Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'Windows Update' = '%CommonProgramFiles(x86)%\System\rager.exe'
Creates the following files on removable media
- <Drive name for removable media>:\mibicho.exe
- <Drive name for removable media>:\autorun.inf
Malicious functions
To bypass firewall, removes or modifies the following registry keys
- [HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%CommonProgramFiles(x86)%\System\rager.exe' = '%CommonProgramFiles(x...
Modifies file system
Creates the following files
- %CommonProgramFiles(x86)%\system\rager.exe
Sets the 'hidden' attribute to the following files
- <Drive name for removable media>:\mibicho.exe
- <Drive name for removable media>:\autorun.inf
- %CommonProgramFiles(x86)%\system\rager.exe
Network activity
Connects to
- 'xx#.xxx.xxx':95
- 'xx##.xxx.xxx':81
UDP
- DNS ASK xx#.xxx.xxx
- DNS ASK xx##.xxx.xxx
Miscellaneous
Creates and executes the following
- '%CommonProgramFiles(x86)%\system\rager.exe'
Executes the following
- '%CommonProgramFiles(x86)%\system\rager.exe' ' (with hidden window)
