Trojan.DownLoader26.55754

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKLM>\SOFTWARE\Classes\VncViewer.Config\shell\open\command] '' = '"%ProgramFiles% (x86)\uvnc bvba\UltraVNC\vncviewer.exe" -config "%1"'

Создает следующие сервисы:

[<HKLM>\SYSTEM\ControlSet001\Services\uvnc_service] 'Start' = '00000002'
[<HKLM>\SYSTEM\ControlSet001\Services\uvnc_service] 'ImagePath' = '"%ProgramFiles% (x86)\uvnc bvba\UltraVNC\WinVNC.exe" -service'

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nsz2.tmp\UAC.dll
%ProgramFiles% (x86)\uvnc bvba\UltraVNC\is-00I3K.tmp
%ProgramFiles% (x86)\uvnc bvba\UltraVNC\is-CD919.tmp
%ProgramFiles% (x86)\uvnc bvba\UltraVNC\is-EE1QP.tmp
%ProgramFiles% (x86)\uvnc bvba\UltraVNC\is-C54KK.tmp
%ProgramFiles% (x86)\uvnc bvba\UltraVNC\is-7QSP2.tmp
%ProgramFiles% (x86)\uvnc bvba\UltraVNC\is-MUFVI.tmp
%ProgramFiles% (x86)\uvnc bvba\UltraVNC\is-8QSH6.tmp
%ProgramFiles% (x86)\uvnc bvba\UltraVNC\is-JM1VK.tmp
%ProgramFiles% (x86)\uvnc bvba\UltraVNC\is-1U6N3.tmp
%ProgramFiles% (x86)\uvnc bvba\UltraVNC\is-DVLON.tmp
%ALLUSERSPROFILE%\Start Menu\Programs\UltraVNC\UltraVNC Viewer.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\UltraVNC\UltraVNC Server.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\UltraVNC\UltraVNC Repeater.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\UltraVNC\UltraVNC Viewer\Run UltraVNC Viewer (Listen Mode).lnk
%ALLUSERSPROFILE%\Start Menu\Programs\UltraVNC\UltraVNC Viewer\Run UltraVNC Viewer (Listen Mode Encrypt)).lnk
%ALLUSERSPROFILE%\Start Menu\Programs\UltraVNC\Edit Settings.lnk
%ProgramFiles% (x86)\uvnc bvba\UltraVNC\unins000.msg
%ProgramFiles% (x86)\uvnc bvba\UltraVNC\is-SNQ84.tmp
%ProgramFiles% (x86)\uvnc bvba\UltraVNC\unins000.dat
%ProgramFiles% (x86)\uvnc bvba\UltraVNC\is-SI9K3.tmp
%ProgramFiles% (x86)\uvnc bvba\UltraVNC\is-0S220.tmp
%TEMP%\nsz2.tmp\sib.dat
%TEMP%\nsz2.tmp\UltraVNC_1_2_12_X86_Setup\UltraVNC_1_2_12_X86_Setup.exe
%TEMP%\nsz2.tmp\UltraVNC_1_2_12_X86_Setup\VNCinstall.inf
%TEMP%\nsz2.tmp\NActions.dll
%TEMP%\is-2RNLJ.tmp\UltraVNC_1_2_12_X86_Setup.tmp
%TEMP%\is-2C5M2.tmp\isskin.dll
%TEMP%\is-2C5M2.tmp\Vista.cjstyles
%ProgramFiles% (x86)\uvnc bvba\UltraVNC\is-A8E6N.tmp
%ProgramFiles% (x86)\uvnc bvba\UltraVNC\is-UCK48.tmp
%ProgramFiles% (x86)\uvnc bvba\UltraVNC\is-C62B7.tmp
%ProgramFiles% (x86)\uvnc bvba\UltraVNC\is-MN4E9.tmp
%ProgramFiles% (x86)\uvnc bvba\UltraVNC\is-6DTUQ.tmp
%ProgramFiles% (x86)\uvnc bvba\UltraVNC\is-0GGNM.tmp
%ProgramFiles% (x86)\uvnc bvba\UltraVNC\is-PUMJE.tmp
%ProgramFiles% (x86)\uvnc bvba\UltraVNC\is-7J3QC.tmp
%ProgramFiles% (x86)\uvnc bvba\UltraVNC\is-40TAB.tmp
%ProgramFiles% (x86)\uvnc bvba\UltraVNC\is-41PSD.tmp
%ProgramFiles% (x86)\uvnc bvba\UltraVNC\is-OVHM4.tmp
%ProgramFiles% (x86)\uvnc bvba\UltraVNC\ultravnc.ini

Удаляет следующие файлы:

%ProgramFiles% (x86)\uvnc bvba\UltraVNC\setpasswd.exe

Перемещает следующие файлы:

%ProgramFiles% (x86)\uvnc bvba\UltraVNC\is-A8E6N.tmp в %ProgramFiles% (x86)\uvnc bvba\UltraVNC\unins000.exe
%ProgramFiles% (x86)\uvnc bvba\UltraVNC\is-8QSH6.tmp в %ProgramFiles% (x86)\uvnc bvba\UltraVNC\uvnc_settings.exe
%ProgramFiles% (x86)\uvnc bvba\UltraVNC\is-MUFVI.tmp в %ProgramFiles% (x86)\uvnc bvba\UltraVNC\setpasswd.exe
%ProgramFiles% (x86)\uvnc bvba\UltraVNC\is-7QSP2.tmp в %ProgramFiles% (x86)\uvnc bvba\UltraVNC\setcad.exe
%ProgramFiles% (x86)\uvnc bvba\UltraVNC\is-C54KK.tmp в %ProgramFiles% (x86)\uvnc bvba\UltraVNC\UVNC_Launch.exe
%ProgramFiles% (x86)\uvnc bvba\UltraVNC\is-EE1QP.tmp в %ProgramFiles% (x86)\uvnc bvba\UltraVNC\vncviewer.exe
%ProgramFiles% (x86)\uvnc bvba\UltraVNC\is-CD919.tmp в %ProgramFiles% (x86)\uvnc bvba\UltraVNC\MSLogonACL.exe
%ProgramFiles% (x86)\uvnc bvba\UltraVNC\is-00I3K.tmp в %ProgramFiles% (x86)\uvnc bvba\UltraVNC\authSSP.dll
%ProgramFiles% (x86)\uvnc bvba\UltraVNC\is-SNQ84.tmp в %ProgramFiles% (x86)\uvnc bvba\UltraVNC\ldapauth9x.dll
%ProgramFiles% (x86)\uvnc bvba\UltraVNC\is-SI9K3.tmp в %ProgramFiles% (x86)\uvnc bvba\UltraVNC\ldapauthnt4.dll
%ProgramFiles% (x86)\uvnc bvba\UltraVNC\is-JM1VK.tmp в %ProgramFiles% (x86)\uvnc bvba\UltraVNC\testauth.exe
%ProgramFiles% (x86)\uvnc bvba\UltraVNC\is-OVHM4.tmp в %ProgramFiles% (x86)\uvnc bvba\UltraVNC\ldapauth.dll
%ProgramFiles% (x86)\uvnc bvba\UltraVNC\is-41PSD.tmp в %ProgramFiles% (x86)\uvnc bvba\UltraVNC\authadmin.dll
%ProgramFiles% (x86)\uvnc bvba\UltraVNC\is-40TAB.tmp в %ProgramFiles% (x86)\uvnc bvba\UltraVNC\logmessages.dll
%ProgramFiles% (x86)\uvnc bvba\UltraVNC\is-7J3QC.tmp в %ProgramFiles% (x86)\uvnc bvba\UltraVNC\logging.dll
%ProgramFiles% (x86)\uvnc bvba\UltraVNC\is-PUMJE.tmp в %ProgramFiles% (x86)\uvnc bvba\UltraVNC\vnchooks.dll
%ProgramFiles% (x86)\uvnc bvba\UltraVNC\is-0GGNM.tmp в %ProgramFiles% (x86)\uvnc bvba\UltraVNC\winvnc.exe
%ProgramFiles% (x86)\uvnc bvba\UltraVNC\is-6DTUQ.tmp в %ProgramFiles% (x86)\uvnc bvba\UltraVNC\repeater.exe
%ProgramFiles% (x86)\uvnc bvba\UltraVNC\is-MN4E9.tmp в %ProgramFiles% (x86)\uvnc bvba\UltraVNC\Readme.txt
%ProgramFiles% (x86)\uvnc bvba\UltraVNC\is-C62B7.tmp в %ProgramFiles% (x86)\uvnc bvba\UltraVNC\Licence.rtf
%ProgramFiles% (x86)\uvnc bvba\UltraVNC\is-UCK48.tmp в %ProgramFiles% (x86)\uvnc bvba\UltraVNC\Whatsnew.rtf
%ProgramFiles% (x86)\uvnc bvba\UltraVNC\is-0S220.tmp в %ProgramFiles% (x86)\uvnc bvba\UltraVNC\workgrpdomnt4.dll
%ProgramFiles% (x86)\uvnc bvba\UltraVNC\is-1U6N3.tmp в %ProgramFiles% (x86)\uvnc bvba\UltraVNC\ultravnc.ini

Подменяет следующие файлы:

%ProgramFiles% (x86)\uvnc bvba\UltraVNC\setpasswd.exe

Сетевая активность:

Подключается к:

'localhost':5900

Другое:

Создает и запускает на исполнение:

'%TEMP%\nsz2.tmp\UltraVNC_1_2_12_X86_Setup\UltraVNC_1_2_12_X86_Setup.exe' /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /LOADINF="VNCinstall.inf"
'%TEMP%\is-2RNLJ.tmp\UltraVNC_1_2_12_X86_Setup.tmp' /SL5="$300DE,2923350,350720,%TEMP%\nsz2.tmp\UltraVNC_1_2_12_X86_Setup\UltraVNC_1_2_12_X86_Setup.exe" /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /LOADINF="VNCinstall.inf"
'%ProgramFiles% (x86)\uvnc bvba\UltraVNC\setpasswd.exe'
'%ProgramFiles% (x86)\uvnc bvba\UltraVNC\setcad.exe'
'%ProgramFiles% (x86)\uvnc bvba\UltraVNC\winvnc.exe' -install
'%ProgramFiles% (x86)\uvnc bvba\UltraVNC\winvnc.exe' -service
'%ProgramFiles% (x86)\uvnc bvba\UltraVNC\winvnc.exe' -service_run

Запускает на исполнение: