Техническая информация
Для обеспечения автозапуска и распространения
Создает следующие сервисы
- [<HKLM>\System\CurrentControlSet\Services\RManService] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\RManService] 'ImagePath' = '"%ProgramFiles%\Remote Manipulator System - Host\rutserv.exe"'
Вредоносные функции
Для обхода брандмауэра удаляет или модифицирует следующие ключи реестра
- [<HKLM>\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%ProgramFiles%\Remote Manipulator System - Host\rutserv.exe' = '%P...
Для затруднения выявления своего присутствия в системе
блокирует запуск следующих системных утилит:
- Диспетчера задач (Taskmgr)
изменяет следующие системные настройки:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoTrayItemsDisplay' = '00000001'
Запускает на исполнение
- '<SYSTEM32>\taskkill.exe' /im explorer.exe /f
Завершает или пытается завершить
следующие системные процессы:
- %WINDIR%\explorer.exe
Изменения в файловой системе
Создает следующие файлы
- %TEMP%\$inst\2.tmp
- %ProgramFiles%\remote manipulator system - host\printer\common\fwproc.exe
- %ProgramFiles%\remote manipulator system - host\printer\common\printer.ico
- %ProgramFiles%\remote manipulator system - host\printer\x64\msvcp120.dll
- %ProgramFiles%\remote manipulator system - host\printer\x64\setupdrv.exe
- %ProgramFiles%\remote manipulator system - host\printer\x64\rppdui.dll
- %ProgramFiles%\remote manipulator system - host\printer\x64\unires_vpd.dll
- %ProgramFiles%\remote manipulator system - host\printer\x64\rppd.lng
- %ProgramFiles%\remote manipulator system - host\printer\x64\msvcr120.dll
- %ProgramFiles%\remote manipulator system - host\printer\x64\printer.ico
- %ProgramFiles%\remote manipulator system - host\printer\x64\rppd.gpd
- %ProgramFiles%\remote manipulator system - host\printer\x64\vccorlib120.dll
- %ProgramFiles%\remote manipulator system - host\printer\x64\stdnames_vpd.gpd
- %ProgramFiles%\remote manipulator system - host\printer\x64\unidrvui_rppd.dll
- %ProgramFiles%\remote manipulator system - host\printer\x64\unidrv_rppd.hlp
- %ProgramFiles%\remote manipulator system - host\printer\x64\unidrv_rppd.dll
- %ProgramFiles%\remote manipulator system - host\printer\x64\rppd.ini
- %ProgramFiles%\remote manipulator system - host\printer\x64\ntprint.inf
- %ProgramFiles%\remote manipulator system - host\printer\x64\rppdpm.dll
- %ProgramFiles%\remote manipulator system - host\rfusclient.exe
- %ProgramFiles%\remote manipulator system - host\rutserv.exe
- %ProgramFiles%\remote manipulator system - host\printer\x86\msvcp120.dll
- %ProgramFiles%\remote manipulator system - host\printer\x86\msvcr120.dll
- %ProgramFiles%\remote manipulator system - host\printer\x86\vccorlib120.dll
- %ProgramFiles%\remote manipulator system - host\printer\x86\rppdui.dll
- %ProgramFiles%\remote manipulator system - host\printer\x86\rppdpm.dll
- %ProgramFiles%\remote manipulator system - host\printer\x86\rppd.ini
- %ProgramFiles%\remote manipulator system - host\printer\x86\printer.ico
- %ProgramFiles%\remote manipulator system - host\printer\x86\unidrv_rppd.dll
- %ProgramFiles%\remote manipulator system - host\printer\x86\ntprint.inf
- %ProgramFiles%\remote manipulator system - host\printer\common\messagebox.exe
- %ProgramFiles%\remote manipulator system - host\printer\common\progressbar.exe
- %ALLUSERSPROFILE%\application data\remote manipulator system\msi\69110_{e5803a4b-5a4b-44f6-a759-882fb6ad7982}\original1.msi
- %WINDIR%\installer\{e5803a4b-5a4b-44f6-a759-882fb6ad7982}\server_start_c00864331b9d4391a8a26292a601ebe2.exe
- %WINDIR%\installer\{e5803a4b-5a4b-44f6-a759-882fb6ad7982}\server_config_c8e9a92497a149d695f92e4e3ae550f0.exe
- %WINDIR%\installer\{e5803a4b-5a4b-44f6-a759-882fb6ad7982}\server_stop_27d7873393984316bea10fb36bb4d2f9.exe
- %WINDIR%\installer\{e5803a4b-5a4b-44f6-a759-882fb6ad7982}\uninst_uninstall_r_3b1e3c8b7d0945898da82ceeed02f0c7.exe
- %WINDIR%\installer\{e5803a4b-5a4b-44f6-a759-882fb6ad7982}\arpproducticon.exe
- %ProgramFiles%\remote manipulator system - host\monitor\x86\windows10\lockscr.cat
- %ProgramFiles%\remote manipulator system - host\monitor\x86\windows10\lockscr.inf
- %ProgramFiles%\remote manipulator system - host\monitor\x86\windows10\lockscr.sys
- %ProgramFiles%\remote manipulator system - host\monitor\x64\windows10\lockscr.cat
- %ProgramFiles%\remote manipulator system - host\monitor\x64\windows10\lockscr.inf
- %ProgramFiles%\remote manipulator system - host\monitor\x64\windows10\lockscr.sys
- %ProgramFiles%\remote manipulator system - host\monitor\x86\drvinstaller32.exe
- %ProgramFiles%\remote manipulator system - host\monitor\x86\windows8\lockscr.inf
- <LS_APPDATA>\adobe\7c1a68e9-60fc-46eb-b223-621226a322e5\info_icon_100.png
- %ProgramFiles%\remote manipulator system - host\monitor\x86\windows8\lockscr.sys
- %ProgramFiles%\remote manipulator system - host\monitor\x64\drvinstaller64.exe
- %ProgramFiles%\remote manipulator system - host\monitor\x64\windows8\lockscr.cat
- %ProgramFiles%\remote manipulator system - host\monitor\x64\windows8\lockscr.inf
- %ProgramFiles%\remote manipulator system - host\monitor\x64\windows8\lockscr.sys
- %ProgramFiles%\remote manipulator system - host\printer\common\rppd.lng
- %ProgramFiles%\remote manipulator system - host\printer\common\vpd_sdk.dll
- %ProgramFiles%\remote manipulator system - host\printer\common\pdfout.dll
- %ProgramFiles%\remote manipulator system - host\printer\common\emf2pdf.dll
- %ProgramFiles%\remote manipulator system - host\printer\common\vpdisp.exe
- %ProgramFiles%\remote manipulator system - host\printer\common\vpdagent.exe
- %ProgramFiles%\remote manipulator system - host\printer\common\srvinst.exe
- %ProgramFiles%\remote manipulator system - host\printer\common\properties.exe
- %ProgramFiles%\remote manipulator system - host\printer\x86\stdnames_vpd.gpd
- %ProgramFiles%\remote manipulator system - host\printer\x86\setupdrv.exe
- %ProgramFiles%\remote manipulator system - host\printer\x86\unires_vpd.dll
- <LS_APPDATA>\adobe\7c1a68e9-60fc-46eb-b223-621226a322e5\transparent.gif
- <LS_APPDATA>\adobe\7c1a68e9-60fc-46eb-b223-621226a322e5\progressbar_blue_active_150.png
- <LS_APPDATA>\adobe\7c1a68e9-60fc-46eb-b223-621226a322e5\progressbar_blue_active_125.png
- <LS_APPDATA>\adobe\7c1a68e9-60fc-46eb-b223-621226a322e5\progressbar_blue_active_100.png
- <LS_APPDATA>\adobe\7c1a68e9-60fc-46eb-b223-621226a322e5\progressbar_blue_active_200.png
- <LS_APPDATA>\adobe\7c1a68e9-60fc-46eb-b223-621226a322e5\progressbar_darkgray_base_100.png
- <LS_APPDATA>\adobe\7c1a68e9-60fc-46eb-b223-621226a322e5\progressbar_darkgray_base_200.png
- <LS_APPDATA>\adobe\7c1a68e9-60fc-46eb-b223-621226a322e5\status_icon_check_150.png
- <LS_APPDATA>\adobe\7c1a68e9-60fc-46eb-b223-621226a322e5\status_icon_check_125.png
- <LS_APPDATA>\adobe\7c1a68e9-60fc-46eb-b223-621226a322e5\status_icon_check_100.png
- <LS_APPDATA>\adobe\7c1a68e9-60fc-46eb-b223-621226a322e5\status_icon_check_200.png
- <LS_APPDATA>\adobe\7c1a68e9-60fc-46eb-b223-621226a322e5\status_icon_x_150.png
- <LS_APPDATA>\adobe\7c1a68e9-60fc-46eb-b223-621226a322e5\status_icon_x_125.png
- <LS_APPDATA>\adobe\7c1a68e9-60fc-46eb-b223-621226a322e5\status_icon_x_100.png
- <LS_APPDATA>\adobe\7c1a68e9-60fc-46eb-b223-621226a322e5\status_icon_x_200.png
- <LS_APPDATA>\adobe\7c1a68e9-60fc-46eb-b223-621226a322e5\status_icon_caution_150.png
- <LS_APPDATA>\adobe\7c1a68e9-60fc-46eb-b223-621226a322e5\status_icon_caution_125.png
- <LS_APPDATA>\adobe\7c1a68e9-60fc-46eb-b223-621226a322e5\status_icon_caution_100.png
- <LS_APPDATA>\adobe\7c1a68e9-60fc-46eb-b223-621226a322e5\status_icon_caution_200.png
- <LS_APPDATA>\adobe\7c1a68e9-60fc-46eb-b223-621226a322e5\warning_icon_200.png
- %TEMP%\$inst\0002.tmp
- %ProgramFiles%\system\readerdc_ro_id_cra_install.exe
- %ProgramFiles%\system\test3.bat
- %TEMP%\$inst\0001.tmp
- %ProgramFiles%\system\original1.msi
- %TEMP%\$inst\temp_0.tmp
- <LS_APPDATA>\adobe\7c1a68e9-60fc-46eb-b223-621226a322e5\close_200.png
- <LS_APPDATA>\adobe\7c1a68e9-60fc-46eb-b223-621226a322e5\progressbar_pole_null_200.png
- <LS_APPDATA>\adobe\7c1a68e9-60fc-46eb-b223-621226a322e5\gray_button_200.png
- <LS_APPDATA>\adobe\7c1a68e9-60fc-46eb-b223-621226a322e5\progressbar_pole_null_100.png
- %ProgramFiles%\remote manipulator system - host\printer\x86\unidrvui_rppd.dll
- <LS_APPDATA>\adobe\7c1a68e9-60fc-46eb-b223-621226a322e5\progressbar_pole_null_125.png
- %ProgramFiles%\remote manipulator system - host\printer\x86\unidrv_rppd.hlp
- %ProgramFiles%\remote manipulator system - host\printer\x86\rppd.gpd
- %ProgramFiles%\remote manipulator system - host\printer\x86\rppd.lng
- %ProgramFiles%\remote manipulator system - host\ssleay32.dll
- %ProgramFiles%\remote manipulator system - host\libeay32.dll
- %ProgramFiles%\remote manipulator system - host\russian.lg
- %ProgramFiles%\remote manipulator system - host\webmmux.dll
- %ProgramFiles%\remote manipulator system - host\webmvorbisdecoder.dll
- %ProgramFiles%\remote manipulator system - host\eula.rtf
- %ProgramFiles%\remote manipulator system - host\vp8decoder.dll
- %ProgramFiles%\remote manipulator system - host\vp8encoder.dll
- %ProgramFiles%\remote manipulator system - host\webmvorbisencoder.dll
- %ProgramFiles%\remote manipulator system - host\monitor\x86\windows8\lockscr.cat
- %ALLUSERSPROFILE%\application data\remote manipulator system\install.log
- <LS_APPDATA>\adobe\7c1a68e9-60fc-46eb-b223-621226a322e5\yellow_button_short_150.png
- <LS_APPDATA>\adobe\7c1a68e9-60fc-46eb-b223-621226a322e5\yellow_button_short_125.png
- <LS_APPDATA>\adobe\7c1a68e9-60fc-46eb-b223-621226a322e5\yellow_button_short_100.png
- <LS_APPDATA>\adobe\7c1a68e9-60fc-46eb-b223-621226a322e5\yellow_button_short_200.png
- <LS_APPDATA>\adobe\7c1a68e9-60fc-46eb-b223-621226a322e5\yellow_button_mini_150.png
- <LS_APPDATA>\adobe\7c1a68e9-60fc-46eb-b223-621226a322e5\yellow_button_mini_125.png
- <LS_APPDATA>\adobe\7c1a68e9-60fc-46eb-b223-621226a322e5\yellow_button_mini_100.png
- <LS_APPDATA>\adobe\7c1a68e9-60fc-46eb-b223-621226a322e5\yellow_button_mini_200.png
- <LS_APPDATA>\adobe\7c1a68e9-60fc-46eb-b223-621226a322e5\yellow_button_150.png
- <LS_APPDATA>\adobe\7c1a68e9-60fc-46eb-b223-621226a322e5\yellow_button_125.png
- <LS_APPDATA>\adobe\7c1a68e9-60fc-46eb-b223-621226a322e5\yellow_button_100.png
- <LS_APPDATA>\adobe\7c1a68e9-60fc-46eb-b223-621226a322e5\yellow_button_200.png
- <LS_APPDATA>\adobe\7c1a68e9-60fc-46eb-b223-621226a322e5\progressbar_pole_null_150.png
- %ProgramFiles%\remote manipulator system - host\english.lg
- %ProgramFiles%\remote manipulator system - host\logs\rms_log_2019-08.html
Присваивает атрибут 'скрытый' для следующих файлов
- %ProgramFiles%\system\original1.msi
- %ProgramFiles%\system\readerdc_ro_id_cra_install.exe
- %ProgramFiles%\system\test3.bat
Удаляет следующие файлы
- %TEMP%\$inst\temp_0.tmp
- %TEMP%\$inst\0001.tmp
- %TEMP%\$inst\0002.tmp
- %TEMP%\$inst\2.tmp
Подменяет следующие файлы
- %TEMP%\Adobe_ADMLogs\Adobe_ADM.log
- %TEMP%\Adobe_ADMLogs\Adobe_GDE.log
Сетевая активность
UDP
- DNS ASK get.adobe.com
- DNS ASK ma##.###dadesign.network
Другое
Ищет следующие окна
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebcheckMonitor' WindowName: ''
- ClassName: '' WindowName: ''
- ClassName: 'Proxy Desktop' WindowName: ''
- ClassName: 'BaseBar' WindowName: 'ChanApp'
- ClassName: 'OleMainThreadWndClass' WindowName: ''
- ClassName: 'SystemTray_Main' WindowName: ''
- ClassName: 'CSCHiddenWindow' WindowName: ''
Создает и запускает на исполнение
- '%ProgramFiles%\system\readerdc_ro_id_cra_install.exe'
- '%ProgramFiles%\remote manipulator system - host\rfusclient.exe' -msi_copy "%ProgramFiles%\System\Original1.msi"
- '%ProgramFiles%\remote manipulator system - host\rutserv.exe' /silentinstall
- '%ProgramFiles%\remote manipulator system - host\rutserv.exe' /firewall
- '%ProgramFiles%\remote manipulator system - host\rutserv.exe' /start
- '%ProgramFiles%\remote manipulator system - host\rutserv.exe'
- '%ProgramFiles%\remote manipulator system - host\rfusclient.exe' /tray
- '<SYSTEM32>\cmd.exe' /c ""%ProgramFiles%\System\test3.bat" "' (со скрытым окном)
- '%ProgramFiles%\system\readerdc_ro_id_cra_install.exe' ' (со скрытым окном)
Запускает на исполнение
- '<SYSTEM32>\cmd.exe' /c ""%ProgramFiles%\System\test3.bat" "
- '<SYSTEM32>\msiexec.exe' /i Original1.msi /qn
- '<SYSTEM32>\msiexec.exe' /V
- '<SYSTEM32>\msiexec.exe' -Embedding 4E43B63C51960FA4CFF8C24952898BCE
- '<SYSTEM32>\attrib.exe' +h "%ProgramFiles% (x86)\Remote Manipulator System - Host"
- '<SYSTEM32>\attrib.exe' +h /s /d "%ProgramFiles% (x86)\Remote Manipulator System - Host"\*.*
- '<SYSTEM32>\attrib.exe' +h "%ProgramFiles%\System"
- '<SYSTEM32>\attrib.exe' +h /s /d "%ProgramFiles%\System"\*.*
- '<SYSTEM32>\reg.exe' add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoTrayItemsDisplay /t REG_DWORD /d 1
- '<SYSTEM32>\reg.exe' add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1
- '<SYSTEM32>\reg.exe' add "HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{E5803A4B-5A4B-44F6-A759-882FB6AD7982}" /v SystemComponent /t REG_DWORD /d 1
- '<SYSTEM32>\reg.exe' delete "HKEY_LOCAL_MACHINE\SOFTWARE\TektonIT\RMS Host\Host\Parameters" /v "General" /f /reg:64
- '<SYSTEM32>\reg.exe' add "HKEY_LOCAL_MACHINE\SOFTWARE\TektonIT\RMS Host\Host\Parameters" /v General /t REG_BINARY /d efbbbf3c3f786d6c2076657273696f6e3d22312e302220656e636f64696e673d225554462d38223f3e0d0a3c67656e657...
- '%WINDIR%\explorer.exe'
