PUA.Win32.FinalShell.BA

This Potentially Unwanted Application arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Arrival Details

This Potentially Unwanted Application arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Potentially Unwanted Application adds the following folders:

• %AppDataLocal%\finalshell
• %AppDataLocal%\finalshell\img
• %AppDataLocal%\finalshell\jre
• %AppDataLocal%\finalshell\jre\bin
• %AppDataLocal%\finalshell\jre\bin\server
• %AppDataLocal%\finalshell\jre\conf
• %AppDataLocal%\finalshell\jre\include
• %AppDataLocal%\finalshell\jre\legal
• %AppDataLocal%\finalshell\jre\lib
• %AppDataLocal%\finalshell\lib-run
• %AppDataLocal%\finalshell\theme
• %Programs%\FinalShell
• %User Temp%\ns{random 4-5 characters}.tmp

(Note: %AppDataLocal% is the Local Application Data folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).. %Programs% is the folder that contains the user’s program groups, which is usually C:\Windows\Start Menu\Programs or C:\Documents and Settings\{User name}\Start Menu\Programs on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Roaming\Microsoft\Windows\Start Menu\Programs on Windows Vista, 7, and 8.. %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

It drops the following files depending on the platform/operating system of the affected computer:

• %AppDataLocal%\finalshell\curl.exe → Command-line file transfer tool
• %AppDataLocal%\finalshell\download_jre.bat → Batch script to download external Java runtime components if required
• %AppDataLocal%\finalshell\finalshell.exe → Main application launcher executable
• %AppDataLocal%\finalshell\finalshell.jar → Decompressed core Java application archive
• %AppDataLocal%\finalshell\finalshelltest.bat → Diagnostic launch script configuring JVM heap allocation
• %AppDataLocal%\finalshell\finalshell_win.pack.gz → Compressed Pack200 archive containing core FinalShell bytecode
• %AppDataLocal%\finalshell\img\finalshell.png → Application icon image
• %AppDataLocal%\finalshell\img\logo.icns → Application logo icon resource
• %AppDataLocal%\finalshell\installer_updater.exe → Background software update utility
• %AppDataLocal%\finalshell\ipdata.dat → Geolocation IP resolution database
• %AppDataLocal%\finalshell\ipseccmd.exe → Windows IPSec policy administration utility
• %AppDataLocal%\finalshell\lib-run\bcprov.jar → Decompressed Bouncy Castle cryptography provider archive
• %AppDataLocal%\finalshell\lib-run\bcprov.pack.gz → Compressed Bouncy Castle cryptographic library archive
• %AppDataLocal%\finalshell\msvcp120.dll → Microsoft Visual C++ 2013 runtime library
• %AppDataLocal%\finalshell\msvcr100.dll → Microsoft Visual C++ 2010 runtime library
• %AppDataLocal%\finalshell\msvcr120.dll → Microsoft Visual C++ 2013 runtime library
• %AppDataLocal%\finalshell\msvcr71.dll → Microsoft Visual C++ .NET 2003 runtime library
• %AppDataLocal%\finalshell\nsExec.dll → NSIS silent process execution plugin library
• %AppDataLocal%\finalshell\uninstaller.exe → Application uninstaller binary
• %AppDataLocal%\finalshell\unpack200.exe → Oracle Java Pack200 decompression tool
• %AppDataLocal%\finalshell\winpcap_install.exe → WinPcap packet capture driver installer package
• %Desktop%\FinalShell.lnk → Shortcut to launch %AppDataLocal%\finalshell\finalshell.exe
• %Programs%\FinalShell\FinalShell.lnk → Start menu shortcut to launch %AppDataLocal%\finalshell\finalshell.exe
• %Programs%\FinalShell\FinalShell网站.lnk → Internet shortcut pointing to developer site hxxp://www[.]hostbuf[.]com/
• %Programs%\FinalShell\Uninstall.lnk → Start menu uninstallation shortcut pointing to %AppDataLocal%\finalshell\uninstaller.exe
• %User Temp%\ns{random 4-5 characters}.tmp\ExecCmd.dll → Temporary installer plugin used to execute command-line tasks
• %User Temp%\ns{random 4-5 characters}.tmp\nsExec.dll → Temporary installer plugin for silent command execution
• %User Temp%\ns{random 4-5 characters}.tmp\processwork.dll → Temporary installer helper plugin used to detect and terminate active FinalShell processes during installation

(Note: %AppDataLocal% is the Local Application Data folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).. %Desktop% is the current user's desktop, which is usually C:\Documents and Settings\{User Name}\Desktop on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\Desktop on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).. %Programs% is the folder that contains the user’s program groups, which is usually C:\Windows\Start Menu\Programs or C:\Documents and Settings\{User name}\Start Menu\Programs on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Roaming\Microsoft\Windows\Start Menu\Programs on Windows Vista, 7, and 8.. %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

It adds the following processes:

• "%AppDataLocal%\finalshell\finalshell.exe" → Launches the FinalShell environment upon setup completion
• "%AppDataLocal%\finalshell\unpack200.exe" finalshell_win.pack.gz finalshell.jar → Decompresses main application JAR
• "%AppDataLocal%\finalshell\unpack200.exe" lib-run\bcprov.pack.gz lib-run\bcprov.jar → Decompresses cryptographic dependencies
• "%System%\cmd.exe" /C w → Command processor invocation spawned during setup helper execution
• "%System%\conhost.exe" 0xffffffff -ForceV1 → Console window host associated with spawned helper commands

(Note: %AppDataLocal% is the Local Application Data folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).. %System% is the Windows system folder, where it usually is C:\Windows\System32 on all Windows operating system versions.)

Other System Modifications

This Potentially Unwanted Application adds the following registry keys:

HKEY_CURRENT_USER\Software\finalshell
(Default) = {installed path}

It adds the following registry entries:

HKEY_CURRENT_USER\Software\finalshell
Installer Language = 2052