TROJ_RIMECUD.XDR

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Other System Modifications

This Trojan deletes the following files:

• À_þ_CHAR(0x07)_TÕ_CHAR(0x07)_Á¨_CHAR(0x07)_[þ2C‚3â'âÝʨ
• ܗFœ#_†ßGyì—Ü—á_†—v_þ—ä_ÕG(GÞG×Gó«5 oœ&—_CHAR(0x06)_œ#_q—Ü—ä_†œ§ßG?ü¡v_þkÕ?é¡ä_Õª²–ä_†òv_q_CHAR(0x1C)_Þä_Õòv_þœûœóû
• 9›C‘^_CHAR(0x19)_+êŸ_CHAR(0x04)__CHAR(0x12)_ÜÝøðɄÊ_CHAR(0x03)_êoj•«âæ2÷˜ª_CHAR(0x1C)__CHAR(0x12)_xŠ‘âv_CHAR(0x03)_»P)~#ë`_CHAR(0x12)_÷øA_CHAR(0x07)_ÔMv(:4ɉâêÇ_CHAR(0x0E)_ÚêŸM+M2XbY«2†‹2\#ë`_CHAR(0x12)_÷ø…ŽiëîY«2%ÆïûöHR%_CHAR(0x04)_Ìځ2Mv«Â¦’_CHAR(0x05)_Pè?×3æò9œ=XêM.5ŒêŒÜá果c_CHAR(0x01)__CHAR(0x1B)_ø=XêRs«Â_CHAR(0x12)__CHAR(0x0B)_d¼•«Z3æ2÷˜#_CHAR(0x01)_õðÉ̸_CHAR(0x1C)_«âê\Ç_CHAR(0x0F)_c_CHAR(0x01)_´ø=X_(¥«Œ4?~9jŠ’ý=x_CHAR(0x04)_ä~ºM2MŠRvd‡1Ý+•_CHAR(0x1B)_qa½_CHAR(0x16)__CHAR(0x12)__CHAR(0x04)_+_CHAR(0x0F)_¶6cØ2Œpèi×3æÝ9ô=Xê;v(ŒÈÉÅ«
• Âp9›CÕicwf4°c_CHAR(0x0F)_ý¼×#\šTþj2\`ûâÝÂȁ Mv½{ꌏ9›M¹ +_CHAR(0x13)__CHAR(0x07)_¾!__CHAR(0x17)_~«_CHAR(0x04)_voµ&v×ù½¦Ÿ_CHAR(0x04)_+T_CHAR(0x02)_Cð)'J$_CHAR(0x14)_oj•_CHAR(0x1B)_¸=œ´¨(2T_CHAR(0x02)_CŠ5¶ðŒ:µ&v_u¥×Ÿ_CHAR(0x04)_ɘ_CHAR(0x13)_Õ¾oêŒ[敡¸_ߏ_CHAR(0x12)__CHAR(0x04)_+Mê~+_CHAR(0x0C)_Œ_CHAR(0x07)_ו¡‘_CHAR(0x04)_Õ_CHAR(0x1F)__CHAR(0x12)_ç™w´Šge×oØ«+̂M¥æ2%É˜÷jéRo臏ojËB#BµÕŸQH~G_CHAR(0x04)_+䓢¦ÏªU°ž#BÝ_CHAR(0x1F)_;˜=o_CHAR(0x13)_X2±¦oj2_CHAR(0x19)_i݌í;M¬Ž2Mv_CHAR(0x0F)_Š4ªp:§Š¡—=xç,EÉ¢_CHAR(0x01)_•oy$_CHAR(0x1F)_t
• ŒÜáΊ«þâæ2ñ¤´ÉêXvWŒôšA_CHAR(0x0F)_àÍÛ_CHAR(0x12)_Hc_CHAR(0x01)_=X=X_(äÉÊ@voµè3÷3æ2¡_CHAR(0x19)_HôSXð²À]†T_CHAR(0x16)_3êö`_CHAR(0x0B)_Ÿ_CHAR(0x12)_÷ø=oгå½ùðŒþ6_CHAR(0x1B)__CHAR(0x03)_×3ìן_CHAR(0x04)__CHAR(0x12)_ܖøðɄ2üZâê_CHAR(0x06)_2-Ô­Ÿ_CHAR(0x04)_ÉÜÀøðÉÚ×_CHAR(0x03)_B™_CHAR(0x03)_\_CHAR(0x12)_=Š×ø=XÝ_CHAR(0x07)_±iË2÷*_CHAR(0x0C)_èo66êŸ_CHAR(0x04)__CHAR(0x12)_Ü÷øðɄ2SÌ(°K\_CHAR(0x12)_ë_CHAR(0x1C)_¾9®+M2XbG«2AoàQ[_CHAR(0x12)_H/\»öRM2ëcÞ«2Ü:êƒzjšêäµÖÉêXð)IJð8«â¶ÝcpŠ_CHAR(0x08)_×ø=1BúÉêUg´ê•«þâæ2ä_CHAR(0x1D)_¹1¬™+Öã
• —2:—÷¾5¨N
• ??????????????????????????????????????
• ???????????????????????????????????????????????????????????????????????????????????????????????????????????????? ???????????????????????????????????????????????????????????????????????????????????????????8????????????????????????????????????????????????????????
• _CHAR(0x14)_]ð2:Š}£*ª_CHAR(0x03)_o¬e_CHAR(0x19)_içWÜƷɘvj«(#\US9›CMÊHŒíaø¥Çä©ðù鱪_CHAR(0x03)_#ø\­=®_CHAR(0x13)__CHAR(0x04)_‹…_CHAR(0x06)_÷Mð_CHAR(0x0F)_eJ²_CHAR(0x03)_«â¦¡\_CHAR(0x04)_Õw_CHAR(0x13)_6 ê®ö¶(š€á'•_CHAR(0x1B)_¶=C÷¨s™1¢2vof4ª_CHAR(0x12)_‡/øž×}ݕîõ+Mõ¾U¾M·¦Ï[µ2ÕiÝjáñ_CHAR(0x03)_™M_CHAR(0x0F)_=d(Œêk¼–E´_CHAR(0x12)_Hèw_CHAR(0x04)__CHAR(0x16)_î_CHAR(0x1F)_eø²Ïƒv zöŸ•¢_sçŸ'Xw´ŠgX2_CHAR(0x15)_«oj2‚‡âæ2¨sð3_CHAR(0x02)_'†(Œê4U«+'_CHAR(0x19)_içæ_CHAR(0x0C)_å4°ö™_CHAR(0x17)_p_CHAR(0x01)_vêŒ÷ÝX2fö¶_CHAR(0x1C)_‚}ø¾¶ê‚+åHŒÔ›öˆÝŒíƚ
• ????????????????????????????????????????????????????????????????????????????????????????????????????????????+???????????????????????¦????????????????????????????£?????????(???????????????????£?????????????????????????????????????????????????????????????????????
• ???????????????????????????£?????????????????????u???????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????¬???????????????????????????????????????????????????????????????????
• è
• ??????????????????
• ³?³?³?³?³?³?³?³?³?³?Ç?Ç?Ç?Ç?Ç?Ç
• ????????????????????????????????????????????????????????????????????????????h???F?????
• ±¥ Sz¾_CHAR(0x16)_`±À¾0?_CHAR(0x14)_?ú
• è
• ‡ÔÀ_CHAR(0x1A)_@ŒÅeŒI\#¾)øq_CHAR(0x0B)_:nsæsÂJ_CHAR(0x16)_ù_CHAR(0x17)__CHAR(0x03)_ºø(V_CHAR(0x04)_A(26r_CHAR(0x15)_–ç†âƒ8._CHAR(0x06)_3¯Aÿʧr3MvR™#”e_CHAR(0x0E)_£z‰˜_QŸô_CHAR(0x14)_~åMŠ_CHAR(0x05)_'ùf_CHAR(0x0E)_Q&èEÖ]Ï~¤Ð¹gøaµ9ûÂÅ©H2²þÉ^º»æGM©@Y®vêßÑÚ6_CHAR(0x10)_xØpQŸôݟåMŠ_CHAR(0x05)_'ùf_CHAR(0x0E)_Q&èEÖ]ÏM¤°_i8(ŒÌð%\M•×ÔHš%_CHAR(0x17)_t¥K—sè‰÷à¬òÅK÷[_CHAR(0x12)_3jùõjW/_CHAR(0x03)_M—Ç2yTo}¥’YҚǢZ†:E¯_CHAR(0x06)_̛áª_CHAR(0x07)_åË÷[_CHAR(0x12)_ø—u_CHAR(0x0E)__CHAR(0x16)__CHAR(0x13)__CHAR(0x04)_2`M_CHAR(0x1B)__CHAR(0x12)_yToGøÕæ¶Cêր_CHAR(0x1C)_
• ?
• ????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????L???????????????????t?????????t??????????????????????????????????????????????????
• ????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????Œ??????????????????????????????????????????????????????????-?????????
• ¸\`ì¥g,­L¬_cº\e1j_CHAR(0x03)_ÕiãæœålðcêX•gT4ª~_CHAR(0x12)__CHAR(0x10)_2‘²j¾.÷Íç½22ðÉÄI_CHAR(0x03)_êêf¸3(c÷͙Xwڊg_CHAR(0x03)_Mª†£–_CHAR(0x12)_×3èwêÁûXw2Šg_CHAR(0x03)_Mª†£â˾ՑÀêŸ6°î®_CHAR(0x07)_vÉ$¥·ñ—âê_CHAR(0x19)_iݍó_CHAR(0x16)_º+:_ñö}_CHAR(0x18)_4ªÌԛÌ_CHAR(0x19)_iðW_CHAR(0x1F)_¨sÚT_CHAR(0x02)_@•g54ªP‡2_CHAR(0x19)_iÉêµlG· jé¿#\S~9›š†ÂHšêäsÚT:´Š(rðs(9›'_CHAR(0x19)__CHAR(0x12)_“_CHAR(0x1C)_~äõÚ  Ä‚«j±_CHAR(0x15)_oj2_CHAR(0x19)_iTcê;_CHAR(0x1D)_w_CHAR(0x1C)_'ë¼+Ú×L_CHAR(0x03)_¼Pœø_CHAR(0x10)_ÖÏêŸÊ&T_CHAR(0x02)_ŠR’2%áX.
• ?????????????????????????????????????
• ‘ƒN_CHAR(0x19)_ìN‘ƒ^Ñ(N_CHAR(0x19)_ì^U߁Ë߁RÕé{X777_CHAR(0x02)_&Ú:7_öAäl
• ?????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????
• ???7
• ?????????????????????????????????????????????????????????????????????????????????????????????????????????¬???????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????_CHAR(0x08)_???????
• ?????????????????????????????????????????_???????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????£??????????????????????????????????????????????????????????????????i????????????????????
• N^N^N^N^N^N^N^^^
• ????????
• ???????????????????l?????????????????????????
• ·@ÂÒºÚjH_CHAR(0x04)_Mêðæ™ÎçAï]r_CHAR(0x0F)_ÐVÖg´_CHAR(0x1F)_ˆ‹i_CHAR(0x0C)_­ôÑʹÔFKÜ5÷_CHAR(0x01)_“à-IG}+Œ_CHAR(0x03)_e_CHAR(0x18)_ó¿ûÞ̈́ÄEtB›©õ§ _CHAR(0x1D)_(×y_CHAR(0x17)_sUË_CHAR(0x06)_xY&o)¼œ˜R¢w:_CHAR(0x02)_£7%%’_CHAR(0x16)__CHAR(0x16)_’WW
• ???????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????+???????????????????????????Œ???????????»???????????????????????????????????????»?????????
• ??
• ??????????????????????????????????????????????????????????????????????????????????)?????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????´??????????????????_?????????????????????????????????

It deletes the following folders:

• _CHAR(0x14)_z¾S¯±”L¾Sz±W ””L?z±SLz±*L_CHAR(0x14)_#`#¤¸
• °_CHAR(0x12)_EJUCc‚åïÔÚkjÜ.öç_CHAR(0x16)_ŧšêŸËÊs‰è_CHAR(0x18)_[Ð]ñ/øê-’_CHAR(0x12)_oà(q_CHAR(0x04)_짼çM¼bzo_CHAR(0x03)_óÌåH:×VB_CHAR(0x18)_Mó_CHAR(0x1D)_F_CHAR(0x16)_Vi_CHAR(0x18)__CHAR(0x16)_֋e~_CHAR(0x0C)_iG!ÝsƒLX½T~ö@ó³ KÎ_CHAR(0x18)__CHAR(0x0F)_óÛkw‚LVM„MÍjX$+esYo°(ªðÍ×XЌ_CHAR(0x06)_ŒyƒUDЄ¡;êáLЙ'7ýο(噂&o KÎ_CHAR(0x18)__CHAR(0x0F)_ów:Mn‹ýο(噂&o KÎ_CHAR(0x18)__CHAR(0x0F)_óÛk¢‚L2Î_CHAR(0x18)_ðÛAX$©'µÉÒ3L_CHAR(0x12)_œ_CHAR(0x03)__CHAR(0x1D)__CHAR(0x05)_sU~Ùö_CHAR(0x16)_¨oAêðo‚_CHAR(0x1B)_[HÚ+M2_CHAR(0x04)_v( jŒ+j2\uΚê€_CHAR(0x04)_+éOMv_CHAR(0x03)_÷êŒø_CHAR(0x13)_j2
• è~ŠM2MµiŒê¦Ï\_CHAR(0x14)_ _CHAR(0x05)_´(šêäsM3'¥’Œê¦Ï\_CHAR(0x14)_ ?J(šêäsM3'ÑN’Œê¦Ï\_CHAR(0x14)_ °¦œšêäsM3'¿£_CHAR(0x02)_Œê¦Ï\_CHAR(0x14)_ z̚êäsM3'_CHAR(0x03)_âiŒê¦Ï\_CHAR(0x14)__CHAR(0x12)__CHAR(0x13)__CHAR(0x12)_Hš°ý_CHAR(0x04)_+T_CHAR(0x02)_'ÖRý:oµœøsÈ_CHAR(0x12)_êŸ_CHAR(0x04)_ŏ2MŠg_CHAR(0x13)__CHAR(0x16)_¶üoj2~oHš%ÆáÅ_CHAR(0x07)_äMv(:{Œ9›PÇ_CHAR(0x0E)__CHAR(0x1C)_šêŸ7KM2뼌=oj_CHAR(0x16)_._CHAR(0x12)_HcwðL½b2MvúÅêŒÜá¥V_CHAR(0x13)_^Hšê§_CHAR(0x1A)_+M__CHAR(0x17)_p_CHAR(0x10)_üŒo_CHAR(0x12)_F\_CHAR(0x12)_=xè~€M2MãŒê¦Ï\_CHAR(0x14)__CHAR(0x12)_ä_CHAR(0x12)_Hši•_CHAR(0x04)_+T_CHAR(0x02)_'Ö5Áꌏ`—2\#BÌÝ
• l
• t½Ô/¸o6̜ž^Åwv§²v0–ßo¤Ù¾_CHAR(0x06)_5_©î¶m**ùÑA˜å bq›ÓXÍ.œ_CHAR(0x04)_…[ÜQ€DKÌßS_CHAR(0x05)_™Õ9½)Í_CHAR(0x0C)_ȅ÷˜†aH_CHAR(0x03)_Mý~5kã_CHAR(0x14)_G™2\ÆjšêÕ@+M8Mv(Á猏”j2/ùHš ½_CHAR(0x04)_+?gMvÖwêŒÐ¡j2äNHšÔ{_CHAR(0x04)_+q—Mv(oðŒ[zH2s¼jš0°M+)Ý_CHAR(0x04)_v¬jðŒ_CHAR(0x1E)_íH2{jšÞ™M+_CHAR(0x15)__CHAR(0x04)_vSðŒ_CHAR(0x16)_Ùº2Òïښ@_CHAR(0x06)_ê+؄ðv_CHAR(0x08)_P_CHAR(0x04)_ŒÊEÚ2^ôºšOßð+()™vQ¶ÎŒº_CHAR(0x1C)_Â2Ú?Қ_CHAR(0x1C)_úæ+Wg™vպΌ²õÂ2ƒÒš9ëæ+¿s™v
• 77

This report is generated via an automated analysis system.