Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\armwake.lnk
Creates the following services
- [<HKLM>\System\CurrentControlSet\Services\RManService] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\RManService] 'ImagePath' = '"%ProgramFiles(x86)%\Remote Utilities - Host\rutserv.exe"'
Malicious functions
Executes the following
- '%WINDIR%\syswow64\taskkill.exe' /F /FI "USERNAME eq user" /IM rfusclient.exe
- '%WINDIR%\syswow64\taskkill.exe' /F /IM explorer.exe
Modifies file system
Creates the following files
- %TEMP%\_ir_sf_temp_0\irsetup.exe
- %ProgramFiles(x86)%\remote utilities - host\printer\x86\rup.gpd
- %ProgramFiles(x86)%\remote utilities - host\printer\x86\uninstall.cmd
- %ProgramFiles(x86)%\remote utilities - host\printer\x86\install.cmd
- %ProgramFiles(x86)%\remote utilities - host\printer\x86\ntprint.inf
- %ProgramFiles(x86)%\remote utilities - host\printer\x86\unires_vpd.dll
- %ProgramFiles(x86)%\remote utilities - host\printer\x86\unidrvui_rup.dll
- %ProgramFiles(x86)%\remote utilities - host\printer\x86\unidrv_rup.dll
- %ProgramFiles(x86)%\remote utilities - host\printer\x86\rupui.dll
- %ProgramFiles(x86)%\remote utilities - host\printer\x86\ruppm.dll
- %ProgramFiles(x86)%\remote utilities - host\printer\x86\vpdagent.exe
- %ProgramFiles(x86)%\remote utilities - host\printer\x86\srvinst.exe
- %ProgramFiles(x86)%\remote utilities - host\printer\x86\setupdrv.exe
- %ProgramFiles(x86)%\remote utilities - host\printer\x86\stdnames_vpd.gpd
- %ProgramFiles(x86)%\remote utilities - host\printer\x86\rupui2.exe
- %ProgramFiles(x86)%\remote utilities - host\printer\x86\fwproc.exe
- %ProgramFiles(x86)%\remote utilities - host\printer\x86\rup.ini
- %ProgramFiles(x86)%\remote utilities - host\portuguese.lg
- %ProgramFiles(x86)%\remote utilities - host\webmvorbisencoder.dll
- %ProgramFiles(x86)%\remote utilities - host\webmvorbisdecoder.dll
- %ProgramFiles(x86)%\remote utilities - host\webmmux.dll
- %ProgramFiles(x86)%\remote utilities - host\vp8encoder.dll
- %ProgramFiles(x86)%\remote utilities - host\chinese simplified.lg
- %ProgramFiles(x86)%\remote utilities - host\danish.lg
- %ProgramFiles(x86)%\remote utilities - host\swedish.lg
- %ProgramFiles(x86)%\remote utilities - host\norwegian.lg
- %ProgramFiles(x86)%\remote utilities - host\korean.lg
- %ProgramFiles(x86)%\remote utilities - host\printer\x86\progress.exe
- %ProgramFiles(x86)%\remote utilities - host\printer\x86\rup.lng
- %ProgramFiles(x86)%\remote utilities - host\printer\x86\rup_s.lng
- %ProgramFiles(x86)%\remote utilities - host\printer\x86\unidrv_rup.hlp
- %ProgramFiles(x86)%\remote utilities - host\logs\rms_log_2019-10.html
- %PROGRAMDATA%\remote utilities\msi\68001_{e945283b-758c-4a40-b851-1066d0e49ea8}\host.msi
- %WINDIR%\installer\{e945283b-758c-4a40-b851-1066d0e49ea8}\en_server_start_85db64512c79429fa70ac6c0611579dd.exe
- %WINDIR%\installer\{e945283b-758c-4a40-b851-1066d0e49ea8}\en_server_settings_e3bfc76be38f4cf79d2ed7163b7decee.exe
- %WINDIR%\installer\{e945283b-758c-4a40-b851-1066d0e49ea8}\uninst_uninstall_r_3b1e3c8b7d0945898da82ceeed02f0c7.exe
- %WINDIR%\installer\{e945283b-758c-4a40-b851-1066d0e49ea8}\en_server_stop_b603677802d142c98e7a415b72132e14.exe
- %WINDIR%\installer\{e945283b-758c-4a40-b851-1066d0e49ea8}\arpproducticon.exe
- %ProgramFiles(x86)%\remote utilities - host\printer\x64\unidrv_rup.hlp
- %ProgramFiles(x86)%\remote utilities - host\printer\x64\rup_s.lng
- %ProgramFiles(x86)%\remote utilities - host\printer\x64\rup.lng
- %ProgramFiles(x86)%\remote utilities - host\printer\x64\stdnames_vpd.gpd
- %ProgramFiles(x86)%\remote utilities - host\printer\x64\rup.gpd
- %ProgramFiles(x86)%\remote utilities - host\printer\x64\uninstall.cmd
- %ProgramFiles(x86)%\remote utilities - host\printer\x64\install.cmd
- %ProgramFiles(x86)%\remote utilities - host\printer\x64\ntprint.inf
- %ProgramFiles(x86)%\remote utilities - host\printer\x64\unires_vpd.dll
- %ProgramFiles(x86)%\remote utilities - host\printer\x64\unidrvui_rup.dll
- %ProgramFiles(x86)%\remote utilities - host\printer\x64\unidrv_rup.dll
- %ProgramFiles(x86)%\remote utilities - host\printer\x64\rupui.dll
- %ProgramFiles(x86)%\remote utilities - host\printer\x64\ruppm.dll
- %ProgramFiles(x86)%\remote utilities - host\printer\x64\vpdagent_x64.exe
- %ProgramFiles(x86)%\remote utilities - host\printer\x64\srvinst_x64.exe
- %ProgramFiles(x86)%\remote utilities - host\printer\x64\setupdrv.exe
- %ProgramFiles(x86)%\remote utilities - host\printer\x64\rupui2.exe
- %ProgramFiles(x86)%\remote utilities - host\printer\x64\progress.exe
- %ProgramFiles(x86)%\remote utilities - host\printer\x64\fwproc_x64.exe
- %ProgramFiles(x86)%\remote utilities - host\printer\x64\rup.ini
- %ProgramFiles(x86)%\remote utilities - host\italian.lg
- %TEMP%\killself.bat
- %ProgramFiles(x86)%\remote utilities - host\dutch.lg
- %ProgramFiles(x86)%\remote utilities - host\chinese traditional.lg
- %APPDATA%\microsoft\windows\start menu\programs\h&ss\armstatus.lnk
- %APPDATA%\microsoft\windows\start menu\programs\h&ss\remote utilities.lnk
- %APPDATA%\microsoft\windows\start menu\programs\h&ss\armsettings.lnk
- %APPDATA%\microsoft\windows\start menu\programs\h&ss\armgrd.lnk
- %APPDATA%\microsoft\windows\start menu\programs\h&ss\armforce.lnk
- %APPDATA%\microsoft\windows\start menu\programs\h&ss\7-zip.lnk
- C:\inst_fold\copy.exe
- C:\inst_fold\reg.bat
- C:\inst_fold\start.bat
- C:\inst_fold\waitbefore.bat
- C:\inst_fold\armwake.lnk
- C:\inst_fold\armstatus.exe
- %APPDATA%\microsoft\windows\start menu\programs\h&ss\waitbefore.lnk
- C:\inst_fold\armstatus.bat
- C:\inst_fold\armsettings.bat
- C:\inst_fold\armgrd.bat
- C:\inst_fold\armforce.exe
- C:\inst_fold\armfix.reg
- C:\inst_fold\7zxa.dll
- C:\inst_fold\7zaa.exe
- C:\inst_fold\7za.dll
- %TEMP%\_ir_sf_temp_0\install-1.ico
- %TEMP%\_ir_sf_temp_0\irimg2.jpg
- %TEMP%\_ir_sf_temp_0\irimg1.jpg
- %TEMP%\_ir_sf_temp_0\irsetup.dat
- %TEMP%\_ir_sf_temp_0\lua5.1.dll
- C:\inst_fold\armstart.exe
- %APPDATA%\microsoft\windows\start menu\programs\h&ss\start.lnk
- %APPDATA%\microsoft\windows\start menu\programs\h&ss\reg.lnk
- %APPDATA%\microsoft\windows\start menu\programs\h&ss\copy.lnk
- %ProgramFiles(x86)%\remote utilities - host\portuguese, brazilian.lg
- %ProgramFiles(x86)%\remote utilities - host\arabic.lg
- %ProgramFiles(x86)%\remote utilities - host\german.lg
- %ProgramFiles(x86)%\remote utilities - host\french.lg
- %ProgramFiles(x86)%\remote utilities - host\japanese.lg
- %ProgramFiles(x86)%\remote utilities - host\polish.lg
- %ProgramFiles(x86)%\remote utilities - host\turkish.lg
- %ProgramFiles(x86)%\remote utilities - host\hebrew.lg
- %ProgramFiles(x86)%\remote utilities - host\spanish.lg
- %ProgramFiles(x86)%\remote utilities - host\eula.rtf
- %ProgramFiles(x86)%\remote utilities - host\ripcserver.dll
- %ProgramFiles(x86)%\remote utilities - host\rwln.dll
- %ProgramFiles(x86)%\remote utilities - host\english.lg
- %ProgramFiles(x86)%\remote utilities - host\vp8decoder.dll
- %ProgramFiles(x86)%\remote utilities - host\rfusclient.exe
- %ProgramFiles(x86)%\remote utilities - host\rutserv.exe
- %ProgramFiles(x86)%\remote utilities - host\monitor\x64\drvinstaller64.exe
- %ProgramFiles(x86)%\remote utilities - host\monitor\x64\lockscr.cat
- %ProgramFiles(x86)%\remote utilities - host\monitor\x64\lockscr.inf
- %ProgramFiles(x86)%\remote utilities - host\monitor\x64\lockscr.sys
- %ProgramFiles(x86)%\remote utilities - host\monitor\x86\drvinstaller32.exe
- %ProgramFiles(x86)%\remote utilities - host\monitor\x86\lockscr.cat
- %ProgramFiles(x86)%\remote utilities - host\monitor\x86\lockscr.inf
- %ProgramFiles(x86)%\remote utilities - host\monitor\x86\lockscr.sys
- %TEMP%\7zipsfx.000\installer.exe
- %TEMP%\7zipsfx.000\host.msi
- %APPDATA%\microsoft\windows\start menu\programs\h&ss\îïåðà öèîГГГ Гї ñèñòåìà microsoftВ® windowsВ®.lnk
- %ProgramFiles(x86)%\remote utilities - host\czech.lg
- <Current directory>\tmpfl.txt
Sets the 'hidden' attribute to the following files
- %ProgramFiles(x86)%\remote utilities - host\eula.rtf
- %ProgramFiles(x86)%\remote utilities - host\rfusclient.exe
- %ProgramFiles(x86)%\remote utilities - host\ripcserver.dll
- %ProgramFiles(x86)%\remote utilities - host\rutserv.exe
- %ProgramFiles(x86)%\remote utilities - host\rwln.dll
- %ProgramFiles(x86)%\remote utilities - host\vp8decoder.dll
- %ProgramFiles(x86)%\remote utilities - host\vp8encoder.dll
- %ProgramFiles(x86)%\remote utilities - host\webmmux.dll
- %ProgramFiles(x86)%\remote utilities - host\webmvorbisdecoder.dll
- %ProgramFiles(x86)%\remote utilities - host\webmvorbisencoder.dll
- C:\inst_fold\armstatus.exe
- C:\inst_fold\armstart.exe
Deletes the following files
- %TEMP%\_ir_sf_temp_0\irsetup.dat
- %TEMP%\_ir_sf_temp_0\install-1.ico
- %TEMP%\_ir_sf_temp_0\irimg2.jpg
- %TEMP%\_ir_sf_temp_0\irimg1.jpg
- %ProgramFiles(x86)%\remote utilities - host\turkish.lg
- %ProgramFiles(x86)%\remote utilities - host\swedish.lg
- %ProgramFiles(x86)%\remote utilities - host\spanish.lg
- %ProgramFiles(x86)%\remote utilities - host\portuguese.lg
- %ProgramFiles(x86)%\remote utilities - host\portuguese, brazilian.lg
- %ProgramFiles(x86)%\remote utilities - host\polish.lg
- %ProgramFiles(x86)%\remote utilities - host\norwegian.lg
- %ProgramFiles(x86)%\remote utilities - host\korean.lg
- %ProgramFiles(x86)%\remote utilities - host\japanese.lg
- %TEMP%\_ir_sf_temp_0\irsetup.exe
- %ProgramFiles(x86)%\remote utilities - host\italian.lg
- %ProgramFiles(x86)%\remote utilities - host\german.lg
- %ProgramFiles(x86)%\remote utilities - host\french.lg
- %ProgramFiles(x86)%\remote utilities - host\english.lg
- %ProgramFiles(x86)%\remote utilities - host\dutch.lg
- %ProgramFiles(x86)%\remote utilities - host\danish.lg
- %ProgramFiles(x86)%\remote utilities - host\czech.lg
- %ProgramFiles(x86)%\remote utilities - host\chinese traditional.lg
- %ProgramFiles(x86)%\remote utilities - host\chinese simplified.lg
- %ProgramFiles(x86)%\remote utilities - host\arabic.lg
- %TEMP%\7zipsfx.000\host.msi
- %TEMP%\7zipsfx.000\installer.exe
- %APPDATA%\microsoft\windows\start menu\programs\h&ss\armstatus.lnk
- %ProgramFiles(x86)%\remote utilities - host\hebrew.lg
- %TEMP%\_ir_sf_temp_0\lua5.1.dll
Substitutes the following files
- %APPDATA%\microsoft\windows\start menu\programs\h&ss\armstatus.lnk
Network activity
UDP
- DNS ASK se####.#emoteutilities.com
Miscellaneous
Searches for the following windows
- ClassName: 'RegEdit_RegEdit' WindowName: ''
- ClassName: '' WindowName: ''
Creates and executes the following
- '%TEMP%\_ir_sf_temp_0\irsetup.exe' __IRAOFF:1791234 "__IRAFN:<Full path to file>" "__IRCT:0" "__IRTSS:0" "__IRSID:S-1-5-21-1960123792-2022915161-3775307078-1001"
- 'C:\inst_fold\armstart.exe'
- '%TEMP%\7zipsfx.000\installer.exe' /rsetup
- '%ProgramFiles(x86)%\remote utilities - host\rfusclient.exe' -msi_copy "%TEMP%\7ZipSfx.000\host.msi"
- '%ProgramFiles(x86)%\remote utilities - host\rutserv.exe' /silentinstall
- '%ProgramFiles(x86)%\remote utilities - host\rutserv.exe' /firewall
- '%ProgramFiles(x86)%\remote utilities - host\rutserv.exe' /start
- '%ProgramFiles(x86)%\remote utilities - host\rutserv.exe'
- '%ProgramFiles(x86)%\remote utilities - host\rfusclient.exe'
- '%ProgramFiles(x86)%\remote utilities - host\rfusclient.exe' /tray
- '%TEMP%\7zipsfx.000\installer.exe' /rsetup' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c C:\inst_fold\armsettings.bat' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c C:\inst_fold\armstatus.bat' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c C:\inst_fold\reg.bat' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c C:\inst_fold\start.bat' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\msiexec.exe' /i "%TEMP%\7ZipSfx.000\host.msi" /qn
- '%WINDIR%\syswow64\reg.exe' add "HKLM\SOFTWARE\Usoris\Remote Utilities Host\Host\Parameters" /v "Options" /t REG_BINARY /d "545046301154524f4d5365727665724f7074696f6e7300095573654e5441757468080d53656375726974794c6576656c0...
- '%WINDIR%\syswow64\reg.exe' query "HKU\S-1-5-19\Environment"
- '%WINDIR%\syswow64\cmd.exe' /c C:\inst_fold\reg.bat
- '%WINDIR%\syswow64\find.exe' /I /C "explorer.exe"
- '%WINDIR%\syswow64\tasklist.exe'
- '%WINDIR%\syswow64\timeout.exe' 2
- '%WINDIR%\syswow64\timeout.exe' 5
- '%WINDIR%\syswow64\find.exe' /I /C "rfusclient.exe"
- '%WINDIR%\syswow64\tasklist.exe' /FI "USERNAME eq user"
- '%WINDIR%\syswow64\cmd.exe' /c C:\inst_fold\armstatus.bat
- '%WINDIR%\syswow64\reg.exe' import "C:\inst_fold\armfix.reg" /reg:64
- '%WINDIR%\syswow64\regedit.exe' /s "C:\inst_fold\armfix.reg"
- '%WINDIR%\syswow64\timeout.exe' 3
- '%WINDIR%\syswow64\reg.exe' delete HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{E945283B-758C-4A40-B851-1066D0E49EA8} /f
- '%WINDIR%\syswow64\attrib.exe' +s +h "C:\inst_fold\armstart.exe"
- '%WINDIR%\syswow64\attrib.exe' +s +h "C:\inst_fold\armstatus.exe"
- '%WINDIR%\syswow64\attrib.exe' +s +h "C:\inst_fold"
- '%WINDIR%\syswow64\attrib.exe' +s +h "%ProgramFiles%\Remote Utilities - Host"
- '%WINDIR%\syswow64\attrib.exe' +s +h "%ProgramFiles%\Remote Utilities - Host\*.*"
- '%WINDIR%\syswow64\attrib.exe' +s +h "%ProgramFiles(x86)%\Remote Utilities - Host"
- '%WINDIR%\syswow64\attrib.exe' +s +h "%ProgramFiles(x86)%\Remote Utilities - Host\*.*"
- '%WINDIR%\syswow64\cmd.exe' /c C:\inst_fold\armsettings.bat
- '%WINDIR%\syswow64\cmd.exe' /c %TEMP%\killself.bat
- '%WINDIR%\syswow64\cmd.exe' /c C:\inst_fold\start.bat
- '%WINDIR%\explorer.exe'
