lpsimd.dl_
- %TEMP%\rarsfx0\setupfiles\drvsetup\winvista\netsf_m.cat
- %TEMP%\rarsfx0\setupfiles\drvsetup\winvista\lpsimd.sys
- %TEMP%\rarsfx0\setupfiles\drvsetup\winvista\lpsimd.dl_
- %TEMP%\rarsfx0\setupfiles\drvsetup\win2003\tdifw_drv.sys
- %TEMP%\rarsfx0\setupfiles\drvsetup\win2003\netsf_m.inf
- %TEMP%\rarsfx0\setupfiles\drvsetup\win2003\netsf_m.cat
- %TEMP%\rarsfx0\setupfiles\drvsetup\win2003\netsf.inf
- %TEMP%\rarsfx0\setupfiles\drvsetup\winvista\netsf.cat
- %TEMP%\rarsfx0\setupfiles\drvsetup\win2003\netsf.cat
- %TEMP%\rarsfx0\setupfiles\drvsetup\win2003\lpsimd.dl_
- %TEMP%\rarsfx0\setupfiles\drvsetup\win2000\tdifw_drv.sys
- %TEMP%\rarsfx0\setupfiles\drvsetup\win2000\netsf_m.inf
- %TEMP%\rarsfx0\setupfiles\drvsetup\win2000\netsf_m.cat
- %TEMP%\rarsfx0\setupfiles\drvsetup\win2000\netsf.inf
- %TEMP%\rarsfx0\setupfiles\drvsetup\win2000\netsf.cat
- %TEMP%\rarsfx0\setupfiles\drvsetup\win2003\lpsimd.sys
- %TEMP%\rarsfx0\setupfiles\drvsetup\netsf_m.inf
- %TEMP%\rarsfx0\setupfiles\drvsetup-x64\netsf_m.cat
- %TEMP%\rarsfx0\setupfiles\drvsetup\winvista\netsf_m.inf
- %TEMP%\rarsfx0\setupfiles\drvsetup-x64\netsf.inf
- %TEMP%\rarsfx0\setupfiles\drvsetup-x64\netsf.cat
- %TEMP%\rarsfx0\setupfiles\drvsetup-x64\lpsimd.dl_
- %TEMP%\rarsfx0\setupfiles\drvsetup-x64\installdrv.bat
- %TEMP%\rarsfx0\setupfiles\drvsetup-x64\drvsetup.exe
- %TEMP%\rarsfx0\setupfiles\drvsetup-x64\drvsetup-x64.exe
- %TEMP%\rarsfx0\setupfiles\drvsetup-x64\netsf_m.inf
- %TEMP%\rarsfx0\setupfiles\drvsetup\winxp\tdifw_drv.sys
- %TEMP%\rarsfx0\setupfiles\drvsetup\winxp\netsf_m.cat
- %TEMP%\rarsfx0\setupfiles\drvsetup\winxp\netsf.inf
- %TEMP%\rarsfx0\setupfiles\drvsetup\winxp\netsf.cat
- %TEMP%\rarsfx0\setupfiles\drvsetup\winxp\lpsimd.sys
- %TEMP%\rarsfx0\setupfiles\drvsetup\winxp\lpsimd.dl_
- %TEMP%\rarsfx0\setupfiles\drvsetup\winvista\tdifw_drv.sys
- %TEMP%\rarsfx0\setupfiles\drvsetup\winvista\netsf.inf
- %TEMP%\rarsfx0\versionconfig.ini
Miscellaneous
Searches for the following windows
- ClassName: 'EDIT' WindowName: ''
- ClassName: '' WindowName: ''
Creates and executes the following
- '%TEMP%\rarsfx0\setup.exe'
- '%TEMP%\rarsfx0\addfirewallrule.exe'
- '%WINDIR%\syswow64\cmd.exe' /c taskkill.exe /f /im msiexec.exe' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c certutil -addstore "TrustedPublisher" venus.cer' (with hidden window)
- '%TEMP%\rarsfx0\addfirewallrule.exe' ' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c taskkill.exe /f /im msiexec.exe
- '%WINDIR%\syswow64\cmd.exe' /c certutil -addstore "TrustedPublisher" venus.cer
- '%WINDIR%\syswow64\certutil.exe' -addstore "TrustedPublisher" venus.cer
