Technical Information
To ensure autorun and distribution
Creates the following services
- [<HKLM>\System\CurrentControlSet\Services\RManService] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\RManService] 'ImagePath' = '%ProgramFiles%\Server\rutserv.exe'
Malicious functions
Executes the following
- '%WINDIR%\syswow64\taskkill.exe' /f /im rutserv.exe
- '%WINDIR%\syswow64\taskkill.exe' /f /im rfusclient.exe
Modifies file system
Creates the following files
- %TEMP%\rarsfx0\vscanner.exe
- C:\hex\install.vbs
- C:\hex\regedit.reg
- C:\hex\rfusclient.exe
- C:\hex\rutserv.exe
- C:\hex\install.bat
- C:\hex\vp8decoder.dll
- C:\hex\vp8encoder.dll
- C:\hex\user01.jpg
- %ProgramFiles%\server\rfusclient.exe
- nul
- %ProgramFiles%\server\rutserv.exe
- %ProgramFiles%\server\vp8decoder.dll
- %ProgramFiles%\server\vp8encoder.dll
Sets the 'hidden' attribute to the following files
- %ProgramFiles%\server\rfusclient.exe
- %ProgramFiles%\server\rutserv.exe
- %ProgramFiles%\server\vp8decoder.dll
- %ProgramFiles%\server\vp8encoder.dll
Deletes the following files
- %TEMP%\rarsfx0\vscanner.exe
- C:\hex\install.vbs
- C:\hex\regedit.reg
- C:\hex\rfusclient.exe
- C:\hex\rutserv.exe
- C:\hex\user01.jpg
- C:\hex\vp8decoder.dll
- C:\hex\vp8encoder.dll
Network activity
TCP
HTTP GET requests
- http://rm##sys.ru/utils/inet_id_notify.php?te####
UDP
- DNS ASK rm##sys.ru
- DNS ASK rm#####ver.tektonit.ru
Miscellaneous
Searches for the following windows
- ClassName: 'EDIT' WindowName: ''
- ClassName: '' WindowName: ''
- ClassName: 'RegEdit_RegEdit' WindowName: ''
Creates and executes the following
- '%TEMP%\rarsfx0\vscanner.exe'
- '%WINDIR%\syswow64\wscript.exe' "C:\Hex\install.vbs"
- '%ProgramFiles%\server\rutserv.exe' /silentinstall
- '%ProgramFiles%\server\rutserv.exe' /firewall
- '%ProgramFiles%\server\rutserv.exe' /start
- '%ProgramFiles%\server\rutserv.exe'
- '%ProgramFiles%\server\rfusclient.exe'
- '%ProgramFiles%\server\rfusclient.exe' /tray
- '%WINDIR%\syswow64\cmd.exe' /c ""C:\Hex\install.bat" "' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c ""C:\Hex\install.bat" "
- '%WINDIR%\syswow64\reg.exe' delete "HKLM\SYSTEM\Remote Manipulator System" /f
- '%WINDIR%\syswow64\regedit.exe' /s "regedit.reg"
- '%WINDIR%\syswow64\timeout.exe' 1
- '%WINDIR%\syswow64\timeout.exe' 2
- '%WINDIR%\syswow64\attrib.exe' +s +h "%ProgramFiles%\Server\*.*"
- '%WINDIR%\syswow64\timeout.exe' 3
