Technical Information
Malicious functions
Executes the following
- '%WINDIR%\syswow64\taskkill.exe' /im "FRec313.exe" /f
Modifies file system
Creates the following files
- %TEMP%\is-jfrrs.tmp\is-h25hr.tmp
- %TEMP%\is-62sol.tmp\_isetup\_regdll.tmp
- %TEMP%\is-62sol.tmp\_isetup\_setup64.tmp
- %TEMP%\is-62sol.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-62sol.tmp\_isetup\_isdecmp.dll
- %TEMP%\is-62sol.tmp\_isetup\_iscrypt.dll
- %ProgramFiles(x86)%\fiusoftfr\frec313\is-7sedl.tmp
- %ProgramFiles(x86)%\fiusoftfr\frec313\is-gml8v.tmp
- %ProgramFiles(x86)%\fiusoftfr\frec313\is-0o8cn.tmp
- %ProgramFiles(x86)%\fiusoftfr\frec313\is-4s47n.tmp
- %ProgramFiles(x86)%\fiusoftfr\frec313\is-5b4nv.tmp
- %ProgramFiles(x86)%\fiusoftfr\frec313\data\is-lhpng.tmp
- %ProgramFiles(x86)%\fiusoftfr\frec313\unins000.dat
- %ProgramFiles(x86)%\fiusoftfr\frec313\frec313.exe
- %APPDATA%\{846ee340-7039-11de-9d20-806e6f6e6963}\el7g2igtnfasd.exe
Deletes the following files
- %TEMP%\is-jfrrs.tmp\is-h25hr.tmp
- %ProgramFiles(x86)%\fiusoftfr\frec313\frec313.exe
Moves the following files
- from %ProgramFiles(x86)%\fiusoftfr\frec313\is-7sedl.tmp to %ProgramFiles(x86)%\fiusoftfr\frec313\unins000.exe
- from %ProgramFiles(x86)%\fiusoftfr\frec313\is-gml8v.tmp to %ProgramFiles(x86)%\fiusoftfr\frec313\frec313.exe
- from %ProgramFiles(x86)%\fiusoftfr\frec313\is-0o8cn.tmp to %ProgramFiles(x86)%\fiusoftfr\frec313\finalrecovery.chm
- from %ProgramFiles(x86)%\fiusoftfr\frec313\is-4s47n.tmp to %ProgramFiles(x86)%\fiusoftfr\frec313\readme.txt
- from %ProgramFiles(x86)%\fiusoftfr\frec313\is-5b4nv.tmp to %ProgramFiles(x86)%\fiusoftfr\frec313\preview.exe
- from %ProgramFiles(x86)%\fiusoftfr\frec313\data\is-lhpng.tmp to %ProgramFiles(x86)%\fiusoftfr\frec313\data\config.xml
Network activity
Connects to
- '45.##.253.56':80
- '45.##.253.72':80
- '45.##.253.75':80
TCP
HTTP GET requests
- http://45.##.253.56/advertisting/plus.php?s=###############################
- http://45.##.253.72/default/stuk.php
- http://45.##.253.72/default/puk.php
- http://45.##.253.75/dll.php
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: 'D2435d_FIUsoftFRFRec313Class_D2435d'
- ClassName: '' WindowName: ''
Creates and executes the following
- '%TEMP%\is-jfrrs.tmp\is-h25hr.tmp' /SL4 $B0218 "<Full path to file>" 2740209 52736
- '%ProgramFiles(x86)%\fiusoftfr\frec313\frec313.exe'
- '%APPDATA%\{846ee340-7039-11de-9d20-806e6f6e6963}\el7g2igtnfasd.exe'
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /im "FRec313.exe" /f & erase "%ProgramFiles(x86)%\FIUsoftFR\FRec313\FRec313.exe" & exit' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /im "FRec313.exe" /f & erase "%ProgramFiles(x86)%\FIUsoftFR\FRec313\FRec313.exe" & exit
