Trojan.DownLoader8.33825

Техническая информация

Для обеспечения автозапуска и распространения:

Создает следующие сервисы:

[<HKLM>\SYSTEM\ControlSet001\Services\uvnc_service] 'Start' = '00000002'

Вредоносные функции:

Для обхода брандмауэра удаляет или модифицирует следующие ключи реестра:

[<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%PROGRAM_FILES%\UltraVnc\winvnc.exe' = '%PROGRAM_FILES%\UltraVnc\winvnc.exe:*:Enabled:winvnc.exe'

Создает и запускает на исполнение:

%PROGRAM_FILES%\UltraVnc\winvnc.exe -install
%PROGRAM_FILES%\UltraVnc\winvnc.exe -service
%PROGRAM_FILES%\UltraVnc\winvnc.exe -service_run
%TEMP%\7zS1.tmp\UltraVNC_1.0.9.6.1_Setup.exe /dir="%PROGRAM_FILES%\UltraVnc\" /norestart /verysilent /loadinf="conf.inf"
%TEMP%\is-35ET3.tmp\UltraVNC_1.0.9.6.1_Setup.tmp /SL5="$300DC,1931452,346624,%TEMP%\7zS1.tmp\UltraVNC_1.0.9.6.1_Setup.exe" /dir="%PROGRAM_FILES%\UltraVnc\" /norestart /verysilent /loadinf="conf.inf"
%TEMP%\is-OQDIO.tmp\check_install.exe silent

Запускает на исполнение:

<SYSTEM32>\netsh.exe firewall add portopening TCP 5900 vnc5900
<SYSTEM32>\netsh.exe firewall add portopening TCP 5800 vnc5800
<SYSTEM32>\netsh.exe firewall add allowedprogram "%PROGRAM_FILES%\UltraVnc\winvnc.exe" "winvnc.exe" ENABLE ALL
<SYSTEM32>\cmd.exe /c .\install.bat
<SYSTEM32>\net1.exe start "uvnc_service"
<SYSTEM32>\net1.exe start uvnc_service

Изменения в файловой системе:

Создает следующие файлы:

%PROGRAM_FILES%\UltraVnc\is-JL496.tmp
%PROGRAM_FILES%\UltraVnc\is-OQG9R.tmp
%PROGRAM_FILES%\UltraVnc\is-07BG8.tmp
%PROGRAM_FILES%\UltraVnc\is-3KNE5.tmp
%PROGRAM_FILES%\UltraVnc\is-NM1EF.tmp
%PROGRAM_FILES%\UltraVnc\is-TII2N.tmp
%PROGRAM_FILES%\UltraVnc\is-HKQLR.tmp
%PROGRAM_FILES%\UltraVnc\is-2DELF.tmp
%ALLUSERSPROFILE%\Start Menu\Programs\UltraVNC\UltraVNC Server.lnk
%PROGRAM_FILES%\UltraVnc\unins000.msg
%ALLUSERSPROFILE%\Start Menu\Programs\UltraVNC\Edit Settings.lnk
%PROGRAM_FILES%\UltraVnc\ultravnc.ini
%PROGRAM_FILES%\UltraVnc\unins000.dat
%ALLUSERSPROFILE%\Start Menu\Programs\UltraVNC\UltraVNC Server\Remove WinVNC Service.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\UltraVNC\UltraVNC Server\Install WinVNC Service.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\UltraVNC\UltraVNC Server\Stop WinVNC Service.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\UltraVNC\UltraVNC Server\Start WinVNC Service.lnk
%PROGRAM_FILES%\UltraVnc\is-1IEMJ.tmp
%TEMP%\is-OQDIO.tmp\_isetup\_RegDLL.tmp
%TEMP%\is-35ET3.tmp\UltraVNC_1.0.9.6.1_Setup.tmp
%TEMP%\is-OQDIO.tmp\isxdl.dll
%TEMP%\is-OQDIO.tmp\_isetup\_shfoldr.dll
%TEMP%\7zS1.tmp\ultravnc.ini
%TEMP%\7zS1.tmp\install.bat
%TEMP%\7zS1.tmp\UltraVNC_1.0.9.6.1_Setup.exe
%TEMP%\7zS1.tmp\conf.inf
%TEMP%\is-OQDIO.tmp\UltraVNC.ico
%PROGRAM_FILES%\UltraVnc\is-9R4DQ.tmp
%PROGRAM_FILES%\UltraVnc\is-S8CNQ.tmp
%PROGRAM_FILES%\UltraVnc\is-CEP5E.tmp
%PROGRAM_FILES%\UltraVnc\is-8C9V2.tmp
%TEMP%\is-OQDIO.tmp\check_install.exe
%PROGRAM_FILES%\UltraVnc\is-N8B9F.tmp
%PROGRAM_FILES%\UltraVnc\is-8E9I9.tmp
%PROGRAM_FILES%\UltraVnc\is-C2PI7.tmp

Удаляет следующие файлы:

%TEMP%\7zS1.tmp\conf.inf
%TEMP%\is-35ET3.tmp\UltraVNC_1.0.9.6.1_Setup.tmp
%TEMP%\7zS1.tmp\install.bat
%TEMP%\7zS1.tmp\UltraVNC_1.0.9.6.1_Setup.exe
%TEMP%\7zS1.tmp\ultravnc.ini
%TEMP%\is-OQDIO.tmp\isxdl.dll
%TEMP%\is-OQDIO.tmp\check_install.exe
%TEMP%\is-OQDIO.tmp\UltraVNC.ico
%TEMP%\is-OQDIO.tmp\_isetup\_shfoldr.dll
%TEMP%\is-OQDIO.tmp\_isetup\_RegDLL.tmp

Перемещает следующие файлы:

%PROGRAM_FILES%\UltraVnc\is-2DELF.tmp в %PROGRAM_FILES%\UltraVnc\workgrpdomnt4.dll
%PROGRAM_FILES%\UltraVnc\is-HKQLR.tmp в %PROGRAM_FILES%\UltraVnc\ldapauth.dll
%PROGRAM_FILES%\UltraVnc\is-TII2N.tmp в %PROGRAM_FILES%\UltraVnc\logging.dll
%PROGRAM_FILES%\UltraVnc\is-NM1EF.tmp в %PROGRAM_FILES%\UltraVnc\authadmin.dll
%PROGRAM_FILES%\UltraVnc\is-3KNE5.tmp в %PROGRAM_FILES%\UltraVnc\SecureVNCPlugin.dsm
%PROGRAM_FILES%\UltraVnc\is-07BG8.tmp в %PROGRAM_FILES%\UltraVnc\uvnc_settings.exe
%PROGRAM_FILES%\UltraVnc\is-OQG9R.tmp в %PROGRAM_FILES%\UltraVnc\authSSP.dll
%PROGRAM_FILES%\UltraVnc\is-JL496.tmp в %PROGRAM_FILES%\UltraVnc\MSLogonACL.exe
%PROGRAM_FILES%\UltraVnc\is-8E9I9.tmp в %PROGRAM_FILES%\UltraVnc\Whatsnew.txt
%PROGRAM_FILES%\UltraVnc\is-S8CNQ.tmp в %PROGRAM_FILES%\UltraVnc\Licence.txt
%PROGRAM_FILES%\UltraVnc\is-N8B9F.tmp в %PROGRAM_FILES%\UltraVnc\unins000.exe
%PROGRAM_FILES%\UltraVnc\is-C2PI7.tmp в %PROGRAM_FILES%\UltraVnc\check_install.exe
%PROGRAM_FILES%\UltraVnc\is-CEP5E.tmp в %PROGRAM_FILES%\UltraVnc\logmessages.dll
%PROGRAM_FILES%\UltraVnc\is-1IEMJ.tmp в %PROGRAM_FILES%\UltraVnc\vnchooks.dll
%PROGRAM_FILES%\UltraVnc\is-9R4DQ.tmp в %PROGRAM_FILES%\UltraVnc\Readme.txt
%PROGRAM_FILES%\UltraVnc\is-8C9V2.tmp в %PROGRAM_FILES%\UltraVnc\winvnc.exe