Trojan.MulDrop5.36903

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKLM>\SOFTWARE\Classes\VncViewer.Config\shell\open\command] '' = '"%PROGRAM_FILES%\UltraVNC\vncviewer.exe" -config "%1"'

Вредоносные функции:

Для обхода брандмауэра удаляет или модифицирует следующие ключи реестра:

[<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%PROGRAM_FILES%\UltraVNC\vncviewer.exe' = '%PROGRAM_FILES%\UltraVNC\vncviewer.exe:*:Enabled:vncviewer.exe'

Создает и запускает на исполнение:

'%TEMP%\is-LTRQK.tmp\UltraVNC_1.0.8.2_Setup.tmp' /SL5="$40092,1523807,346112,c:\ccs\ultravncviewer\UltraVNC_1.0.8.2_Setup.exe" /verysilent /loadinf="c:\ccs\ultravncviewer\UltraVNCViewerInstall.inf"
'C:\ccs\ultravncviewer\UltraVNC_1.0.8.2_Setup.exe' /verysilent /loadinf="c:\ccs\ultravncviewer\UltraVNCViewerInstall.inf"

Запускает на исполнение:

'<SYSTEM32>\netsh.exe' firewall add allowedprogram "%PROGRAM_FILES%\UltraVNC\vncviewer.exe" "vncviewer.exe" ENABLE ALL
'<SYSTEM32>\cmd.exe' /c ""c:\ccs\ultravncviewer\ultravncviewerinstall.bat" "

Изменения в файловой системе:

Создает следующие файлы:

%PROGRAM_FILES%\UltraVNC\is-BP3U3.tmp
%PROGRAM_FILES%\UltraVNC\is-3UF7R.tmp
%PROGRAM_FILES%\UltraVNC\is-6UA6S.tmp
%PROGRAM_FILES%\UltraVNC\is-B32NJ.tmp
%PROGRAM_FILES%\UltraVNC\is-DJR51.tmp
%PROGRAM_FILES%\UltraVNC\is-U9IBH.tmp
%PROGRAM_FILES%\UltraVNC\is-0I4UB.tmp
%PROGRAM_FILES%\UltraVNC\is-TD599.tmp
%PROGRAM_FILES%\UltraVNC\unins000.dat
%PROGRAM_FILES%\UltraVNC\cad.exe
%PROGRAM_FILES%\UltraVNC\SCHook.dll
%ALLUSERSPROFILE%\Start Menu\Programs\UltraVNC\UltraVNC Viewer\Show UltraVNC Viewer Help.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\UltraVNC\UltraVNC Viewer.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\UltraVNC\UltraVNC Viewer\Run UltraVNC Viewer (Listen Mode).lnk
%ALLUSERSPROFILE%\Start Menu\Programs\UltraVNC\UltraVNC Viewer\Run UltraVNC Viewer (Listen Mode Encrypt)).lnk
%PROGRAM_FILES%\UltraVNC\is-765FV.tmp
C:\ccs\ultravncviewer\cad.exe
C:\ccs\ultravncviewer\UltraVNC_1.0.8.2_Setup.exe
C:\ccs\ultravncviewer\SCHook.dll
C:\ccs\ultravncviewer\UltraVNCViewerInstall.inf
C:\ccs\ultravncviewer\y.txt
C:\ccs\ultravncviewer\ultravnc.ini
C:\ccs\ultravncviewer\UltraVNCViewerInstall.bat
%TEMP%\is-LTRQK.tmp\UltraVNC_1.0.8.2_Setup.tmp
%PROGRAM_FILES%\UltraVNC\is-BUPUJ.tmp
%PROGRAM_FILES%\UltraVNC\is-BKVSE.tmp
%PROGRAM_FILES%\UltraVNC\is-43A7Q.tmp
%TEMP%\is-UVNLM.tmp\UltraVNC.ico
%TEMP%\is-UVNLM.tmp\_isetup\_RegDLL.tmp
%TEMP%\is-UVNLM.tmp\_isetup\_shfoldr.dll
%TEMP%\is-UVNLM.tmp\isxdl.dll

Удаляет следующие файлы:

Перемещает следующие файлы:

%PROGRAM_FILES%\UltraVNC\is-BP3U3.tmp в %PROGRAM_FILES%\UltraVNC\Readme_dsm.txt
%PROGRAM_FILES%\UltraVNC\is-B32NJ.tmp в %PROGRAM_FILES%\UltraVNC\Licence.txt
%PROGRAM_FILES%\UltraVNC\is-0I4UB.tmp в %PROGRAM_FILES%\UltraVNC\Whatsnew.txt
%PROGRAM_FILES%\UltraVNC\is-TD599.tmp в %PROGRAM_FILES%\UltraVNC\uvnc_settings.exe
%PROGRAM_FILES%\UltraVNC\is-6UA6S.tmp в %PROGRAM_FILES%\UltraVNC\SecureVNCPluginARC4.dsm
%PROGRAM_FILES%\UltraVNC\is-3UF7R.tmp в %PROGRAM_FILES%\UltraVNC\SecureVNCPlugin.dsm
%PROGRAM_FILES%\UltraVNC\is-43A7Q.tmp в %PROGRAM_FILES%\UltraVNC\Licence.txt
%PROGRAM_FILES%\UltraVNC\is-BKVSE.tmp в %PROGRAM_FILES%\UltraVNC\Whatsnew.txt
%PROGRAM_FILES%\UltraVNC\is-BUPUJ.tmp в %PROGRAM_FILES%\UltraVNC\unins000.exe
%PROGRAM_FILES%\UltraVNC\is-U9IBH.tmp в %PROGRAM_FILES%\UltraVNC\MSRC4Plugin.dsm
%PROGRAM_FILES%\UltraVNC\is-DJR51.tmp в %PROGRAM_FILES%\UltraVNC\vncviewer.exe
%PROGRAM_FILES%\UltraVNC\is-765FV.tmp в %PROGRAM_FILES%\UltraVNC\Readme.txt