msoutc.exe

As in case with the malware described in our blogpost, it will also install itself as a system service. The service will be called "Indman", "Indexing Manager", and described as "Provides fast indexing service".

As in case with the malware described in our blogpost, it will also install itself as a system service. The service will be called "Indman", "Indexing Manager", and described as "Provides fast indexing service".

The implementation of this function is very unique - it involves complete filling of the file with the random data in order to occupy all associated disk sectors, before the file is deleted. The file-delete function itself is also unique – the file is first renamed into a temporary file with a random name, and that temporary file is also deleted.

When the malware reaches out to the C&C server, it may receive a special instruction to terminate itself. In that case, it uninstalls its service, deletes its configuration and log files, then quits and deletes itself by executing a self-delete batch file... In order to delete its configuration and log files, the bot calls an internal function that wipes these files out so that their contents cannot be forensically restored.

When executed, it checks if there is another instance of itself already running on a system, by attempting to create a mutex called: Global\FwtSqmSession106839323_S-1-5-20 If the mutex creation attempt fails, returning the 'already exists' error code, the bot will quit and delete itself

The default parameters specify 127.0.0.1 (local host) and port 443 as the default address for the C&C server... Every 5 minutes it initiates a communication to the remote C&C. | Every 5 minutes it initiates a communication to the remote C&C. All communications are encrypted. The beacon signal it sends contains the local IP address. The data it receives from the C&C is first decrypted, and then used to update its own executable and the wmplog09c.sqm configuration file.

The data it receives from the C&C is first decrypted, and then used to update its own executable and the wmplog09c.sqm configuration file. The updated executable may have additional functionality that is missing in the analysed sample.