Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\c__fvwvnk_<File name>.exe
Malicious functions
Searches for registry branches where third party applications store passwords
- [HKLM\SOFTWARE\Wow6432Node\Ghisler\Total Commander]
- [HKLM\SOFTWARE\Wow6432Node\Ghisler\Windows Commander]
- [HKCU\SOFTWARE\Ghisler\Total Commander]
- [HKCU\SOFTWARE\Ghisler\Windows Commander]
- [HKLM\SOFTWARE\Ghisler\Total Commander]
Modifies file system
Creates the following files
- %TEMP%\total_commander.msi
- %ProgramFiles%\totalcmd\tcuninst.wul
- %ProgramFiles%\totalcmd\wcuninst.wul
- %ProgramFiles%\totalcmd\totalcmd.inc
- %ProgramFiles%\totalcmd\unrar64.dll
- %ProgramFiles%\totalcmd\no.bar
- %ProgramFiles%\totalcmd\wcmicons.dll
- %ProgramFiles%\totalcmd\tcunin64.wul
- %ProgramFiles%\totalcmd\wcmicons.inc
- %ProgramFiles%\totalcmd\tcunzl64.dll
- %ProgramFiles%\totalcmd\tclzma64.dll
- %ProgramFiles%\totalcmd\tc7z64.dll
- %ProgramFiles%\totalcmd\tcbit7z64.dll
- %ProgramFiles%\totalcmd\wcmicon2.dll
- %ProgramFiles%\totalcmd\blakex64.dll
- %ProgramFiles%\totalcmd\wcmzip64.dll
- %ProgramFiles%\totalcmd\vertical.bar
- %ProgramFiles%\totalcmd\default.bar
- %ProgramFiles%\totalcmd\history.txt
- %ProgramFiles%\totalcmd\language\wcmd_rus.mnu
- %ProgramFiles%\totalcmd\language\wcmd_rus.inc
- %ProgramFiles%\totalcmd\language\wcmd_ukr.lng
- %ProgramFiles%\totalcmd\language\wcmd_ukr.mnu
- %ProgramFiles%\totalcmd\language\wcmd_ukr.inc
- %ProgramFiles%\totalcmd\language\wcmd_chn.inc
- %ProgramFiles%\totalcmd\filter32\autopitch.dll
- %ProgramFiles%\totalcmd\filter32\soundtouchdll_license.txt
- %ProgramFiles%\totalcmd\filter32\vmr9rotator.dll
- %ProgramFiles%\totalcmd\filter64\autopitch.dll
- %ProgramFiles%\totalcmd\filter64\soundtouchdll_x64.dll
- %ProgramFiles%\totalcmd\filter64\soundtouchdll_license.txt
- %ProgramFiles%\totalcmd\filter64\vmr9rotator.dll
- %ProgramFiles%\totalcmd\filter32\soundtouchdll.dll
- %ProgramFiles%\totalcmd\descript.ion
- %ProgramFiles%\totalcmd\language\wcmd_chn.mnu
- %ProgramFiles%\totalcmd\language\wcmd_rus.lng
- %ProgramFiles%\totalcmd\tczstd64.dll
- %ProgramFiles%\totalcmd\tc7z.sfx
- %ProgramFiles%\totalcmd\tc7zipif.dll
- %ProgramFiles%\totalcmd\tcbit7z.dll
- %ProgramFiles%\totalcmd\tc7z.dll
- %ProgramFiles%\totalcmd\tczstd32.dll
- %ProgramFiles%\totalcmd\libdeflate.dll
- %ProgramFiles%\totalcmd\unrar9x.dll
- %ProgramFiles%\totalcmd\blakex32.dll
- %ProgramFiles%\totalcmd\share_nt.exe
- %ProgramFiles%\totalcmd\noclose.exe
- %ProgramFiles%\totalcmd\totalcmd.exe
- %ProgramFiles%\totalcmd\totalcmd.exe.manifest
- %ProgramFiles%\totalcmd\tcuninst.exe
- %ProgramFiles%\totalcmd\tcsharewin10.dll
- %ProgramFiles%\totalcmd\tcmdx64.exe
- %ProgramFiles%\totalcmd\tcmadmin.exe
- %ProgramFiles%\totalcmd\unrar.dll
- %ProgramFiles%\totalcmd\cabrk.dll
- %ProgramFiles%\totalcmd\language\wcmd_rom.inc
- %ProgramFiles%\totalcmd\tcmadm64.exe
- %ProgramFiles%\totalcmd\tcunin64.exe
- %ProgramFiles%\totalcmd\tcmdx32.exe
- %ProgramFiles%\totalcmd\noclose64.exe
- %ProgramFiles%\totalcmd\cglpt64.sys
- %ProgramFiles%\totalcmd\tcusbrun.exe
- %ProgramFiles%\totalcmd\cglpt9x.vxd
- %ProgramFiles%\totalcmd\cglptnt.sys
- %ProgramFiles%\totalcmd\tcunzlib.dll
- %ProgramFiles%\totalcmd\tcmdlzma.dll
- %ProgramFiles%\totalcmd\wc32to16.exe
- %ProgramFiles%\totalcmd\wcmzip32.dll
- %ProgramFiles%\totalcmd\freres32.dll
- %ProgramFiles%\totalcmd\libdeflate64.dll
- %ProgramFiles%\totalcmd\sfxhead.sfx
- %ProgramFiles%\totalcmd\tcsharewin10x64.dll
- %ProgramFiles%\totalcmd\language\wcmd_chn.lng
- %ProgramFiles%\totalcmd\language\wcmd_kor.inc
- %ProgramFiles%\totalcmd\language\wcmd_kor.mnu
- %TEMP%\ai_extui_bin_2240\banner.scale200.jpg
- %TEMP%\ai_extui_bin_2240\dialog.scale150.jpg
- %TEMP%\ai_extui_bin_2240\dialog.scale200.jpg
- %TEMP%\msi4a49.tmp
- %TEMP%\ai_extui_bin_2240\dialog.svg
- %TEMP%\total commander installer\s.exe
- %TEMP%\ai_extui_bin_2240\banner.scale150.jpg
- %ProgramFiles%\totalcmd\keyboard.txt
- %ProgramFiles%\totalcmd\language\wcmd_cz.lng
- %ProgramFiles%\totalcmd\language\wcmd_cz.mnu
- %ProgramFiles%\totalcmd\language\wcmd_cz.inc
- %ProgramFiles%\totalcmd\language\wcmd_dan.lng
- %APPDATA%\ghisler\wincmd.ini
- %TEMP%\ai_extui_bin_2240\lzmaextractor.dll
- %ProgramFiles%\totalcmd\totalcmd.chm
- %TEMP%\ai_extui_bin_2240\banner.svg
- %TEMP%\ai_extui_bin_2240\dialog.scale125.jpg
- %TEMP%\total_commander.x64.msi
- %TEMP%\ai_extui_bin_2240\dialog.jpg
- %TEMP%\ai_extui_bin_2240\completi
- %TEMP%\ai_extui_bin_2240\custicon
- %TEMP%\ai_extui_bin_2240\exclamic
- %TEMP%\ai_extui_bin_2240\info
- %TEMP%\ai_extui_bin_2240\insticon
- %TEMP%\msi3df9.tmp
- %TEMP%\ai_extui_bin_2240\removico
- %TEMP%\ai_extui_bin_2240\up
- %TEMP%\ai_extui_bin_2240\new
- %TEMP%\ai_extui_bin_2240\banner.jpg
- %TEMP%\ai_extui_bin_2240\tabback
- %TEMP%\ai_extui_bin_2240\cmdlinkarrow
- %ProgramFiles%\totalcmd\language\wcmd_dan.mnu
- %TEMP%\ai_extui_bin_2240\repairic
- %ProgramFiles%\totalcmd\language\wcmd_dan.inc
- %TEMP%\ai_extui_bin_2240\banner.scale125.jpg
- %ProgramFiles%\totalcmd\language\wcmd_deu.lng
- %ProgramFiles%\totalcmd\language\wcmd_ita.inc
- %ProgramFiles%\totalcmd\language\wcmd_nor.mnu
- %ProgramFiles%\totalcmd\language\wcmd_pol.lng
- %ProgramFiles%\totalcmd\language\wcmd_pol.mnu
- %ProgramFiles%\totalcmd\language\wcmd_pol.inc
- %ProgramFiles%\totalcmd\language\wcmd_sk.lng
- %ProgramFiles%\totalcmd\language\wcmd_sk.mnu
- %ProgramFiles%\totalcmd\language\wcmd_svn.lng
- %ProgramFiles%\totalcmd\language\wcmd_svn.mnu
- %ProgramFiles%\totalcmd\language\wcmd_svn.inc
- %ProgramFiles%\totalcmd\language\wcmd_swe.lng
- %ProgramFiles%\totalcmd\language\wcmd_swe.mnu
- %ProgramFiles%\totalcmd\language\wcmd_swe.inc
- %ProgramFiles%\totalcmd\language\wcmd_kor.lng
- %ProgramFiles%\totalcmd\language\wcmd_ita.mnu
- %ProgramFiles%\totalcmd\language\wcmd_deu.mnu
- %ProgramFiles%\totalcmd\language\wcmd_nor.lng
- %ProgramFiles%\totalcmd\unacev2.dll
- %ProgramFiles%\totalcmd\totalcmd64.exe
- %ProgramFiles%\totalcmd\language\wcmd_rom.mnu
- %ProgramFiles%\totalcmd\language\wcmd_dut.lng
- %ProgramFiles%\totalcmd\language\wcmd_dut.mnu
- %ProgramFiles%\totalcmd\language\wcmd_dut.inc
- %ProgramFiles%\totalcmd\language\wcmd_eng.mnu
- %ProgramFiles%\totalcmd\language\wcmd_esp.lng
- %ProgramFiles%\totalcmd\language\wcmd_esp.mnu
- %ProgramFiles%\totalcmd\language\wcmd_deu.inc
- %ProgramFiles%\totalcmd\language\wcmd_esp.inc
- %ProgramFiles%\totalcmd\language\wcmd_fra.mnu
- %ProgramFiles%\totalcmd\language\wcmd_fra.inc
- %ProgramFiles%\totalcmd\language\wcmd_hun.lng
- %ProgramFiles%\totalcmd\language\wcmd_hun.mnu
- %ProgramFiles%\totalcmd\language\wcmd_hun.inc
- %ProgramFiles%\totalcmd\language\wcmd_rom.lng
- %ProgramFiles%\totalcmd\language\wcmd_fra.lng
- %ProgramFiles%\totalcmd\language\wcmd_ita.lng
- %ProgramFiles%\totalcmd\totalcmd64.exe.manifest
Deletes the following files
- %TEMP%\msi3df9.tmp
- %TEMP%\msi4a49.tmp
- <SYSTEM32>\tasks\c__fvwvnk_<File name>.exe
Miscellaneous
Creates and executes the following
- '%TEMP%\total commander installer\s.exe' /A
Executes the following
- '%WINDIR%\syswow64\msiexec.exe' /i %TEMP%\Total_Commander.x64.msi AI_SETUPEXEPATH=<Full path to file> SETUPEXEDIR=<Current directory>\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1735657745 " AI_EUIMSI="" AI_MISSING...
