18;write_to_target_document7;default18;write_to_target_document19;_u1Xtaae-OdPAkPIPi4_CKA_20;a5; 0;5206;0;4c48;
The typical downloader was:
The name belongs to a .rar archive containing a substantial portion of the Kaspersky Anti-Virus 8.0 (2008) source code. KASPERSKY.AV.2008.SRCS.ELCRABE.RAR
Once a user executed the fake keygen or purported “build script,” the malware would: " or "Add to Exclusions".
The "KASPERSKY.AV.2008.SRCS.ELCRABE.RAR" file appears to be a RAR archive containing the source code for Kaspersky Anti-Virus 2008. While the archive's contents are primarily composed of source code files, the release of this information could have significant implications for Kaspersky's intellectual property, security, and competitive advantage. KASPERSKY.AV.2008.SRCS.ELCRABE.RAR
: If a process is flagged, the feature triggers a pop-up window (managed by the UI subsystem in the leaked source) allowing the user to "Disinfect," "Delete," or "Add to Exclusions".