Technical Information
To ensure autorun and distribution
Sets the following service settings
- [<HKLM>\System\CurrentControlSet\Services\RManService] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\RManService] 'ImagePath' = '%APPDATA%\RMS\rutserv.exe'
Creates the following services
- 'RManService' %APPDATA%\RMS\rutserv.exe
Malicious functions
Executes the following
- '%WINDIR%\syswow64\taskkill.exe' /f /im rutserv.exe
- '%WINDIR%\syswow64\taskkill.exe' /f /im rfusclient.exe
Modifies file system
Creates the following files
- %APPDATA%\windows\open.vbs
- %APPDATA%\rms\vp8encoder.dll
- %APPDATA%\rms\vp8decoder.dll
- %APPDATA%\rms\russian.lg
- %APPDATA%\rms\rutserv.exe
- %APPDATA%\rms\rfusclient.exe
- C:\log\windows\hiscomponent\install.bat
- C:\log\windows\hiscomponent\regedit.reg
- C:\log\install.bat
- C:\log\go.au3
- %APPDATA%\rms\autoit3.exe
- C:\log\autoit3.exe
- C:\log\vp8decoder.dll
- C:\log\rutserv.exe
- C:\log\russian.lg
- C:\log\rfusclient.exe
- C:\log\install.vbs
- %TEMP%\ztmp\tmp8645.exe
- %TEMP%\ztmp\tmp3115.bat
- %APPDATA%\windows\build\data.exe
- %APPDATA%\windows\run.exe
- C:\log\vp8encoder.dll
- %APPDATA%\rms\go.au3
Deletes the following files
- %TEMP%\ztmp\tmp8645.exe
Network activity
Connects to
- 'rm##sys.ru':80
UDP
- DNS ASK rm##sys.ru
Miscellaneous
Searches for the following windows
- ClassName: 'EDIT' WindowName: ''
- ClassName: '' WindowName: ''
- ClassName: 'RegEdit_RegEdit' WindowName: ''
Creates and executes the following
- '%WINDIR%\syswow64\wscript.exe' "%APPDATA%\Windows\open.vbs"
- '%APPDATA%\windows\run.exe'
- '%APPDATA%\windows\build\data.exe' -p24T7234F9GY234908TJEAODRIFH8W0934HTGJ -d C:\Log
- '%WINDIR%\syswow64\wscript.exe' "C:\Log\install.vbs"
- '%WINDIR%\syswow64\wscript.exe' "C:\Log\install.vbs" Run
- '%APPDATA%\rms\rutserv.exe' /silentinstall
- '%APPDATA%\rms\rutserv.exe' /firewall
- '%APPDATA%\rms\rutserv.exe' /start
- '%APPDATA%\rms\rutserv.exe'
- '%APPDATA%\rms\rfusclient.exe'
- '%APPDATA%\rms\rfusclient.exe' /tray
- '%APPDATA%\rms\autoit3.exe' go.au3
- '%APPDATA%\windows\run.exe' ' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c ""C:\Log\Windows\hiscomponent\install.bat" "' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c if not exist "%TEMP%\afolder" mkdir "%TEMP%\afolder"
- '%WINDIR%\syswow64\cmd.exe' /c if not exist "%TEMP%\ztmp" mkdir "%TEMP%\ztmp"
- '%WINDIR%\syswow64\cmd.exe' /c attrib +h %TEMP%\ztmp
- '%WINDIR%\syswow64\attrib.exe' +h %TEMP%\ztmp
- '%WINDIR%\syswow64\cmd.exe' /c if exist "%TEMP%\ztmp\tmp3115.bat" del "%TEMP%\ztmp\tmp3115.bat"
- '%WINDIR%\syswow64\cmd.exe' /c if exist "%TEMP%\ztmp\tmp8645.exe" del "%TEMP%\ztmp\tmp8645.exe"
- '%WINDIR%\syswow64\cmd.exe' /c %TEMP%\ztmp\tmp3115.bat "%APPDATA%\Windows\run.exe"
- '%WINDIR%\syswow64\cmd.exe' /c ""C:\Log\Windows\hiscomponent\install.bat" "
- '%WINDIR%\syswow64\reg.exe' delete "HKLM\SYSTEM\Remote Manipulator System" /f
- '%WINDIR%\syswow64\regedit.exe' /s "Windows\hiscomponent\regedit.reg"
- '%WINDIR%\syswow64\timeout.exe' 1
- '%WINDIR%\syswow64\timeout.exe' 2
- '%WINDIR%\syswow64\attrib.exe' -s -h "%APPDATA%\RMS"
- '%WINDIR%\syswow64\attrib.exe' -s -h "%APPDATA%\RMS\*.*"
- '%WINDIR%\syswow64\attrib.exe' -s -h "%APPDATA%\RMS\rfusclient.exe"
- '%WINDIR%\syswow64\attrib.exe' -s -h "%APPDATA%\RMS\rutserv.exe"
