Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\bit4fe3.tmp
Malicious functions
Injects code into
the following system processes:
- %WINDIR%\syswow64\cmd.exe
the following user processes:
- localctrl_alpha_v3.exe
Modifies file system
Creates the following files
- %TEMP%\rubrician_20250420143407.cleanroom.log
- %TEMP%\shiwrrpbjdamwn
- %TEMP%\ce0e3223
- %APPDATA%\remoteservicezoo_test\wiggery.bmp
- %APPDATA%\remoteservicezoo_test\starburn.dll
- %APPDATA%\remoteservicezoo_test\rescuecdburner.exe
- %APPDATA%\remoteservicezoo_test\qtxml4.dll
- %APPDATA%\remoteservicezoo_test\qtnetwork4.dll
- %APPDATA%\remoteservicezoo_test\qtgui4.dll
- %APPDATA%\remoteservicezoo_test\qtcore4.dll
- %APPDATA%\remoteservicezoo_test\msvcr100.dll
- %APPDATA%\remoteservicezoo_test\msvcp100.dll
- %APPDATA%\remoteservicezoo_test\hypochondriac.xlsx
- %TEMP%\rubrician_20250420143417.log
- %WINDIR%\temp\{05c93231-b48b-48cd-b5cc-b20c6ed01bd4}\.ba\bundleextensiondata.xml
- %WINDIR%\temp\{05c93231-b48b-48cd-b5cc-b20c6ed01bd4}\.ba\bootstrapperapplicationdata.xml
- %WINDIR%\temp\{05c93231-b48b-48cd-b5cc-b20c6ed01bd4}\.ba\wiggery.bmp
- %WINDIR%\temp\{05c93231-b48b-48cd-b5cc-b20c6ed01bd4}\.ba\starburn.dll
- %WINDIR%\temp\{05c93231-b48b-48cd-b5cc-b20c6ed01bd4}\.ba\rescuecdburner.exe
- %WINDIR%\temp\{05c93231-b48b-48cd-b5cc-b20c6ed01bd4}\.ba\qtxml4.dll
- %WINDIR%\temp\{05c93231-b48b-48cd-b5cc-b20c6ed01bd4}\.ba\qtnetwork4.dll
- %WINDIR%\temp\{05c93231-b48b-48cd-b5cc-b20c6ed01bd4}\.ba\qtgui4.dll
- %WINDIR%\temp\{05c93231-b48b-48cd-b5cc-b20c6ed01bd4}\.ba\qtcore4.dll
- %WINDIR%\temp\{05c93231-b48b-48cd-b5cc-b20c6ed01bd4}\.ba\msvcr100.dll
- %WINDIR%\temp\{05c93231-b48b-48cd-b5cc-b20c6ed01bd4}\.ba\msvcp100.dll
- %WINDIR%\temp\{05c93231-b48b-48cd-b5cc-b20c6ed01bd4}\.ba\hypochondriac.xlsx
- %WINDIR%\temp\{05c93231-b48b-48cd-b5cc-b20c6ed01bd4}\.ba\ascidian.dll
- %WINDIR%\temp\{b169a714-47cb-4fae-808c-bde49ba6c0e0}\.cr\<File name>.exe
- %TEMP%\kftr
- %TEMP%\localctrl_alpha_v3.exe
Sets the 'hidden' attribute to the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\bit4fe3.tmp
Deletes the following files
- %WINDIR%\temp\{b169a714-47cb-4fae-808c-bde49ba6c0e0}\.cr\<File name>.exe
Miscellaneous
Creates and executes the following
- '%WINDIR%\temp\{b169a714-47cb-4fae-808c-bde49ba6c0e0}\.cr\<File name>.exe' -burn.clean.room="<Full path to file>" -burn.filehandle.attached=216 -burn.filehandle.self=212
- '%WINDIR%\temp\{05c93231-b48b-48cd-b5cc-b20c6ed01bd4}\.ba\rescuecdburner.exe'
- '%APPDATA%\remoteservicezoo_test\rescuecdburner.exe'
- '%TEMP%\localctrl_alpha_v3.exe'
Executes the following
- '%WINDIR%\syswow64\cmd.exe'
