Technical Information
To ensure autorun and distribution
Sets the following service settings
- [HKLM\SYSTEM\CurrentControlSet\Services\VDeviceCard] 'Start' = '00000002'
- [HKLM\SYSTEM\CurrentControlSet\Services\VDeviceCard] 'ImagePath' = '%ALLUSERSPROFILE%\CardWindows\CDevice.exe'
Creates the following services
- 'VDeviceCard' %ALLUSERSPROFILE%\CardWindows\CDevice.exe
Malicious functions
Executes the following
- '%WINDIR%\syswow64\taskkill.exe' /im rfusclient.exe /f
- '%WINDIR%\syswow64\taskkill.exe' /im rutserv.exe /f
Modifies file system
Creates the following files
- %TEMP%\$inst\2.tmp
- %TEMP%\$inst\temp_0.tmp
- %ALLUSERSPROFILE%\cardwindows\builder.exe
- %ALLUSERSPROFILE%\cardwindows\builder2.exe
- %ALLUSERSPROFILE%\cardwindows\windevinstall.exe
- %ALLUSERSPROFILE%\cardwindows\config_set.reg
- %ALLUSERSPROFILE%\cardwindows\start1.exe
- %ALLUSERSPROFILE%\cardwindows\winupdate.exe
- %ALLUSERSPROFILE%\cardwindows\start.exe
- %ALLUSERSPROFILE%\cardwindows\russian.lg
- %ALLUSERSPROFILE%\cardwindows\sysdevices.exe
- %ALLUSERSPROFILE%\cardwindows\sysinstall.bat
- %ALLUSERSPROFILE%\cardwindows\sysinstall2.bat
- %ALLUSERSPROFILE%\cardwindows\vp8decoder.dll
- %ALLUSERSPROFILE%\cardwindows\vp8encoder.dll
- %ALLUSERSPROFILE%\cardwindows\winupdate1.exe
- %ALLUSERSPROFILE%\cardwindows\cdevice.exe
- %ALLUSERSPROFILE%\cardwindows\systemcard.dat
Sets the 'hidden' attribute to the following files
- %ALLUSERSPROFILE%\cardwindows\builder.exe
- %ALLUSERSPROFILE%\cardwindows\builder2.exe
- %ALLUSERSPROFILE%\cardwindows\cdevice.exe
- %ALLUSERSPROFILE%\cardwindows\russian.lg
- %ALLUSERSPROFILE%\cardwindows\start.exe
- %ALLUSERSPROFILE%\cardwindows\start1.exe
- %ALLUSERSPROFILE%\cardwindows\sysdevices.exe
- %ALLUSERSPROFILE%\cardwindows\sysinstall.bat
- %ALLUSERSPROFILE%\cardwindows\systemcard.dat
- %ALLUSERSPROFILE%\cardwindows\vp8decoder.dll
- %ALLUSERSPROFILE%\cardwindows\vp8encoder.dll
- %ALLUSERSPROFILE%\cardwindows\windevinstall.exe
Deletes following files that it created itself
- %TEMP%\$inst\temp_0.tmp
- %TEMP%\$inst\2.tmp
Network activity
Connects to
- 'rm##sys.ru':80
- 'rm#####ver.tektonit.ru':5655
TCP
HTTP GET requests
HTTP POST requests
- http://rm##sys.ru/utils/inet_id_notify.php
Other
- 'rm#####ver.tektonit.ru':5655
UDP
- DNS ASK rm##sys.ru
- DNS ASK rm#####ver.tektonit.ru
Miscellaneous
Searches for the following windows
- ClassName: 'EDIT' WindowName: ''
- ClassName: 'MS_WINHELP' WindowName: ''
- ClassName: '' WindowName: ''
- ClassName: 'RegEdit_RegEdit' WindowName: ''
Creates and executes the following
- '%ALLUSERSPROFILE%\cardwindows\windevinstall.exe' -p7832489354378589235643543456
- '%ALLUSERSPROFILE%\cardwindows\start1.exe'
- '%ALLUSERSPROFILE%\cardwindows\start.exe'
- '%ALLUSERSPROFILE%\cardwindows\builder.exe'
- '%ALLUSERSPROFILE%\cardwindows\builder2.exe'
- '%ALLUSERSPROFILE%\cardwindows\winupdate.exe' -p5387687645378674524512345389721228
- '%ALLUSERSPROFILE%\cardwindows\winupdate1.exe'
- '%ALLUSERSPROFILE%\cardwindows\cdevice.exe' /silentinstall
- '%ALLUSERSPROFILE%\cardwindows\cdevice.exe' /firewall
- '%ALLUSERSPROFILE%\cardwindows\cdevice.exe' /start
- '%ALLUSERSPROFILE%\cardwindows\cdevice.exe'
- '%ALLUSERSPROFILE%\cardwindows\sysdevices.exe'
- '%ALLUSERSPROFILE%\cardwindows\sysdevices.exe' /tray
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c ""%ALLUSERSPROFILE%\CardWindows\SysInstall.bat" "
- '%WINDIR%\syswow64\attrib.exe' +s +h "%ALLUSERSPROFILE%\CardWindows"
- '%WINDIR%\syswow64\sc.exe' stop RManService
- '%WINDIR%\syswow64\sc.exe' stop VDeviceCard
- '%WINDIR%\syswow64\sc.exe' stop NPackStereo
- '%WINDIR%\syswow64\sc.exe' stop ServiceWork
- '%WINDIR%\syswow64\sc.exe' stop IntelDriver
- '%WINDIR%\syswow64\sc.exe' stop AMIHardware
- '%WINDIR%\syswow64\sc.exe' delete RManService
- '%WINDIR%\syswow64\sc.exe' delete VDeviceCard
- '%WINDIR%\syswow64\sc.exe' delete NPackStereo
- '%WINDIR%\syswow64\sc.exe' delete ServiceWork
- '%WINDIR%\syswow64\sc.exe' delete IntelDriver
- '%WINDIR%\syswow64\sc.exe' delete AMIHardware
- '%WINDIR%\syswow64\reg.exe' delete "HKLM\SYSTEM\Nvidia\Toolbar\DeviceCard" /f
- '%WINDIR%\syswow64\regedit.exe' /s "%ALLUSERSPROFILE%\CardWindows\config_set.reg"
- '%WINDIR%\syswow64\sc.exe' failure VDeviceCard reset= 0 actions= restart/500/restart/500/restart/500
- '%WINDIR%\syswow64\sc.exe' config VDeviceCard obj= LocalSystem type= interact type= own
- '%WINDIR%\syswow64\attrib.exe' +s +h "%ALLUSERSPROFILE%\CardWindows\*.*"
- '%ALLUSERSPROFILE%\cardwindows\winupdate.exe' -p5387687645378674524512345389721228' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c ""%ALLUSERSPROFILE%\CardWindows\SysInstall.bat" "' (with hidden window)
