Trojan.MulDrop8.24575

Техническая информация

Вредоносные функции:

Для обхода брандмауэра удаляет или модифицирует следующие ключи реестра:

[<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%ProgramFiles%\uvnc bvba\UltraVNC\winvnc.exe' = '%ProgramFiles%\uvnc b...

Запускает на исполнение:

'<SYSTEM32>\netsh.exe' firewall add portopening TCP 5900 vnc5900
'<SYSTEM32>\netsh.exe' firewall add portopening TCP 5800 vnc5800
'<SYSTEM32>\netsh.exe' firewall add allowedprogram "%ProgramFiles%\uvnc bvba\UltraVNC\winvnc.exe" "winvnc.exe" ENABLE ALL

Изменения в файловой системе:

Создает следующие файлы:

<Текущая директория>\uvncx86.exe
%ProgramFiles%\uvnc bvba\UltraVNC\is-6QQMU.tmp
%ProgramFiles%\uvnc bvba\UltraVNC\is-6ERRJ.tmp
%ProgramFiles%\uvnc bvba\UltraVNC\is-5UUV5.tmp
%ProgramFiles%\uvnc bvba\UltraVNC\is-NV9E5.tmp
%ProgramFiles%\uvnc bvba\UltraVNC\is-4LCBF.tmp
%ProgramFiles%\uvnc bvba\UltraVNC\is-64BP7.tmp
%ProgramFiles%\uvnc bvba\UltraVNC\is-NL567.tmp
%ProgramFiles%\uvnc bvba\UltraVNC\is-5KHI0.tmp
%ProgramFiles%\uvnc bvba\UltraVNC\unins000.dat
%ALLUSERSPROFILE%\Start Menu\Programs\UltraVNC\UltraVNC Viewer.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\UltraVNC\UltraVNC Server.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\UltraVNC\UltraVNC Repeater.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\UltraVNC\UltraVNC Viewer\Run UltraVNC Viewer (Listen Mode).lnk
%ALLUSERSPROFILE%\Start Menu\Programs\UltraVNC\UltraVNC Viewer\Run UltraVNC Viewer (Listen Mode Encrypt)).lnk
%ALLUSERSPROFILE%\Start Menu\Programs\UltraVNC\Edit Settings.lnk
%ProgramFiles%\uvnc bvba\UltraVNC\unins000.msg
%ProgramFiles%\uvnc bvba\UltraVNC\is-5SOP2.tmp
%ProgramFiles%\uvnc bvba\UltraVNC\is-AMPGF.tmp
%ProgramFiles%\uvnc bvba\UltraVNC\is-G3HAN.tmp
%ProgramFiles%\uvnc bvba\UltraVNC\is-V4T1F.tmp
%TEMP%\is-PR71C.tmp\uvncx86.tmp
%TEMP%\is-4504E.tmp\isskin.dll
%TEMP%\is-4504E.tmp\Vista.cjstyles
%ProgramFiles%\uvnc bvba\UltraVNC\is-U6TTL.tmp
%ProgramFiles%\uvnc bvba\UltraVNC\is-3VS20.tmp
%ProgramFiles%\uvnc bvba\UltraVNC\is-5N8MU.tmp
%ProgramFiles%\uvnc bvba\UltraVNC\is-FOTRQ.tmp
%ProgramFiles%\uvnc bvba\UltraVNC\is-K8BVV.tmp
%ProgramFiles%\uvnc bvba\UltraVNC\is-2RJEM.tmp
%ProgramFiles%\uvnc bvba\UltraVNC\is-09U3N.tmp
%ProgramFiles%\uvnc bvba\UltraVNC\is-FM5EQ.tmp
%ProgramFiles%\uvnc bvba\UltraVNC\is-59HVE.tmp
%ProgramFiles%\uvnc bvba\UltraVNC\is-HQVGU.tmp
%ProgramFiles%\uvnc bvba\UltraVNC\is-4ALVJ.tmp
%ProgramFiles%\uvnc bvba\UltraVNC\is-1JBT6.tmp
%ProgramFiles%\uvnc bvba\UltraVNC\is-LTTMD.tmp
%ProgramFiles%\uvnc bvba\UltraVNC\is-2UOBA.tmp
%ProgramFiles%\uvnc bvba\UltraVNC\ultravnc.ini

Удаляет следующие файлы:

%ProgramFiles%\uvnc bvba\UltraVNC\vncviewer.exe
%ProgramFiles%\uvnc bvba\UltraVNC\UVNC_Launch.exe
%ProgramFiles%\uvnc bvba\UltraVNC\setpasswd.exe

Перемещает следующие файлы:

%ProgramFiles%\uvnc bvba\UltraVNC\is-U6TTL.tmp в %ProgramFiles%\uvnc bvba\UltraVNC\unins000.exe
%ProgramFiles%\uvnc bvba\UltraVNC\is-NV9E5.tmp в %ProgramFiles%\uvnc bvba\UltraVNC\uvnc_settings.exe
%ProgramFiles%\uvnc bvba\UltraVNC\is-5UUV5.tmp в %ProgramFiles%\uvnc bvba\UltraVNC\setpasswd.exe
%ProgramFiles%\uvnc bvba\UltraVNC\is-6ERRJ.tmp в %ProgramFiles%\uvnc bvba\UltraVNC\setcad.exe
%ProgramFiles%\uvnc bvba\UltraVNC\is-6QQMU.tmp в %ProgramFiles%\uvnc bvba\UltraVNC\UVNC_Launch.exe
%ProgramFiles%\uvnc bvba\UltraVNC\is-5SOP2.tmp в %ProgramFiles%\uvnc bvba\UltraVNC\vncviewer.exe
%ProgramFiles%\uvnc bvba\UltraVNC\is-G3HAN.tmp в %ProgramFiles%\uvnc bvba\UltraVNC\MSLogonACL.exe
%ProgramFiles%\uvnc bvba\UltraVNC\is-2UOBA.tmp в %ProgramFiles%\uvnc bvba\UltraVNC\authSSP.dll
%ProgramFiles%\uvnc bvba\UltraVNC\is-2RJEM.tmp в %ProgramFiles%\uvnc bvba\UltraVNC\ldapauth9x.dll
%ProgramFiles%\uvnc bvba\UltraVNC\is-LTTMD.tmp в %ProgramFiles%\uvnc bvba\UltraVNC\ldapauthnt4.dll
%ProgramFiles%\uvnc bvba\UltraVNC\is-4LCBF.tmp в %ProgramFiles%\uvnc bvba\UltraVNC\testauth.exe
%ProgramFiles%\uvnc bvba\UltraVNC\is-1JBT6.tmp в %ProgramFiles%\uvnc bvba\UltraVNC\ldapauth.dll
%ProgramFiles%\uvnc bvba\UltraVNC\is-HQVGU.tmp в %ProgramFiles%\uvnc bvba\UltraVNC\authadmin.dll
%ProgramFiles%\uvnc bvba\UltraVNC\is-59HVE.tmp в %ProgramFiles%\uvnc bvba\UltraVNC\logmessages.dll
%ProgramFiles%\uvnc bvba\UltraVNC\is-FM5EQ.tmp в %ProgramFiles%\uvnc bvba\UltraVNC\logging.dll
%ProgramFiles%\uvnc bvba\UltraVNC\is-09U3N.tmp в %ProgramFiles%\uvnc bvba\UltraVNC\vnchooks.dll
%ProgramFiles%\uvnc bvba\UltraVNC\is-K8BVV.tmp в %ProgramFiles%\uvnc bvba\UltraVNC\winvnc.exe
%ProgramFiles%\uvnc bvba\UltraVNC\is-V4T1F.tmp в %ProgramFiles%\uvnc bvba\UltraVNC\repeater.exe
%ProgramFiles%\uvnc bvba\UltraVNC\is-FOTRQ.tmp в %ProgramFiles%\uvnc bvba\UltraVNC\Readme.txt
%ProgramFiles%\uvnc bvba\UltraVNC\is-5N8MU.tmp в %ProgramFiles%\uvnc bvba\UltraVNC\Licence.rtf
%ProgramFiles%\uvnc bvba\UltraVNC\is-3VS20.tmp в %ProgramFiles%\uvnc bvba\UltraVNC\Whatsnew.rtf
%ProgramFiles%\uvnc bvba\UltraVNC\is-4ALVJ.tmp в %ProgramFiles%\uvnc bvba\UltraVNC\workgrpdomnt4.dll
%ProgramFiles%\uvnc bvba\UltraVNC\is-64BP7.tmp в %ProgramFiles%\uvnc bvba\UltraVNC\ultravnc.ini

Подменяет следующие файлы:

%ProgramFiles%\uvnc bvba\UltraVNC\vncviewer.exe
%ProgramFiles%\uvnc bvba\UltraVNC\UVNC_Launch.exe
%ProgramFiles%\uvnc bvba\UltraVNC\setpasswd.exe

Другое:

Создает и запускает на исполнение:

'<Текущая директория>\uvncx86.exe' /verysilent /noicon /loadinf=uvncinstall.inf /NORESTART
'%TEMP%\is-PR71C.tmp\uvncx86.tmp' /SL5="$100E4,2611488,350720,<Текущая директория>\uvncx86.exe" /verysilent /noicon /loadinf=uvncinstall.inf /NORESTART
'%ProgramFiles%\uvnc bvba\UltraVNC\setpasswd.exe'
'%ProgramFiles%\uvnc bvba\UltraVNC\setcad.exe'