Technical Information
Malicious functions
To complicate detection of its presence in the operating system,
modifies the following system settings:
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoRun' = '00000000'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'DisallowRun' = '00000000'
Modifies file system
Creates the following files
- %TEMP%\rarsfx0\idm_6.4x_crack_v20.4.exe
- %TEMP%\idm_updt.vbs
- %TEMP%\crk_updt.vbs
- %ProgramFiles%\winrar\rarreg.key
- %APPDATA%\winrar\rarreg.key
Network activity
Connects to
- 'id#.0dy.ir':443
TCP
HTTP GET requests
- http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?a4##############
Other
- 'id#.0dy.ir':443
UDP
- DNS ASK id#.0dy.ir
Miscellaneous
Searches for the following windows
- ClassName: 'EDIT' WindowName: ''
Creates and executes the following
- '%TEMP%\rarsfx0\idm_6.4x_crack_v20.4.exe'
Executes the following
- '%WINDIR%\syswow64\wscript.exe' "%TEMP%\\CRK_UPDT.vbs" "https://idm.0dy.ir/" "Version" "Download_URL" "20.4" "Crack" "%ProgramFiles%\Mozilla Firefox\firefox.exe" silent
