Technical Information
To ensure autorun and distribution:
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\services\fsproflt2] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\services\FSProFilter2] 'Start' = '00000000'
Malicious functions:
Creates and executes the following:
- '%TEMP%\is-RKU3A.tmp\package.tmp' /SL5="$30196,2960309,118784,%TEMP%\nscF76A.tmp\package.exe" /VERYSILENT /DIR="%PROGRAM_FILES%\Hide Folders"
- '<SYSTEM32>\fsproflt2.exe'
- '%TEMP%\nscF76A.tmp\ns2945.tmp' taskkill /F /IM hf5.exe
- '%TEMP%\RarSFX0\Hide.Folders.v5.1.5.1089.exe' /S /Q
- '%TEMP%\nscF76A.tmp\nsF865.tmp' "%TEMP%\nscF76A.tmp\package.exe" /VERYSILENT /DIR="%PROGRAM_FILES%\Hide Folders"
- '%TEMP%\nscF76A.tmp\package.exe' /VERYSILENT /DIR="%PROGRAM_FILES%\Hide Folders"
Executes the following:
- '<SYSTEM32>\conhost.exe' /s
- '<SYSTEM32>\sc.exe' start fsproflt2
- '<SYSTEM32>\taskkill.exe' /F /IM hf5.exe
- '<SYSTEM32>\sc.exe' 0x128 package.tmp
- '<SYSTEM32>\sc.exe' create FSProFilter2 binPath= System32\Drivers\FSPFltd2.sys Type= filesys start= boot DisplayName= "FSPro File Filter 2" group= "FSFilter Content Screener" depend= FltMgr tag= yes
- '<SYSTEM32>\sc.exe' stop fsproflt2
- '<SYSTEM32>\sc.exe' create fsproflt2 binPath= <SYSTEM32>\fsproflt2.exe DisplayName= "FSPro Filter Service 2" Start= Auto Group= UIGroup
- '<SYSTEM32>\fltMC.exe' load FSProFilter2
Modifies file system :
Creates the following files:
- %APPDATA%\Roaming\Microsoft\Windows\Start Menu\Programs\Hide Folders\Hide Folders.lnk
- %APPDATA%\Roaming\Microsoft\Windows\Start Menu\Programs\Hide Folders\Buy Hide Folders Now!.lnk
- %APPDATA%\Roaming\Microsoft\Windows\Start Menu\Programs\Hide Folders\Hide Folders Homepage....lnk
- %APPDATA%\Roaming\Microsoft\Windows\Start Menu\Programs\Hide Folders\Hide Folders Help.lnk
- %PROGRAM_FILES%\Hide Folders\unins000.dat
- %PROGRAM_FILES%\Hide Folders\unins000.msg
- %HOMEPATH%\Desktop\Hide Folders.lnk
- %PROGRAM_FILES%\Hide Folders\sounds\is-FS999.tmp
- %PROGRAM_FILES%\Hide Folders\skins\is-3B559.tmp
- %PROGRAM_FILES%\Hide Folders\skins\is-LL6MT.tmp
- %PROGRAM_FILES%\Hide Folders\skins\is-GGMFM.tmp
- %PROGRAM_FILES%\Hide Folders\skins\is-78809.tmp
- %PROGRAM_FILES%\Hide Folders\sounds\is-0GVIF.tmp
- %PROGRAM_FILES%\Hide Folders\skins\is-5G4DO.tmp
- %PROGRAM_FILES%\Hide Folders\skins\is-A1J7L.tmp
- <Auxiliary element>
- %PROGRAM_FILES%\Hide Folders\langs\Hungarian.lng
- %PROGRAM_FILES%\Hide Folders\langs\German.lng
- %PROGRAM_FILES%\Hide Folders\langs\French.lng
- %PROGRAM_FILES%\Hide Folders\langs\Korean.lng
- %PROGRAM_FILES%\Hide Folders\langs\Spanish.lng
- %PROGRAM_FILES%\Hide Folders\langs\Russian.lng
- %PROGRAM_FILES%\Hide Folders\langs\Polish.lng
- %PROGRAM_FILES%\Hide Folders\langs\Farsi.lng
- %PROGRAM_FILES%\Hide Folders\hf5.exe
- %TEMP%\nscF76A.tmp\nsProcess.dll
- %TEMP%\nscF76A.tmp\ns2945.tmp
- %PROGRAM_FILES%\Hide Folders\msimg32.dll
- %PROGRAM_FILES%\Hide Folders\langs\Estonian.lng
- %PROGRAM_FILES%\Hide Folders\langs\English.lng
- %PROGRAM_FILES%\Hide Folders\langs\Dutch.lng
- %PROGRAM_FILES%\Hide Folders\is-B831B.tmp
- %PROGRAM_FILES%\Hide Folders\is-KA0AM.tmp
- %PROGRAM_FILES%\Hide Folders\is-IG68D.tmp
- %PROGRAM_FILES%\Hide Folders\is-32QAV.tmp
- <DRIVERS>\is-UM9O3.tmp
- %PROGRAM_FILES%\Hide Folders\is-GLE11.tmp
- %PROGRAM_FILES%\Hide Folders\is-PU7K9.tmp
- %PROGRAM_FILES%\Hide Folders\is-VI5RJ.tmp
- %TEMP%\nscF76A.tmp\package.exe
- %TEMP%\nscF769.tmp
- %TEMP%\RarSFX0\Hide.Folders.v5.1.5.1089.exe
- %TEMP%\nscF76A.tmp\nsExec.dll
- %TEMP%\is-CS3RM.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-RKU3A.tmp\package.tmp
- %TEMP%\nscF76A.tmp\nsF865.tmp
- <SYSTEM32>\is-PQ6VN.tmp
- %PROGRAM_FILES%\Hide Folders\langs\is-AN0EB.tmp
- %PROGRAM_FILES%\Hide Folders\langs\is-2QQ7M.tmp
- %PROGRAM_FILES%\Hide Folders\langs\is-7K7OJ.tmp
- %PROGRAM_FILES%\Hide Folders\langs\is-AFONS.tmp
- %PROGRAM_FILES%\Hide Folders\skins\is-G4BOT.tmp
- %PROGRAM_FILES%\Hide Folders\skins\is-02URJ.tmp
- %PROGRAM_FILES%\Hide Folders\skins\is-8MOGP.tmp
- %PROGRAM_FILES%\Hide Folders\langs\is-V7ECE.tmp
- %PROGRAM_FILES%\Hide Folders\langs\is-SMN0M.tmp
- %PROGRAM_FILES%\Hide Folders\langs\is-VSKU5.tmp
- %PROGRAM_FILES%\Hide Folders\langs\is-L7UB3.tmp
- %PROGRAM_FILES%\Hide Folders\langs\is-R0UTK.tmp
- %PROGRAM_FILES%\Hide Folders\langs\is-GT8FR.tmp
- %PROGRAM_FILES%\Hide Folders\langs\is-SC2VP.tmp
- %PROGRAM_FILES%\Hide Folders\langs\is-BK1VK.tmp
Deletes the following files:
- %TEMP%\nscF76A.tmp\nsProcess.dll
- %TEMP%\nscF76A.tmp\nsExec.dll
- %TEMP%\RarSFX0\Hide.Folders.v5.1.5.1089.exe
- %TEMP%\nscF76A.tmp\package.exe
- %TEMP%\is-RKU3A.tmp\package.tmp
- %TEMP%\is-CS3RM.tmp\_isetup\_shfoldr.dll
- %TEMP%\nscF76A.tmp\ns2945.tmp
- %TEMP%\nscF76A.tmp\nsF865.tmp
Moves the following files:
- from %PROGRAM_FILES%\Hide Folders\skins\is-8MOGP.tmp to %PROGRAM_FILES%\Hide Folders\skins\Calcium.asz
- from %PROGRAM_FILES%\Hide Folders\langs\is-AFONS.tmp to %PROGRAM_FILES%\Hide Folders\langs\Estonian.lng
- from %PROGRAM_FILES%\Hide Folders\skins\is-G4BOT.tmp to %PROGRAM_FILES%\Hide Folders\skins\Topaz.asz
- from %PROGRAM_FILES%\Hide Folders\skins\is-02URJ.tmp to %PROGRAM_FILES%\Hide Folders\skins\Mint.asz
- from %PROGRAM_FILES%\Hide Folders\langs\is-7K7OJ.tmp to %PROGRAM_FILES%\Hide Folders\langs\Polish.lng
- from %PROGRAM_FILES%\Hide Folders\langs\is-V7ECE.tmp to %PROGRAM_FILES%\Hide Folders\langs\Korean.lng
- from %PROGRAM_FILES%\Hide Folders\langs\is-AN0EB.tmp to %PROGRAM_FILES%\Hide Folders\langs\Spanish.lng
- from %PROGRAM_FILES%\Hide Folders\langs\is-2QQ7M.tmp to %PROGRAM_FILES%\Hide Folders\langs\Russian.lng
- from %PROGRAM_FILES%\Hide Folders\skins\is-5G4DO.tmp to %PROGRAM_FILES%\Hide Folders\skins\Steam2.asz
- from %PROGRAM_FILES%\Hide Folders\skins\is-A1J7L.tmp to %PROGRAM_FILES%\Hide Folders\skins\Moonlight.asz
- from %PROGRAM_FILES%\Hide Folders\sounds\is-FS999.tmp to %PROGRAM_FILES%\Hide Folders\sounds\alarm2p.wav
- from %PROGRAM_FILES%\Hide Folders\sounds\is-0GVIF.tmp to %PROGRAM_FILES%\Hide Folders\sounds\alarm1p.wav
- from %PROGRAM_FILES%\Hide Folders\skins\is-LL6MT.tmp to %PROGRAM_FILES%\Hide Folders\skins\Web2.asz
- from %PROGRAM_FILES%\Hide Folders\skins\is-GGMFM.tmp to %PROGRAM_FILES%\Hide Folders\skins\Toxic.asz
- from %PROGRAM_FILES%\Hide Folders\skins\is-78809.tmp to %PROGRAM_FILES%\Hide Folders\skins\Matrix.asz
- from %PROGRAM_FILES%\Hide Folders\skins\is-3B559.tmp to %PROGRAM_FILES%\Hide Folders\skins\Zest.asz
- from %PROGRAM_FILES%\Hide Folders\is-PU7K9.tmp to %PROGRAM_FILES%\Hide Folders\Homepage.url
- from %PROGRAM_FILES%\Hide Folders\is-32QAV.tmp to %PROGRAM_FILES%\Hide Folders\license.txt
- from <DRIVERS>\is-UM9O3.tmp to <DRIVERS>\FSPFltd2.sys
- from %PROGRAM_FILES%\Hide Folders\is-GLE11.tmp to %PROGRAM_FILES%\Hide Folders\Buynow.url
- from %PROGRAM_FILES%\Hide Folders\is-IG68D.tmp to %PROGRAM_FILES%\Hide Folders\hf5.exe
- from %PROGRAM_FILES%\Hide Folders\is-VI5RJ.tmp to %PROGRAM_FILES%\Hide Folders\unins000.exe
- from %PROGRAM_FILES%\Hide Folders\is-B831B.tmp to %PROGRAM_FILES%\Hide Folders\FSPFlt2.dll
- from %PROGRAM_FILES%\Hide Folders\is-KA0AM.tmp to %PROGRAM_FILES%\Hide Folders\hf.chm
- from %PROGRAM_FILES%\Hide Folders\langs\is-BK1VK.tmp to %PROGRAM_FILES%\Hide Folders\langs\French.lng
- from %PROGRAM_FILES%\Hide Folders\langs\is-R0UTK.tmp to %PROGRAM_FILES%\Hide Folders\langs\Farsi.lng
- from %PROGRAM_FILES%\Hide Folders\langs\is-GT8FR.tmp to %PROGRAM_FILES%\Hide Folders\langs\Hungarian.lng
- from %PROGRAM_FILES%\Hide Folders\langs\is-SC2VP.tmp to %PROGRAM_FILES%\Hide Folders\langs\German.lng
- from %PROGRAM_FILES%\Hide Folders\langs\is-L7UB3.tmp to %PROGRAM_FILES%\Hide Folders\langs\Arabic.lng
- from <SYSTEM32>\is-PQ6VN.tmp to <SYSTEM32>\fsproflt2.exe
- from %PROGRAM_FILES%\Hide Folders\langs\is-SMN0M.tmp to %PROGRAM_FILES%\Hide Folders\langs\English.lng
- from %PROGRAM_FILES%\Hide Folders\langs\is-VSKU5.tmp to %PROGRAM_FILES%\Hide Folders\langs\Dutch.lng
Miscellaneous:
Searches for the following windows:
- ClassName: '' WindowName: ''
- ClassName: 'msctls_updown32' WindowName: ''
- ClassName: 'SysHeader32' WindowName: ''
- ClassName: 'EDIT' WindowName: ''
- ClassName: 'THFMainForm' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''