Technical Information
Malicious functions:
Executes the following:
- '<SYSTEM32>\taskkill.exe' /f /im rfusclient.exe
- '<SYSTEM32>\taskkill.exe' /f /im rutserv.exe
Modifies file system:
Creates the following files:
- C:\vp8decoder.dll
- C:\rutserv.exe
- C:\vp8encoder.dll
- C:\install.vbs
- C:\regedit.reg
- C:\test.sfx.exe
- C:\exec.bat
- C:\test.exe
- C:\rfusclient.exe
- C:\install.bat
Miscellaneous:
Searches for the following windows:
- ClassName: '' WindowName: ''
- ClassName: 'EDIT' WindowName: ''
Creates and executes the following:
- '<SYSTEM32>\wscript.exe' "c:\install.vbs"
- 'C:\test.exe'
- 'C:\test.sfx.exe' -p123 -dc:\
Executes the following:
- '<SYSTEM32>\cmd.exe' /c ""c:\install.bat" "
- '<SYSTEM32>\cmd.exe' /c ""c:\exec.bat" "
