Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\smsss
- <SYSTEM32>\tasks\explorere
- <SYSTEM32>\tasks\smss
- <SYSTEM32>\tasks\furichekerpremiumf
- <SYSTEM32>\tasks\explorer
- <SYSTEM32>\tasks\furichekerpremium
- <SYSTEM32>\tasks\mdmm
- <SYSTEM32>\tasks\mdm
- <SYSTEM32>\tasks\servicess
- <SYSTEM32>\tasks\services
- <SYSTEM32>\tasks\dwmd
- <SYSTEM32>\tasks\dwm
- <SYSTEM32>\tasks\lsass
- <SYSTEM32>\tasks\lsassl
Malicious functions
Reads files which store third party applications passwords
- %ProgramFiles(x86)%\steam\config\config.vdf
- %ProgramFiles(x86)%\steam\config\dialogconfig.vdf
- %LOCALAPPDATA%\google\chrome\user data\default\cookies
- %APPDATA%\opera software\opera stable\login data
- %LOCALAPPDATA%\google\chrome\user data\default\login data
- %LOCALAPPDATA%\google\chrome\user data\default\web data
Modifies file system
Creates the following files
- %TEMP%\rarsfx0\fd1.bat
- %TEMP%\akzmfdnpqr
- %TEMP%\wd7jstvs3y
- %TEMP%\3d3dci66ne
- %TEMP%\mneys7pkmg
- %TEMP%\8kfclrypdz
- %TEMP%\ytjehkxzfy
- %TEMP%\mzo70kaueu
- %TEMP%\zt711kuq2x
- %TEMP%\5fydazyvcc
- C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\mdm.exe
- %TEMP%\tjer0mc0yc
- %TEMP%\pq6s2hal6b
- %TEMP%\wpsclqoqbp
- %TEMP%\hdrz9hd5cv
- %TEMP%\efjewcnwys
- %TEMP%\l147qjfj24
- %TEMP%\zwzgtvnfsk
- %TEMP%\wqgxqid2rs
- %TEMP%\dqiutzctch
- %TEMP%\p9nqddfgit
- %TEMP%\zzocafvbcy
- %TEMP%\bmkuau39bo
- %TEMP%\102f9213-f6d5-44b7-a226-e97a4ae8f07f.vbs
- %TEMP%\9caff0399421d5890a864724ee3f7ba7a13ad5e6.exe
- %TEMP%\7fa81298-5a95-40cd-83b2-cad19d1e80aa.vbs
- %TEMP%\rarsfx1\furichekerpremium.exe
- %TEMP%\rarsfx2\fd.bat
- %TEMP%\rarsfx2\connectbase_host.exe
- %TEMP%\rarsfx3\connect to base_host.exe
- %ProgramFiles%\rat\smss.exe
- %ProgramFiles%\rat\69ddcba757bf72
- C:\totalcmd\language\explorer.exe
- C:\totalcmd\language\7a0fd90576e088
- %ProgramFiles%\microsoft synchronization services\furichekerpremium.exe
- %TEMP%\kzdrdubhx8
- %TEMP%\yymdlpvsm7
- %ProgramFiles%\microsoft synchronization services\a170ff59ea23b0
- %TEMP%\ocnt0rmgy5
- %TEMP%\irvokbyde7.bat
- nul
- C:\users\public\favorites\services.exe
- C:\users\public\favorites\c5b4cb5e9653cc
- C:\msocache\all users\{90140000-0019-0409-1000-0000000ff1ce}-c\dwm.exe
- C:\msocache\all users\{90140000-0019-0409-1000-0000000ff1ce}-c\6cb0b6c459d5d3
- C:\totalcmd\language\lsass.exe
- C:\totalcmd\language\6203df4a6bafc7
- %TEMP%\rarsfx0\furichekerpremium.sfx.exe
- C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\559fba5f8e4410
- %TEMP%\ejnfx33ucl
Deletes the following files
- %TEMP%\rarsfx0\fd1.bat
- %TEMP%\p9nqddfgit
- %TEMP%\dqiutzctch
- %TEMP%\wqgxqid2rs
- %TEMP%\zwzgtvnfsk
- %TEMP%\l147qjfj24
- %TEMP%\efjewcnwys
- %TEMP%\hdrz9hd5cv
- %TEMP%\wpsclqoqbp
- %TEMP%\pq6s2hal6b
- %TEMP%\yymdlpvsm7
- %TEMP%\tjer0mc0yc
- %TEMP%\5fydazyvcc
- %TEMP%\kzdrdubhx8
- %TEMP%\zt711kuq2x
- %TEMP%\ytjehkxzfy
- %TEMP%\8kfclrypdz
- %TEMP%\mneys7pkmg
- %TEMP%\3d3dci66ne
- %TEMP%\wd7jstvs3y
- %TEMP%\akzmfdnpqr
- %TEMP%\bmkuau39bo
- %TEMP%\zzocafvbcy
- %TEMP%\ocnt0rmgy5
- %TEMP%\rarsfx1\furichekerpremium.exe
- %TEMP%\rarsfx2\connectbase_host.exe
- %TEMP%\rarsfx0\furichekerpremium.sfx.exe
- %TEMP%\mzo70kaueu
- %TEMP%\ejnfx33ucl
Network activity
Connects to
- 'fu######.isp26.admintest.ru':80
TCP
HTTP GET requests
- http://fu######.isp26.admintest.ru/ImagepipeSqltemp.php?gB#######################################################################################################################################...
- http://fu######.isp26.admintest.ru/ImagepipeSqltemp.php?wR#######################################################################################################################################...
UDP
- DNS ASK fu######.isp26.admintest.ru
- 'localhost':123
Miscellaneous
Searches for the following windows
- ClassName: 'EDIT' WindowName: ''
Creates and executes the following
- '%TEMP%\rarsfx0\furichekerpremium.sfx.exe' -p1234
- '%TEMP%\rarsfx1\furichekerpremium.exe'
- '%TEMP%\rarsfx2\connectbase_host.exe' -p1234
- '%TEMP%\rarsfx3\connect to base_host.exe'
- 'C:\totalcmd\language\lsass.exe'
- '<SYSTEM32>\wscript.exe' "%TEMP%\7fa81298-5a95-40cd-83b2-cad19d1e80aa.vbs"
- '<SYSTEM32>\wscript.exe' "%TEMP%\102f9213-f6d5-44b7-a226-e97a4ae8f07f.vbs"
- '<SYSTEM32>\cmd.exe' /C "%TEMP%\IrvokbYdE7.bat"' (with hidden window)
- 'C:\totalcmd\language\lsass.exe' ' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\RarSFX0\fd1.bat" "
- '<SYSTEM32>\schtasks.exe' /create /tn "lsassl" /sc MINUTE /mo 9 /tr "'C:\totalcmd\LANGUAGE\lsass.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "dwmd" /sc MINUTE /mo 9 /tr "'C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\dwm.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "dwm" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\dwm.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "dwmd" /sc MINUTE /mo 9 /tr "'C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\dwm.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "servicess" /sc MINUTE /mo 14 /tr "'C:\Users\Public\Favorites\services.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "services" /sc ONLOGON /tr "'C:\Users\Public\Favorites\services.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "servicess" /sc MINUTE /mo 7 /tr "'C:\Users\Public\Favorites\services.exe'" /f
- '<SYSTEM32>\w32tm.exe' /stripchart /computer:localhost /period:5 /dataonly /samples:2
- '<SYSTEM32>\cmd.exe' /C "%TEMP%\IrvokbYdE7.bat"
- '<SYSTEM32>\schtasks.exe' /create /tn "mdmm" /sc MINUTE /mo 5 /tr "'C:\Recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\mdm.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "lsass" /sc ONLOGON /tr "'C:\totalcmd\LANGUAGE\lsass.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "mdm" /sc ONLOGON /tr "'C:\Recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\mdm.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "FurichekerPremiumF" /sc MINUTE /mo 6 /tr "'%ProgramFiles%\Microsoft Synchronization Services\FurichekerPremium.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "FurichekerPremium" /sc ONLOGON /tr "'%ProgramFiles%\Microsoft Synchronization Services\FurichekerPremium.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "FurichekerPremiumF" /sc MINUTE /mo 5 /tr "'%ProgramFiles%\Microsoft Synchronization Services\FurichekerPremium.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "explorere" /sc MINUTE /mo 7 /tr "'C:\totalcmd\LANGUAGE\explorer.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "explorer" /sc ONLOGON /tr "'C:\totalcmd\LANGUAGE\explorer.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "explorere" /sc MINUTE /mo 11 /tr "'C:\totalcmd\LANGUAGE\explorer.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "smsss" /sc MINUTE /mo 7 /tr "'%ProgramFiles%\RAT\smss.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "smss" /sc ONLOGON /tr "'%ProgramFiles%\RAT\smss.exe'" /rl HIGHEST /f
- '<SYSTEM32>\schtasks.exe' /create /tn "smsss" /sc MINUTE /mo 11 /tr "'%ProgramFiles%\RAT\smss.exe'" /f
- '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\RarSFX2\fd.bat" "
- '<SYSTEM32>\schtasks.exe' /create /tn "mdmm" /sc MINUTE /mo 6 /tr "'C:\Recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\mdm.exe'" /f
- '<SYSTEM32>\schtasks.exe' /create /tn "lsassl" /sc MINUTE /mo 6 /tr "'C:\totalcmd\LANGUAGE\lsass.exe'" /rl HIGHEST /f
