Trojan.DownLoader10.50908

Техническая информация

Для обеспечения автозапуска и распространения:

Создает следующие сервисы:

[<HKLM>\SYSTEM\ControlSet001\Services\uvnc_service] 'Start' = '00000002'

Вредоносные функции:

Для обхода брандмауэра удаляет или модифицирует следующие ключи реестра:

[<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%PROGRAM_FILES%\UltraVNC\winvnc.exe' = '%PROGRAM_FILES%\UltraVNC\winvnc.exe:*:Enabled:winvnc.exe'

Создает и запускает на исполнение:

'%PROGRAM_FILES%\UltraVNC\winvnc.exe' -install
'%PROGRAM_FILES%\UltraVNC\winvnc.exe' -service
'%PROGRAM_FILES%\UltraVNC\winvnc.exe' -service_run
'%TEMP%\1.tmp\UltraVNCSetup.exe' /silent /loadinf=install.inf
'%TEMP%\is-S3MET.tmp\UltraVNCSetup.tmp' /SL5="$40036,1523807,346112,%TEMP%\1.tmp\UltraVNCSetup.exe" /silent /loadinf=install.inf
'%TEMP%\is-QIF6V.tmp\check_install.exe' silent

Запускает на исполнение:

'<SYSTEM32>\net.exe' stop "uvnc_service"
'<SYSTEM32>\netsh.exe' firewall add allowedprogram "%PROGRAM_FILES%\UltraVNC\winvnc.exe" "winvnc.exe" ENABLE ALL
'<SYSTEM32>\cmd.exe' /c ""%TEMP%\selfdel0.bat" "
'<SYSTEM32>\net1.exe' stop "uvnc_service"
'<SYSTEM32>\net1.exe' start "uvnc_service"
'<SYSTEM32>\cmd.exe' /c ""%TEMP%\1.tmp\batfile.bat" "
'<SYSTEM32>\netsh.exe' firewall add portopening TCP 5800 vnc5800
'<SYSTEM32>\netsh.exe' firewall add portopening TCP 5900 vnc5900

Изменения в файловой системе:

Создает следующие файлы:

%PROGRAM_FILES%\UltraVNC\is-ELA9O.tmp
%PROGRAM_FILES%\UltraVNC\is-SDR0G.tmp
%PROGRAM_FILES%\UltraVNC\is-BAFT8.tmp
%PROGRAM_FILES%\UltraVNC\is-7U06J.tmp
%PROGRAM_FILES%\UltraVNC\is-KGHOU.tmp
%PROGRAM_FILES%\UltraVNC\is-V0VK8.tmp
%PROGRAM_FILES%\UltraVNC\is-MP7EF.tmp
%PROGRAM_FILES%\UltraVNC\is-3V69G.tmp
%PROGRAM_FILES%\UltraVNC\is-LM2SA.tmp
%PROGRAM_FILES%\UltraVNC\is-HBKCU.tmp
%ALLUSERSPROFILE%\Start Menu\Programs\UltraVNC\Edit Settings.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\UltraVNC\UltraVNC Server\Stop WinVNC Service.lnk
%PROGRAM_FILES%\UltraVNC\unins000.dat
%TEMP%\selfdel0.bat
%PROGRAM_FILES%\UltraVNC\ultravnc.ini
%ALLUSERSPROFILE%\Start Menu\Programs\UltraVNC\UltraVNC Server.lnk
%PROGRAM_FILES%\UltraVNC\is-0O9R5.tmp
%ALLUSERSPROFILE%\Start Menu\Programs\UltraVNC\UltraVNC Server\Install WinVNC Service.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\UltraVNC\UltraVNC Server\Start WinVNC Service.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\UltraVNC\UltraVNC Server\Remove WinVNC Service.lnk
%TEMP%\is-QIF6V.tmp\_isetup\_shfoldr.dll
%TEMP%\is-QIF6V.tmp\_isetup\_RegDLL.tmp
%TEMP%\is-QIF6V.tmp\isxdl.dll
%PROGRAM_FILES%\UltraVNC\is-NBHU2.tmp
%TEMP%\is-QIF6V.tmp\UltraVNC.ico
%TEMP%\1.tmp\install.inf
%TEMP%\1.tmp\batfile.bat
%TEMP%\1.tmp\ultravnc.ini
%TEMP%\is-S3MET.tmp\UltraVNCSetup.tmp
%TEMP%\1.tmp\UltraVNCSetup.exe
%PROGRAM_FILES%\UltraVNC\is-12RLK.tmp
%PROGRAM_FILES%\UltraVNC\is-S3H6C.tmp
%PROGRAM_FILES%\UltraVNC\is-4I313.tmp
%PROGRAM_FILES%\UltraVNC\is-UDJFI.tmp
%PROGRAM_FILES%\UltraVNC\is-H2EMK.tmp
%PROGRAM_FILES%\UltraVNC\is-7936M.tmp
%TEMP%\is-QIF6V.tmp\check_install.exe
%PROGRAM_FILES%\UltraVNC\is-3QJS2.tmp
%PROGRAM_FILES%\UltraVNC\is-KKFHC.tmp
%PROGRAM_FILES%\UltraVNC\is-RPIQ8.tmp

Удаляет следующие файлы:

%TEMP%\1.tmp\batfile.bat
%TEMP%\is-S3MET.tmp\UltraVNCSetup.tmp
%TEMP%\is-QIF6V.tmp\_isetup\_shfoldr.dll
%TEMP%\1.tmp\UltraVNCSetup.exe
%TEMP%\1.tmp\ultravnc.ini
%TEMP%\1.tmp\install.inf
%TEMP%\is-QIF6V.tmp\check_install.exe
%PROGRAM_FILES%\UltraVNC\Licence.txt
%PROGRAM_FILES%\UltraVNC\Whatsnew.txt
%TEMP%\is-QIF6V.tmp\_isetup\_RegDLL.tmp
%TEMP%\is-QIF6V.tmp\UltraVNC.ico
%TEMP%\is-QIF6V.tmp\isxdl.dll

Перемещает следующие файлы:

%PROGRAM_FILES%\UltraVNC\is-LM2SA.tmp в %PROGRAM_FILES%\UltraVNC\MSRC4Plugin.dsm
%PROGRAM_FILES%\UltraVNC\is-SDR0G.tmp в %PROGRAM_FILES%\UltraVNC\Whatsnew.txt
%PROGRAM_FILES%\UltraVNC\is-HBKCU.tmp в %PROGRAM_FILES%\UltraVNC\MSLogonACL.exe
%PROGRAM_FILES%\UltraVNC\is-V0VK8.tmp в %PROGRAM_FILES%\UltraVNC\ldapauth.dll
%PROGRAM_FILES%\UltraVNC\is-3V69G.tmp в %PROGRAM_FILES%\UltraVNC\authSSP.dll
%PROGRAM_FILES%\UltraVNC\is-7U06J.tmp в %PROGRAM_FILES%\UltraVNC\SecureVNCPluginARC4.dsm
%PROGRAM_FILES%\UltraVNC\is-0O9R5.tmp в %PROGRAM_FILES%\UltraVNC\uvnc_settings.exe
%PROGRAM_FILES%\UltraVNC\is-KGHOU.tmp в %PROGRAM_FILES%\UltraVNC\SecureVNCPlugin.dsm
%PROGRAM_FILES%\UltraVNC\is-ELA9O.tmp в %PROGRAM_FILES%\UltraVNC\Licence.txt
%PROGRAM_FILES%\UltraVNC\is-BAFT8.tmp в %PROGRAM_FILES%\UltraVNC\Readme_dsm.txt
%PROGRAM_FILES%\UltraVNC\is-MP7EF.tmp в %PROGRAM_FILES%\UltraVNC\workgrpdomnt4.dll
%PROGRAM_FILES%\UltraVNC\is-RPIQ8.tmp в %PROGRAM_FILES%\UltraVNC\Licence.txt
%PROGRAM_FILES%\UltraVNC\is-KKFHC.tmp в %PROGRAM_FILES%\UltraVNC\Readme.txt
%PROGRAM_FILES%\UltraVNC\is-3QJS2.tmp в %PROGRAM_FILES%\UltraVNC\Whatsnew.txt
%PROGRAM_FILES%\UltraVNC\is-NBHU2.tmp в %PROGRAM_FILES%\UltraVNC\unins000.exe
%PROGRAM_FILES%\UltraVNC\is-7936M.tmp в %PROGRAM_FILES%\UltraVNC\check_install.exe
%PROGRAM_FILES%\UltraVNC\is-H2EMK.tmp в %PROGRAM_FILES%\UltraVNC\logging.dll
%PROGRAM_FILES%\UltraVNC\is-UDJFI.tmp в %PROGRAM_FILES%\UltraVNC\authadmin.dll
%PROGRAM_FILES%\UltraVNC\is-4I313.tmp в %PROGRAM_FILES%\UltraVNC\vnchooks.dll
%PROGRAM_FILES%\UltraVNC\is-S3H6C.tmp в %PROGRAM_FILES%\UltraVNC\winvnc.exe
%PROGRAM_FILES%\UltraVNC\is-12RLK.tmp в %PROGRAM_FILES%\UltraVNC\logmessages.dll