Malware
FuwuqiDrama
FuwuqiDrama is a server-side RAT. It manages client connections by utilizing I/O completion ports, which are usually used in high-performance server applications as an elegant solution to manage many
FuwuqiDrama is a Windows malware family operated by Lazarus Group.
Background
FuwuqiDrama is a server-side RAT that handles client connections through I/O completion ports, a mechanism typically reserved for high-performance server software that needs to service many clients simultaneously.
Two hardcoded lists set it apart.
The first holds roughly 50 video filenames of South Korean TV series whose titles have been rendered into Mandarin Chinese and then written in Pinyin romanization, meaning the sounds appear in the Latin alphabet without tone marks. For instance, meiyounihuobuxiaqu.avi corresponds to Can't Live Without You (a 2012 K-drama) and wulalafufu.avi to Ohlala Couple (also 2012).
The second enumerates these companies: NVIDIA, Amazon, Intel, Skype, 360Safe, Rising, Tencent, Mozilla, Adobe, Yahoo, Google. The identical list appears in certain WannaCryptor samples.
FuwuqiDrama keeps its configuration in the INI file data\package_con_x86.cat, which holds a port number and a bot identifier under a single section named Fuwuqi, the romanized Chinese term for server.
Source: Malpedia (Fraunhofer FKIE).