Backdoor.Win32.FUPORPLEX.C

Canal de infecção: Dropped by other malware, Downloaded from the Internet

This Backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Tipo de compactação: 2,483,200 bytes

Tipo de arquivo: Other

Residente na memória: Yes

Data de recebimento das amostras iniciais: 21 Oct 2020

Carga útil: Deletes files, Steals information, Connects to URLs/IPs, Displays message/message boxes

Arrival Details

This Backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Backdoor drops the following files:

%Windows%\winupdate32.log if OS is x32
%Windows%\winupdate64.log if OS is x64
One of the following:
- %Windows%\sens.dll
- %Windows%\cscdll.dll
One of the following:
- %Windows%\AppPatch\Acpsens.dll -> copy of legit %Windows%\sens.dll
- %Windows%\AppPatch\Acpcscdll.dll -> copy of legit %Windows%\cscdll.dll
%Windows%\AppPatch\Ke{6 random numbers}.xsl
%Windows%\AppPatch\Ac{Characters based on C: volume serial number}.sdb -> copy of %Windows%\AppPatch\Ke5{6 random numbers}.xsl
%Windows%\AppPatch\Custom\{7 random characters}.tmp -> copies of its components
%System%\Ms{Characters based on C: volume serial number}App.dll
%System%\drivers\dump_{random hex strings}.sys

(Note: %Windows% is the Windows folder, where it usually is C:\Windows on all Windows operating system versions.. %System% is the Windows system folder, where it usually is C:\Windows\System32 on all Windows operating system versions.)

It adds the following processes:

netsh interface ipv6 install
netsh.exe ipsec static add policy name=qianye
netsh.exe ipsec static add filterlist name=Filter1
netsh.exe ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=445 protocol=TCP
netsh.exe ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=135 protocol=TCP
netsh.exe ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=139 protocol=TCP
netsh.exe ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=445 protocol=UDP
netsh.exe ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=135 protocol=UDP
netsh.exe ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=139 protocol=UDP
netsh.exe ipsec static add filteraction name=FilteraAtion1 action=block
netsh.exe ipsec static add rule name=Rule1 policy=qianye filterlist=Filter1 filteraction=FilteraAtion1
netsh.exe ipsec static set policy name=qianye assign=y
%System%\svchost.exe -k NetworkService
%System%\svchost.exe -k LocalService

(Note: %System% is the Windows system folder, where it usually is C:\Windows\System32 on all Windows operating system versions.)

It creates the following folders:

%System Root%\RECYCLER
%Windows%\AppPatch
%Windows%\AppPatch\Custom
%Program Files%\OTFDXCNEJDKCODPNIZZRXFWJIBKVCIHFNGXU\OTFDXCNEJDKCODPNIZZRXFWJIBKVCIHFNGXU\
%Program Files%\OTFDXCNEJDKCODPNIZZRXFWJIBKVCIHFNGXU\

(Note: %System Root% is the Windows root folder, where it usually is C:\ on all Windows operating system versions.. %Windows% is the Windows folder, where it usually is C:\Windows on all Windows operating system versions.. %Program Files% is the default Program Files folder, usually C:\Program Files in Windows 2000(32-bit), Server 2003(32-bit), XP, Vista(64-bit), 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit) , or C:\Program Files (x86) in Windows XP(64-bit), Vista(64-bit), 7(64-bit), 8(64-bit), 8.1(64-bit), 2008(64-bit), 2012(64-bit) and 10(64-bit).)

Other System Modifications

This Backdoor deletes the following files:

%System%\Ms{Characters based on C: volume serial number}App.dll
One of the following:
- %Windows%\sens.dll
- %Windows%\cscdll.dll
One of the following:
- %Windows%\AppPatch\Acpsens.dll
- %Windows%\AppPatch\Acpcscdll.dll
.tmp files in %Windows%\AppPatch\Custom\
.tmp files in %Windows%\AppPatch\
.xsl files in %Windows%\AppPatch\

(Note: %System% is the Windows system folder, where it usually is C:\Windows\System32 on all Windows operating system versions.. %Windows% is the Windows folder, where it usually is C:\Windows on all Windows operating system versions.)

It deletes the following folders:

%System Root%\RECYCLER

(Note: %System Root% is the Windows root folder, where it usually is C:\ on all Windows operating system versions.)

It adds the following registry entries:

HKEY_LOCAL_MACHINE\SOFTWARE\SoundResearch
UpdaterLastTimeChecked1 = 1

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Installer\
Folders
%Program Files%\OTFDXCNEJDKCODPNIZZRXFWJIBKVCIHFNGXU\OTFDXCNEJDKCODPNIZZRXFWJIBKVCIHFNGXU\ = 1

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Installer\
Folders
%Program Files%\OTFDXCNEJDKCODPNIZZRXFWJIBKVCIHFNGXU\ = 1

HKEY_LOCAL_MACHINE\SYSTEM\{ControlSet001 or CurrentControlSet}\
services\Ms{Characters based on C: volume serial number}App\Parameters
ServiceDll = %System%\Ms{Characters based on C: volume serial number}App.dll

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows NT\CurrentVersion\Svchost
netsvcs = {add "Ms{Characters based on C: volume serial number}App" to the list}

HKEY_LOCAL_MACHINE\SYSTEM\{ControlSet001 or CurrentControlSet}\
services\Ms{Characters based on C: volume serial number}App
ImagePath = %System%\svchost.exe -k netsvcs

HKEY_CURRENT_USER\Software\Policies\
Microsoft\Windows Defender
DisableAntiSpyware = 1

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\Windows Defender
DisableAntiSpyware = 1

HKEY_CURRENT_USER\Software\Microsoft\
Windows Script\Settings
JITDebug = 0

Information Theft

This Backdoor gathers the following data:

Current Date
MAC Address
System's service pack
Volume Serial-ID

Other Details

This Backdoor adds the following registry keys:

HKEY_LOCAL_MACHINE\SYSTEM\{ControlSet001 or CurrentControlSet}\
services\Ms{Characters based on C: volume serial number}App\Parameters

HKEY_LOCAL_MACHINE\SYSTEM\{ControlSet001 or CurrentControlSet}\
services\Ms{Characters based on C: volume serial number}App

HKEY_LOCAL_MACHINE\SOFTWARE\SoundResearch

It does the following:

Prompts user to restart the machine after its installation:
{BLOCKED}.{BLOCKED}.192.42:10944/{random hex}.moe --> --> --> --> --> --> --> --> --> --> --> --> --> --> --> --> --> --> --> --> --> --> --> --> --> --> --> --> --> --> --> --> --> --> --> --> --> --> --> --> --> --> --> --> --> --> --> --> --> --> --> --> --> --> --> --> --> --> --> --> --> --> --> --> --> --> --> --> --> --> --> --> --> --> --> --> --> --> --> -->

Downloaded modules are saved as %Windows%\AppPatch\Custom\{random hex}.moe

It adds the following mutex to avoid re-running certain malicious routines:

Global\RunWord{random characters} ? for shellcode routine
Global\{Characters based on C: volume serial number}CSS ? for registry creation routine
Global\{Characters based on C: volume serial number}SetServiceX ? for "%System%\svchost.exe -k LocalService" process execution routine
Global\{Characters based on C: volume serial number}SetService ? for "%System%\svchost.exe -k LocalService" process execution routine
Global\{Characters based on C: volume serial number}AppService ? for "%System%\svchost.exe -k NetworkService" process execution routine

Mecanismo de varredura mínima: 9.800

Primeiro arquivo padrão VSAPI: 16.306.01

Data do lançamento do primeiro padrão VSAPI: 23 Oct 2020

VSAPI OPR Pattern Version: 16.307.00

VSAPI OPR Pattern veröffentlicht am: 24 Oct 2020

Step 1

Before doing any scans, Windows 7, Windows 8, Windows 8.1, and Windows 10 users must disable System Restore to allow full scanning of their computers.

Step 2

Note that not all files, folders, and registry keys and entries are installed on your computer during this malware's/spyware's/grayware's execution. This may be due to incomplete installation or other operating system conditions. If you do not find the same files/folders/registry information, please proceed to the next step.

Step 3

Identify and terminate files detected as Backdoor.Win32.FUPORPLEX.C

[ Learn More ]

Windows Task Manager may not display all running processes. In this case, please use a third-party process viewer, preferably Process Explorer, to terminate the malware/grayware/spyware file. You may download the said tool here.
If the detected file is displayed in either Windows Task Manager or Process Explorer but you cannot delete it, restart your computer in safe mode. To do this, refer to this link for the complete steps.
If the detected file is not displayed in either Windows Task Manager or Process Explorer, continue doing the next steps.

Step 4

Delete this registry key

[ Learn More ]

Important: Editing the Windows Registry incorrectly can lead to irreversible system malfunction. Please do this step only if you know how or you can ask assistance from your system administrator. Else, check this Microsoft article first before modifying your computer's registry.

In HKEY_LOCAL_MACHINE\SYSTEM\{ControlSet001 or CurrentControlSet}\
- services\Ms{Characters based on C: volume serial number}App\Parameters
In HKEY_LOCAL_MACHINE\SYSTEM\{ControlSet001 or CurrentControlSet}\
- services\Ms{Characters based on C: volume serial number}App
In HKEY_LOCAL_MACHINE\SOFTWARE\SoundResearch

Step 5

Delete this registry value

[ Learn More ]

Important: Editing the Windows Registry incorrectly can lead to irreversible system malfunction. Please do this step only if you know how or you can ask assistance from your system administrator. Else, check this Microsoft article first before modifying your computer's registry.

In HKEY_LOCAL_MACHINE\SOFTWARE\SoundResearch
- UpdaterLastTimeChecked1 = 1
In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders
- %Program Files%\OTFDXCNEJDKCODPNIZZRXFWJIBKVCIHFNGXU\OTFDXCNEJDKCODPNIZZRXFWJIBKVCIHFNGXU\ = 1
In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders
- %Program Files%\OTFDXCNEJDKCODPNIZZRXFWJIBKVCIHFNGXU\ = 1
In HKEY_LOCAL_MACHINE\SYSTEM\{ControlSet001 or CurrentControlSet}\services\Ms{Characters based on C: volume serial number}App\Parameters
- ServiceDll = %System%\Ms{Characters based on C: volume serial number}App.dll
In HKEY_LOCAL_MACHINE\SYSTEM\{ControlSet001 or CurrentControlSet}\services\Ms{Characters based on C: volume serial number}App
- ImagePath = %System%\svchost.exe -k netsvcs
In HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows Defender
- DisableAntiSpyware = 1
In HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender
- DisableAntiSpyware = 1
In HKEY_CURRENT_USER\Software\Microsoft\Windows Script\Settings
- JITDebug = 0

To delete the registry value this malware created:

Open Registry Editor. To do this:
» For Windows 7 and Windows Server 2008 (R2) users, click the Start button, type regedit in the Search input field then press Enter.
» For Windows 8, Windows 8.1, 10, and Windows Server 2012 (R2) users, right-click on the lower left corner of the screen, click Run, type regedit in the text box provided, and then press Enter.
In the left panel of the Registry Editor window, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>SoundResearch
In the right panel, locate and delete the entry:
UpdaterLastTimeChecked1 = 1
In the left panel of the Registry Editor window, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>Installer>Folders
In the right panel, locate and delete the entry:
%Program Files%\OTFDXCNEJDKCODPNIZZRXFWJIBKVCIHFNGXU\OTFDXCNEJDKCODPNIZZRXFWJIBKVCIHFNGXU\ = 1
Again In the right panel, locate and delete the entry:
%Program Files%\OTFDXCNEJDKCODPNIZZRXFWJIBKVCIHFNGXU\ = 1
In the left panel of the Registry Editor window, double-click the following:
HKEY_LOCAL_MACHINE>SYSTEM>{ControlSet001 or CurrentControlSet}>services>Ms{Characters based on C: volume serial number}App>Parameters
In the right panel, locate and delete the entry:
ServiceDll = %System%\Ms{Characters based on C: volume serial number}App.dll
In the left panel of the Registry Editor window, double-click the following:
HKEY_LOCAL_MACHINE>SYSTEM>{ControlSet001 or CurrentControlSet}>services>Ms{Characters based on C: volume serial number}App
In the right panel, locate and delete the entry:
ImagePath = %System%\svchost.exe -k netsvcs
In the left panel of the Registry Editor window, double-click the following:
HKEY_CURRENT_USER>Software>Policies>Microsoft>Windows Defender
In the right panel, locate and delete the entry:
DisableAntiSpyware = 1
In the left panel of the Registry Editor window, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Policies>Microsoft>Windows Defender
In the right panel, locate and delete the entry:
DisableAntiSpyware = 1
In the left panel of the Registry Editor window, double-click the following:
HKEY_CURRENT_USER>Software>Microsoft>Windows Script>Settings
In the right panel, locate and delete the entry:
JITDebug = 0
Close Registry Editor.

Step 6

Search and delete this file

[ Learn More ]

There may be some files that are hidden. Please make sure you check the Search Hidden Files and Folders checkbox in the "More advanced options" option to include all hidden files and folders in the search result.

%Windows%\AppPatch\Ke{6 random numbers}.xsl
%Windows%\AppPatch\Ac{Characters based on C: volume serial number}.sdb
%Windows%\AppPatch\Custom\{7 random characters}.tmp
%System%\Ms{Characters based on C: volume serial number}App.dll
%System%\drivers\dump_{random hex strings}.sys
%Windows%\winupdate32.log if OS is x32
%Windows%\winupdate64.log if OS is x64

Step 7

Search and delete these folders

[ Learn More ]

Please make sure you check the Search Hidden Files and Folders checkbox in the More advanced options option to include all hidden folders in the search result.

%System Root%\RECYCLER
%Windows%\AppPatch
%Windows%\AppPatch\Custom
%Program Files%\OTFDXCNEJDKCODPNIZZRXFWJIBKVCIHFNGXU\OTFDXCNEJDKCODPNIZZRXFWJIBKVCIHFNGXU\
%Program Files%\OTFDXCNEJDKCODPNIZZRXFWJIBKVCIHFNGXU\

Step 8

Restore this file from backup only Microsoft-related files will be restored. If this malware/grayware also deleted files related to programs that are not from Microsoft, please reinstall those programs on you computer again.

if %Windows%\AppPatch\Acpsens.dll exists:

restore %Windows%\sens.dll

if %Windows%\AppPatch\Acpcscdll.dll exists:

restore %Windows%\cscdll.dll

Step 9

Scan your computer with your Trend Micro product to delete files detected as Backdoor.Win32.FUPORPLEX.C. If the detected files have already been cleaned, deleted, or quarantined by your Trend Micro product, no further step is required. You may opt to simply delete the quarantined files. Please check the following Trend Micro Support pages for more information:

Did this description help? Tell us how we did.

OVERVIEW

TECHNICAL DETAILS

SOLUTION

Recursos

Suporte

Sobre a Trend

Backdoor.Win32.FUPORPLEX.C

OVERVIEW

TECHNICAL DETAILS

SOLUTION

Recursos

Suporte

Sobre a Trend

Américas

Oriente Médio & África

Europa

Ásia&Pacífico