Техническая информация
Для обеспечения автозапуска и распространения
Модифицирует следующие ключи реестра
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'RAMSaverPro' = '%ProgramFiles(x86)%\WinTools Software\RAM Saver Professional\ramsaverpro.exe'
Создает следующие сервисы
- [<HKLM>\System\CurrentControlSet\Services\DNS-Service] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\DNS-Service] 'ImagePath' = '"%WINDIR%\SysWOW64\drivers\dllhost.exe"'
Вредоносные функции
Запускает на исполнение
- '%WINDIR%\syswow64\taskkill.exe' /f /im rutserv.exe
- '%WINDIR%\syswow64\taskkill.exe' /f /im rfusclient.exe
- '%WINDIR%\syswow64\netsh.exe' firewall add portopening TCP 5650 "Open Port 5650"
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="Open Port 5650" dir=in action=allow protocol=TCP localport=5650
Изменения в файловой системе
Создает следующие файлы
- %TEMP%\$inst\2.tmp
- %ProgramFiles(x86)%\wintools software\ram saver professional\lang\is-tnp51.tmp
- %ProgramFiles(x86)%\wintools software\ram saver professional\lang\is-pbk6l.tmp
- %ProgramFiles(x86)%\wintools software\ram saver professional\lang\is-iv9d0.tmp
- %ProgramFiles(x86)%\wintools software\ram saver professional\lang\is-gq13s.tmp
- %ProgramFiles(x86)%\wintools software\ram saver professional\lang\is-jp4ai.tmp
- %ProgramFiles(x86)%\wintools software\ram saver professional\lang\is-cfrh7.tmp
- %ProgramFiles(x86)%\wintools software\ram saver professional\lang\is-pmrcr.tmp
- %ProgramFiles(x86)%\wintools software\ram saver professional\lang\is-u6tq7.tmp
- %ProgramFiles(x86)%\wintools software\ram saver professional\lang\is-r41d7.tmp
- %ProgramFiles(x86)%\wintools software\ram saver professional\lang\is-ndgtg.tmp
- %ProgramFiles(x86)%\wintools software\ram saver professional\lang\is-2dq58.tmp
- %ProgramFiles(x86)%\wintools software\ram saver professional\lang\is-31qr4.tmp
- %ProgramFiles(x86)%\wintools software\ram saver professional\lang\is-bq2ko.tmp
- %ProgramFiles(x86)%\wintools software\ram saver professional\lang\is-8c7i8.tmp
- %ProgramFiles(x86)%\wintools software\ram saver professional\lang\is-ms8fb.tmp
- %PROGRAMDATA%\domain name system servis\install.log
- %ProgramFiles(x86)%\wintools software\ram saver professional\lang\is-0jhcu.tmp
- %ProgramFiles(x86)%\wintools software\ram saver professional\lang\is-m96a5.tmp
- %ProgramFiles(x86)%\wintools software\ram saver professional\lang\is-1d0ah.tmp
- %ProgramFiles(x86)%\wintools software\ram saver professional\lang\is-mc1jl.tmp
- %ProgramFiles(x86)%\wintools software\ram saver professional\lang\is-cic5h.tmp
- %ProgramFiles(x86)%\wintools software\ram saver professional\is-altk2.tmp
- %ProgramFiles(x86)%\wintools software\ram saver professional\lang\is-ioc6v.tmp
- %PROGRAMDATA%\microsoft\windows\start menu\programs\ram saver professional\ram saver professional.lnk
- %PROGRAMDATA%\microsoft\windows\start menu\programs\ram saver professional\language switcher.lnk
- %PROGRAMDATA%\microsoft\windows\start menu\programs\ram saver professional\uninstall.lnk
- %ProgramFiles(x86)%\wintools software\ram saver professional\unins000.dat
- %HOMEPATH%\desktop\ram saver professional.lnk
- %ProgramFiles(x86)%\wintools software\ram saver professional\ramsaverpro.ini
- %TEMP%\101.ico
- %ProgramFiles(x86)%\wintools software\ram saver professional\help\is-i3p3c.tmp
- %ProgramFiles(x86)%\wintools software\ram saver professional\lang\is-q8tns.tmp
- %ProgramFiles(x86)%\wintools software\ram saver professional\lang\is-oq07s.tmp
- %TEMP%\is-72bn3.tmp\metroblue.vsf
- %TEMP%\$inst\temp_0.tmp
- %WINDIR%\syswow64\drivers\install.cmd
- %WINDIR%\syswow64\drivers\install.exe
- %WINDIR%\syswow64\drivers\ssleay32.dll
- %WINDIR%\syswow64\drivers\libeay32.dll
- %WINDIR%\syswow64\drivers\dllhost.exe
- %TEMP%\ram saver\19.5\setup.exe
- %TEMP%\ram saver\19.5\reg.exe
- %TEMP%\is-mqeas.tmp\setup.tmp
- %TEMP%\is-72bn3.tmp\_isetup\_regdll.tmp
- %TEMP%\is-72bn3.tmp\_isetup\_setup64.tmp
- %TEMP%\is-72bn3.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-72bn3.tmp\istask.dll
- %TEMP%\is-72bn3.tmp\vclstylesinno.dll
- %TEMP%\is-72bn3.tmp\wizardform.bitmapimage1.bmp
- %ProgramFiles(x86)%\wintools software\ram saver professional\lang\is-fr6ot.tmp
- %ProgramFiles(x86)%\wintools software\ram saver professional\is-ablo5.tmp
- %ProgramFiles(x86)%\wintools software\ram saver professional\is-3mgol.tmp
- %ProgramFiles(x86)%\wintools software\ram saver professional\is-6tc3d.tmp
- %ProgramFiles(x86)%\wintools software\ram saver professional\is-e322d.tmp
- %ProgramFiles(x86)%\wintools software\ram saver professional\is-g1qbm.tmp
- %ProgramFiles(x86)%\wintools software\ram saver professional\is-ctg1b.tmp
- %ProgramFiles(x86)%\wintools software\ram saver professional\is-k0hhr.tmp
- %ProgramFiles(x86)%\wintools software\ram saver professional\is-6napl.tmp
- %ProgramFiles(x86)%\wintools software\ram saver professional\is-bc9av.tmp
- %ProgramFiles(x86)%\wintools software\ram saver professional\is-kmbkr.tmp
- %ProgramFiles(x86)%\wintools software\ram saver professional\help\is-eaf6e.tmp
- %ProgramFiles(x86)%\wintools software\ram saver professional\help\is-200vk.tmp
- %ProgramFiles(x86)%\wintools software\ram saver professional\lang\is-ra23q.tmp
- %ProgramFiles(x86)%\wintools software\ram saver professional\lang\is-v1onu.tmp
- %ProgramFiles(x86)%\wintools software\ram saver professional\lang\is-nd5b1.tmp
- %WINDIR%\syswow64\idfgvgjnghcdfb.reg
Присваивает атрибут 'скрытый' для следующих файлов
- %WINDIR%\syswow64\idfgvgjnghcdfb.reg
- %WINDIR%\syswow64\drivers\dllhost.exe
- %WINDIR%\syswow64\drivers\install.exe
- %WINDIR%\syswow64\drivers\install.cmd
Удаляет следующие файлы
- %TEMP%\$inst\temp_0.tmp
- %ProgramFiles(x86)%\wintools software\ram saver professional\lang\default.lng
- %PROGRAMDATA%\microsoft\windows\start menu\programs\ram saver professional\ram saver professional.lnk
- %TEMP%\is-72bn3.tmp\istask.dll
- %TEMP%\is-72bn3.tmp\metroblue.vsf
- %TEMP%\is-72bn3.tmp\vclstylesinno.dll
- %TEMP%\is-72bn3.tmp\wizardform.bitmapimage1.bmp
- %TEMP%\is-72bn3.tmp\_isetup\_regdll.tmp
- %TEMP%\is-72bn3.tmp\_isetup\_setup64.tmp
- %TEMP%\is-72bn3.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-mqeas.tmp\setup.tmp
- %TEMP%\$inst\2.tmp
- %TEMP%\ram saver\19.5\reg.exe
- %TEMP%\ram saver\19.5\setup.exe
- %WINDIR%\syswow64\drivers\install.exe
- %WINDIR%\syswow64\drivers\install.cmd
Перемещает следующие файлы
- %ProgramFiles(x86)%\wintools software\ram saver professional\is-ablo5.tmp в %ProgramFiles(x86)%\wintools software\ram saver professional\unins000.exe
- %ProgramFiles(x86)%\wintools software\ram saver professional\lang\is-cfrh7.tmp в %ProgramFiles(x86)%\wintools software\ram saver professional\lang\french.lng
- %ProgramFiles(x86)%\wintools software\ram saver professional\lang\is-pmrcr.tmp в %ProgramFiles(x86)%\wintools software\ram saver professional\lang\german.lng
- %ProgramFiles(x86)%\wintools software\ram saver professional\lang\is-u6tq7.tmp в %ProgramFiles(x86)%\wintools software\ram saver professional\lang\hungarian.lng
- %ProgramFiles(x86)%\wintools software\ram saver professional\lang\is-r41d7.tmp в %ProgramFiles(x86)%\wintools software\ram saver professional\lang\italiano.lng
- %ProgramFiles(x86)%\wintools software\ram saver professional\lang\is-ndgtg.tmp в %ProgramFiles(x86)%\wintools software\ram saver professional\lang\kazakh.lng
- %ProgramFiles(x86)%\wintools software\ram saver professional\lang\is-2dq58.tmp в %ProgramFiles(x86)%\wintools software\ram saver professional\lang\korean.lng
- %ProgramFiles(x86)%\wintools software\ram saver professional\lang\is-gq13s.tmp в %ProgramFiles(x86)%\wintools software\ram saver professional\lang\dutch.lng
- %ProgramFiles(x86)%\wintools software\ram saver professional\lang\is-jp4ai.tmp в %ProgramFiles(x86)%\wintools software\ram saver professional\lang\espanol.lng
- %ProgramFiles(x86)%\wintools software\ram saver professional\lang\is-31qr4.tmp в %ProgramFiles(x86)%\wintools software\ram saver professional\lang\polish.lng
- %ProgramFiles(x86)%\wintools software\ram saver professional\lang\is-q8tns.tmp в %ProgramFiles(x86)%\wintools software\ram saver professional\lang\serbian.lng
- %ProgramFiles(x86)%\wintools software\ram saver professional\lang\is-ms8fb.tmp в %ProgramFiles(x86)%\wintools software\ram saver professional\lang\spanish.lng
- %ProgramFiles(x86)%\wintools software\ram saver professional\lang\is-0jhcu.tmp в %ProgramFiles(x86)%\wintools software\ram saver professional\lang\swedish.lng
- %ProgramFiles(x86)%\wintools software\ram saver professional\lang\is-m96a5.tmp в %ProgramFiles(x86)%\wintools software\ram saver professional\lang\taiwan.lng
- %ProgramFiles(x86)%\wintools software\ram saver professional\lang\is-1d0ah.tmp в %ProgramFiles(x86)%\wintools software\ram saver professional\lang\thai.lng
- %ProgramFiles(x86)%\wintools software\ram saver professional\lang\is-mc1jl.tmp в %ProgramFiles(x86)%\wintools software\ram saver professional\lang\turkish.lng
- %ProgramFiles(x86)%\wintools software\ram saver professional\lang\is-bq2ko.tmp в %ProgramFiles(x86)%\wintools software\ram saver professional\lang\portugues_br.lng
- %ProgramFiles(x86)%\wintools software\ram saver professional\lang\is-8c7i8.tmp в %ProgramFiles(x86)%\wintools software\ram saver professional\lang\schinese.lng
- %ProgramFiles(x86)%\wintools software\ram saver professional\lang\is-iv9d0.tmp в %ProgramFiles(x86)%\wintools software\ram saver professional\lang\czech.lng
- %ProgramFiles(x86)%\wintools software\ram saver professional\lang\is-pbk6l.tmp в %ProgramFiles(x86)%\wintools software\ram saver professional\lang\croatian.lng
- %ProgramFiles(x86)%\wintools software\ram saver professional\lang\is-tnp51.tmp в %ProgramFiles(x86)%\wintools software\ram saver professional\lang\arabic.lng
- %ProgramFiles(x86)%\wintools software\ram saver professional\is-6tc3d.tmp в %ProgramFiles(x86)%\wintools software\ram saver professional\killproc.exe
- %ProgramFiles(x86)%\wintools software\ram saver professional\is-e322d.tmp в %ProgramFiles(x86)%\wintools software\ram saver professional\killproc.ini
- %ProgramFiles(x86)%\wintools software\ram saver professional\is-g1qbm.tmp в %ProgramFiles(x86)%\wintools software\ram saver professional\language.exe
- %ProgramFiles(x86)%\wintools software\ram saver professional\is-ctg1b.tmp в %ProgramFiles(x86)%\wintools software\ram saver professional\moncpu.exe
- %ProgramFiles(x86)%\wintools software\ram saver professional\is-k0hhr.tmp в %ProgramFiles(x86)%\wintools software\ram saver professional\monram.exe
- %ProgramFiles(x86)%\wintools software\ram saver professional\is-6napl.tmp в %ProgramFiles(x86)%\wintools software\ram saver professional\ramsavercp.exe
- %ProgramFiles(x86)%\wintools software\ram saver professional\is-bc9av.tmp в %ProgramFiles(x86)%\wintools software\ram saver professional\ramsaverpro.exe
- %ProgramFiles(x86)%\wintools software\ram saver professional\is-3mgol.tmp в %ProgramFiles(x86)%\wintools software\ram saver professional\comboost.exe
- %ProgramFiles(x86)%\wintools software\ram saver professional\is-kmbkr.tmp в %ProgramFiles(x86)%\wintools software\ram saver professional\ramsaverpro.xml
- %ProgramFiles(x86)%\wintools software\ram saver professional\help\is-200vk.tmp в %ProgramFiles(x86)%\wintools software\ram saver professional\help\russian.chm
- %ProgramFiles(x86)%\wintools software\ram saver professional\lang\is-ra23q.tmp в %ProgramFiles(x86)%\wintools software\ram saver professional\lang\belarusian.lng
- %ProgramFiles(x86)%\wintools software\ram saver professional\lang\is-v1onu.tmp в %ProgramFiles(x86)%\wintools software\ram saver professional\lang\default.lng
- %ProgramFiles(x86)%\wintools software\ram saver professional\lang\is-fr6ot.tmp в %ProgramFiles(x86)%\wintools software\ram saver professional\lang\english.lng
- %ProgramFiles(x86)%\wintools software\ram saver professional\lang\is-nd5b1.tmp в %ProgramFiles(x86)%\wintools software\ram saver professional\lang\russian.lng
- %ProgramFiles(x86)%\wintools software\ram saver professional\lang\is-oq07s.tmp в %ProgramFiles(x86)%\wintools software\ram saver professional\lang\ukrainian.lng
- %ProgramFiles(x86)%\wintools software\ram saver professional\help\is-i3p3c.tmp в %ProgramFiles(x86)%\wintools software\ram saver professional\help\spanish.chm
- %ProgramFiles(x86)%\wintools software\ram saver professional\help\is-eaf6e.tmp в %ProgramFiles(x86)%\wintools software\ram saver professional\help\english.chm
- %ProgramFiles(x86)%\wintools software\ram saver professional\lang\is-cic5h.tmp в %ProgramFiles(x86)%\wintools software\ram saver professional\lang\vietnamese.lng
- %ProgramFiles(x86)%\wintools software\ram saver professional\is-altk2.tmp в %ProgramFiles(x86)%\wintools software\ram saver professional\ramsaverpro.ini
Подменяет следующие файлы
- %ProgramFiles(x86)%\wintools software\ram saver professional\lang\default.lng
- %PROGRAMDATA%\microsoft\windows\start menu\programs\ram saver professional\ram saver professional.lnk
- %TEMP%\$inst\2.tmp
- %TEMP%\$inst\temp_0.tmp
Сетевая активность
UDP
- DNS ASK sm##.#paceweb.ru
- DNS ASK rm#####ver.tektonit.ru
Другое
Ищет следующие окна
- ClassName: '' WindowName: ''
- ClassName: 'RegEdit_RegEdit' WindowName: ''
- ClassName: 'ProgMan' WindowName: ''
- ClassName: 'SHELLDLL_DefView' WindowName: ''
- ClassName: 'SysListView32' WindowName: ''
- ClassName: 'BUTTON' WindowName: ''
- ClassName: 'ReBarWindow32' WindowName: ''
- ClassName: 'ToolbarWindow32' WindowName: 'Quick Launch'
- ClassName: 'MSTaskSwWClass' WindowName: ''
- ClassName: 'TrayNotifyWnd' WindowName: ''
- ClassName: 'SysPager' WindowName: ''
- ClassName: 'TrayClockWClass' WindowName: ''
- ClassName: 'RamSaverProWndClass' WindowName: ''
- ClassName: 'RAMbooster' WindowName: ''
- ClassName: 'monramWndClass' WindowName: ''
- ClassName: 'moncpuWndClass' WindowName: ''
Создает и запускает на исполнение
- '%WINDIR%\syswow64\drivers\dllhost.exe'
- '%TEMP%\ram saver\19.5\setup.exe' /VERYSILENT
- '%WINDIR%\syswow64\drivers\dllhost.exe' /firewall
- '%TEMP%\is-mqeas.tmp\setup.tmp' /SL5="$10268,1956502,64512,%TEMP%\RAM Saver\19.5\setup.exe" /VERYSILENT
- '%ProgramFiles(x86)%\wintools software\ram saver professional\ramsavercp.exe'
- '%TEMP%\ram saver\19.5\reg.exe' shortcut "%ProgramFiles(x86)%\WinTools Software\RAM Saver Professional\RAMSaverPro.exe" "~$folder.desktop$" "RAM Saver Professional"
- '%WINDIR%\syswow64\drivers\install.exe'
- '%WINDIR%\syswow64\drivers\dllhost.exe' /start
- '%ProgramFiles(x86)%\wintools software\ram saver professional\ramsaverpro.exe'
- '%WINDIR%\syswow64\drivers\dllhost.exe' /silentinstall
- '%TEMP%\ram saver\19.5\setup.exe' /VERYSILENT' (со скрытым окном)
- '%WINDIR%\syswow64\cmd.exe' /c attrib -h -s -r "%TEMP%\RAM Saver\19.5\*.*"' (со скрытым окном)
- '%WINDIR%\syswow64\cmd.exe' /c reg delete "HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\RAM Saver 19.5" /f' (со скрытым окном)
- '%WINDIR%\syswow64\cmd.exe' /c RMDIR /s/q "%TEMP%\RAM Saver"' (со скрытым окном)
- '%WINDIR%\syswow64\cmd.exe' /c "%ProgramFiles%\WinTools Software\RAM Saver Professional\RAMSaverPro.exe"' (со скрытым окном)
- '%WINDIR%\syswow64\cmd.exe' /c "%ProgramFiles(x86)%\WinTools Software\RAM Saver Professional\RAMSaverPro.exe"' (со скрытым окном)
- '%WINDIR%\syswow64\cmd.exe' /c "%ProgramFiles%\WinTools Software\RAM Saver Professional\ramsavercp.exe"' (со скрытым окном)
- '%WINDIR%\syswow64\cmd.exe' /c "%ProgramFiles(x86)%\WinTools Software\RAM Saver Professional\ramsavercp.exe"' (со скрытым окном)
- '%TEMP%\ram saver\19.5\reg.exe' shortcut "%ProgramFiles(x86)%\WinTools Software\RAM Saver Professional\RAMSaverPro.exe" "~$folder.desktop$" "RAM Saver Professional"' (со скрытым окном)
- '%WINDIR%\syswow64\cmd.exe' /c ""<DRIVERS>\install.cmd" "' (со скрытым окном)
Запускает на исполнение
- '%WINDIR%\syswow64\cmd.exe' /c ""<DRIVERS>\install.cmd" "
- '%WINDIR%\syswow64\attrib.exe' -h -s -r "%ProgramFiles%\Remote Manipulator System - Host"
- '%WINDIR%\syswow64\attrib.exe' -h -s -r "%ProgramFiles(x86)%\Remote Manipulator System - Host"
- '%WINDIR%\syswow64\attrib.exe' -h -s "rfusclient.exe"
- '%WINDIR%\syswow64\attrib.exe' +h +s "install.cmd"
- '%WINDIR%\syswow64\attrib.exe' +h +s "install.exe"
- '%WINDIR%\syswow64\attrib.exe' +h +s "dllhost.exe"
- '%WINDIR%\syswow64\attrib.exe' +h +s "<SYSTEM32>\idfgvgjnghcdfb.reg"
- '%WINDIR%\syswow64\ping.exe' 127.0.0.1
- '%WINDIR%\syswow64\reg.exe' delete "HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\RAM Saver 19.5" /f
- '%WINDIR%\syswow64\cmd.exe' /c reg delete "HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\RAM Saver 19.5" /f
- '%WINDIR%\syswow64\cmd.exe' /c RMDIR /s/q "%TEMP%\RAM Saver"
- '%WINDIR%\syswow64\attrib.exe' -h -s -r "%TEMP%\RAM Saver\19.5\*.*"
- '%WINDIR%\syswow64\reg.exe' delete "HKLM\SYSTEM\Remote Manipulator System" /f
- '%WINDIR%\syswow64\cmd.exe' /c attrib -h -s -r "%TEMP%\RAM Saver\19.5\*.*"
- '%WINDIR%\syswow64\cmd.exe' /c "%ProgramFiles%\WinTools Software\RAM Saver Professional\RAMSaverPro.exe"
- '%WINDIR%\syswow64\cmd.exe' /c "%ProgramFiles(x86)%\WinTools Software\RAM Saver Professional\RAMSaverPro.exe"
- '%WINDIR%\syswow64\cmd.exe' /c "%ProgramFiles%\WinTools Software\RAM Saver Professional\ramsavercp.exe"
- '%WINDIR%\syswow64\cmd.exe' /c "%ProgramFiles(x86)%\WinTools Software\RAM Saver Professional\ramsavercp.exe"
- '%WINDIR%\syswow64\regedit.exe' /S "%TEMP%\RAM Saver\19.5\settings.reg"
- '%WINDIR%\syswow64\attrib.exe' -h -s "install.exe"
- '%WINDIR%\syswow64\attrib.exe' -h -s "install.cmd"
