Trojan.DownLoader6.8822

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\RWLN] 'Startup' = 'WLEventStartup'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\RWLN] 'Logon' = 'WLEventLogon'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\RWLN] 'DllName' = 'RWLN.dll'

Создает следующие сервисы:

[<HKLM>\SYSTEM\ControlSet001\Services\RManService] 'Start' = '00000002'

Вредоносные функции:

Создает и запускает на исполнение:

%PROGRAM_FILES%\Remote Manipulator System - Server\rutserv.exe /start
%PROGRAM_FILES%\Remote Manipulator System - Server\rfusclient.exe /server /start
%PROGRAM_FILES%\Remote Manipulator System - Server\rfusclient.exe /tray
%PROGRAM_FILES%\Remote Manipulator System - Server\rutserv.exe
%PROGRAM_FILES%\Remote Manipulator System - Server\rutserv.exe /silentinstall
%PROGRAM_FILES%\Remote Manipulator System - Server\rfusclient.exe /server /silentinstall
%PROGRAM_FILES%\Remote Manipulator System - Server\rutserv.exe /firewall
%PROGRAM_FILES%\Remote Manipulator System - Server\rfusclient.exe /server /firewall

Запускает на исполнение:

<SYSTEM32>\msiexec.exe /I "rms.server5.1b2ru.msi" /qn
<SYSTEM32>\ping.exe 127.0.0.1
<SYSTEM32>\msiexec.exe -Embedding CE4D034E5651DBA8F1D0C086CEC1B95F
<SYSTEM32>\attrib.exe +r +s +h "%PROGRAM_FILES%\Remote Manipulator System - Server"
<SYSTEM32>\msiexec.exe -Embedding 1B2481F8D70024B2D4293120D0995385 M Global\MSI0000
<SYSTEM32>\chcp.com 1251
<SYSTEM32>\cmd.exe /c ""%TEMP%\install.cmd" "
<SYSTEM32>\msiexec.exe /x {61FFA475-24D5-44FB-A51F-39B699E3D82C} /quiet REBOOT=ReallySuppress
<SYSTEM32>\msiexec.exe /x {11A90858-40BB-4858-A2DA-CA6495B5E907} /quiet REBOOT=ReallySuppress
<SYSTEM32>\msiexec.exe /V

Изменения в файловой системе:

Создает следующие файлы:

%PROGRAM_FILES%\Remote Manipulator System - Server\HookDrv.dll
%PROGRAM_FILES%\Remote Manipulator System - Server\rfusclient.exe
%PROGRAM_FILES%\Remote Manipulator System - Server\msvcp90.dll
%PROGRAM_FILES%\Remote Manipulator System - Server\RIPCServer.dll
%PROGRAM_FILES%\Remote Manipulator System - Server\EULA.rtf
%PROGRAM_FILES%\Remote Manipulator System - Server\msvcr90.dll
%PROGRAM_FILES%\Remote Manipulator System - Server\vp8decoder.dll
%PROGRAM_FILES%\Remote Manipulator System - Server\English.lg
%PROGRAM_FILES%\Remote Manipulator System - Server\rutserv.exe
%PROGRAM_FILES%\Remote Manipulator System - Server\dsfVorbisDecoder.dll
%WINDIR%\Installer\{11A90858-40BB-4858-A2DA-CA6495B5E907}\config_server_066CADD456D84808BDCEE928E4286C5B.exe
%WINDIR%\Installer\{11A90858-40BB-4858-A2DA-CA6495B5E907}\stop_server_F11ADA9A6E8F4FE79139D84A6B091D47.exe
%WINDIR%\Installer\MSI8.tmp
<SYSTEM32>\RWLN.dll
%WINDIR%\Installer\{11A90858-40BB-4858-A2DA-CA6495B5E907}\ROMServer.exe_84521F20C7744F7FAAC4E478858A721D.exe
%WINDIR%\Installer\MSI6.tmp
%PROGRAM_FILES%\Remote Manipulator System - Server\help.chm
%WINDIR%\Installer\{11A90858-40BB-4858-A2DA-CA6495B5E907}\UNINST_Uninstall_R_3B1E3C8B7D0945898DA82CEEED02F0C7.exe
%WINDIR%\Installer\{11A90858-40BB-4858-A2DA-CA6495B5E907}\ARPPRODUCTICON.exe
%PROGRAM_FILES%\Remote Manipulator System - Server\vp8encoder.dll
%TEMP%\rms.server5.1b2ru.msi
%TEMP%\install.cmd
%WINDIR%\Installer\20526.msi
%TEMP%\$inst\0001.tmp
%TEMP%\$inst\temp_0.tmp
%TEMP%\$inst\4.tmp
%TEMP%\$inst\2.tmp
%TEMP%\$inst\7.tmp
%TEMP%\$inst\5.tmp
%PROGRAM_FILES%\Remote Manipulator System - Server\Microsoft.VC90.CRT.manifest
%PROGRAM_FILES%\Remote Manipulator System - Server\RWLN.dll
%PROGRAM_FILES%\Remote Manipulator System - Server\Russian.lg
%PROGRAM_FILES%\Remote Manipulator System - Server\dsfVorbisEncoder.dll
%WINDIR%\Installer\MSI5.tmp
%TEMP%\~3.tmp
%WINDIR%\Installer\MSI2.tmp
C:\Config.Msi\20529.rbs
%WINDIR%\Installer\MSI1.tmp