Техническая информация
Для обеспечения автозапуска и распространения:
Создает или изменяет следующие файлы:
- %ALLUSERSPROFILE%\Start Menu\Programs\Startup\RZHelper.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\Startup\RemoteZilla.lnk
Вредоносные функции:
Для обхода брандмауэра удаляет или модифицирует следующие ключи реестра:
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%PROGRAM_FILES%\RZ2.2.0201212031412\RemoteZilla.exe' = '%PROGRAM_FILES%\RZ2.2.0201212031412\RemoteZilla.exe:*:Enabled:RemoteZilla-Server'
Для затруднения выявления своего присутствия в системе
блокирует отображение:
- скрытых файлов
Создает и запускает на исполнение:
- %TEMP%\nso11.tmp\ns20.tmp "netsh.exe" firewall delete allowedprogram "%PROGRAM_FILES%\RZ2.2.0201212031412\RemoteZilla.exe" CURRENT
- %TEMP%\nso11.tmp\ns1F.tmp "netsh.exe" firewall delete allowedprogram "%PROGRAM_FILES%\RZ2.2.0201212031412\RemoteZilla.exe" ALL
- %TEMP%\nso11.tmp\ns22.tmp cmd.exe /C del /P /Q "\RZ.txt"
- %TEMP%\nso11.tmp\ns21.tmp REG.EXE DELETE "HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\RemoteZilla-Server" /f
- %TEMP%\nso11.tmp\ns1E.tmp REG.EXE DELETE "HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\RZ_Service" /f
- %TEMP%\nso11.tmp\ns1B.tmp REG.EXE DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RZHelper" /f
- %TEMP%\nso11.tmp\ns1A.tmp REG.EXE DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RZExe" /f
- %TEMP%\nso11.tmp\ns1D.tmp REG.EXE DELETE "HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\RZ_Service\Enum" /f
- %TEMP%\nso11.tmp\ns1C.tmp REG.EXE DELETE "HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\RZ_Service\Security" /f
- %TEMP%\nso11.tmp\ns23.tmp cmd.exe /C RMDIR /S /Q "%TEMP%\RZTmp1"
- %TEMP%\nso11.tmp\ns2A.tmp cmd.exe /C RMDIR /S /Q "%TEMP%\RZTmp2"
- %TEMP%\nso11.tmp\ns29.tmp cmd.exe /C RMDIR /S /Q "%TEMP%\RZTmp1"
- %TEMP%\nso11.tmp\ns2C.tmp cmd.exe /C RMDIR /S /Q ""
- %TEMP%\nso11.tmp\ns2B.tmp cmd.exe /C RMDIR /S /Q "%PROGRAM_FILES%\RZ2.2.0201212031412"
- %TEMP%\nso11.tmp\ns28.tmp cmd.exe /C del /P /Q "\RZ.txt"
- %TEMP%\nso11.tmp\ns25.tmp cmd.exe /C RMDIR /S /Q ""
- %TEMP%\nso11.tmp\ns24.tmp cmd.exe /C RMDIR /S /Q "%TEMP%\RZTmp2"
- %TEMP%\nso11.tmp\ns27.tmp regedit.exe /s "%TEMP%\StopRZ.reg"
- %TEMP%\nso11.tmp\ns26.tmp regedit.exe /s "%PROGRAM_FILES%\RZ2.2.0201212031412\StopRZ.reg"
- %TEMP%\nsw6.tmp\nsC.tmp "netsh.exe" firewall add allowedprogram "%PROGRAM_FILES%\RZ2.2.0201212031412\RemoteZilla.exe" "RemoteZilla-Server" ENABLE
- %TEMP%\nsw6.tmp\nsB.tmp "netsh.exe" firewall add allowedprogram "%PROGRAM_FILES%\RZ2.2.0201212031412\RemoteZilla.exe" "RemoteZilla-Server" ENABLE ALL
- %PROGRAM_FILES%\RZ2.2.0201212031412\RemoteZilla.exe
- %PROGRAM_FILES%\RZ2.2.0201212031412\RZHelper.exe
- %TEMP%\nsw6.tmp\nsA.tmp "%PROGRAM_FILES%\RZ2.2.0201212031412\Uninst.exe"
- %TEMP%\nsw6.tmp\ns7.tmp "sc.exe" delete RZ_Service
- %TEMP%\nsy3.tmp\RZ_65.46.14.186_5500.exe /303077472031067835296_Nettech Computers, Inc./0
- %TEMP%\nsw6.tmp\ns9.tmp ""
- %TEMP%\nsw6.tmp\ns8.tmp "net.exe" stop RZ_Service
- %PROGRAM_FILES%\RZ2.2.0201212031412\Uninst.exe
- %TEMP%\nso11.tmp\ns17.tmp "taskkill.exe" /F /IM RemoteZilla.exe /T
- %TEMP%\nso11.tmp\ns16.tmp "tskill.exe" RemoteZilla
- %TEMP%\nso11.tmp\ns19.tmp REG.EXE DELETE "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\RZ-ShowSuperHidden" /f
- %TEMP%\nso11.tmp\ns18.tmp REG.EXE DELETE "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\RZ-Hidden" /f
- %TEMP%\nso11.tmp\ns15.tmp "taskkill.exe" /F /IM RZHelper.exe /T
- %TEMP%\nso11.tmp\ns12.tmp "sc.exe" delete RZ_Service
- %TEMP%\A~ADVANTIGu_.exe _?=%PROGRAM_FILES%\RZ2.2.0201212031412\
- %TEMP%\nso11.tmp\ns14.tmp "tskill.exe" RZHelper
- %TEMP%\nso11.tmp\ns13.tmp "net.exe" stop RZ_Service
Запускает на исполнение:
- <SYSTEM32>\reg.exe DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RZHelper" /f
- <SYSTEM32>\reg.exe DELETE "HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\RZ_Service\Security" /f
- <SYSTEM32>\reg.exe DELETE "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\RZ-ShowSuperHidden" /f
- <SYSTEM32>\reg.exe DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RZExe" /f
- <SYSTEM32>\reg.exe DELETE "HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\RZ_Service\Enum" /f
- %WINDIR%\regedit.exe /s "%PROGRAM_FILES%\RZ2.2.0201212031412\StopRZ.reg"
- %WINDIR%\regedit.exe /s "%TEMP%\StopRZ.reg"
- <SYSTEM32>\reg.exe DELETE "HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\RZ_Service" /f
- <SYSTEM32>\reg.exe DELETE "HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\RemoteZilla-Server" /f
- <SYSTEM32>\reg.exe DELETE "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\RZ-Hidden" /f
- <SYSTEM32>\net1.exe stop RZ_Service
- <SYSTEM32>\netsh.exe firewall add allowedprogram "%PROGRAM_FILES%\RZ2.2.0201212031412\RemoteZilla.exe" "RemoteZilla-Server" ENABLE ALL
- <SYSTEM32>\sc.exe delete RZ_Service
- <SYSTEM32>\net.exe stop RZ_Service
- <SYSTEM32>\netsh.exe firewall add allowedprogram "%PROGRAM_FILES%\RZ2.2.0201212031412\RemoteZilla.exe" "RemoteZilla-Server" ENABLE
- <SYSTEM32>\tskill.exe RemoteZilla
- <SYSTEM32>\taskkill.exe /F /IM RemoteZilla.exe /T
- <SYSTEM32>\tskill.exe RZHelper
- <SYSTEM32>\taskkill.exe /F /IM RZHelper.exe /T
Изменения в файловой системе:
Создает следующие файлы:
- %TEMP%\nso11.tmp\ns17.tmp
- %TEMP%\nso11.tmp\ns18.tmp
- %TEMP%\nso11.tmp\ns15.tmp
- %TEMP%\nso11.tmp\ns16.tmp
- %TEMP%\nso11.tmp\ns1B.tmp
- %TEMP%\nso11.tmp\ns1C.tmp
- %TEMP%\nso11.tmp\ns19.tmp
- %TEMP%\nso11.tmp\ns1A.tmp
- %TEMP%\nso11.tmp\ns14.tmp
- %TEMP%\A~ADVANTIGu_.exe
- %TEMP%\nsl10.tmp
- %TEMP%\31067835296.txt
- %TEMP%\nskE.tmp
- %TEMP%\nso11.tmp\ns12.tmp
- %TEMP%\nso11.tmp\ns13.tmp
- C:\RZ.txt
- %TEMP%\nso11.tmp\nsExec.dll
- %TEMP%\nso11.tmp\ns27.tmp
- %TEMP%\nso11.tmp\ns28.tmp
- %TEMP%\StopRZ.reg
- %TEMP%\nso11.tmp\ns26.tmp
- %TEMP%\nso11.tmp\ns2B.tmp
- %TEMP%\nso11.tmp\ns2C.tmp
- %TEMP%\nso11.tmp\ns29.tmp
- %TEMP%\nso11.tmp\ns2A.tmp
- %TEMP%\nso11.tmp\ns25.tmp
- %TEMP%\nso11.tmp\ns1F.tmp
- %TEMP%\nso11.tmp\ns20.tmp
- %TEMP%\nso11.tmp\ns1D.tmp
- %TEMP%\nso11.tmp\ns1E.tmp
- %TEMP%\nso11.tmp\ns23.tmp
- %TEMP%\nso11.tmp\ns24.tmp
- %TEMP%\nso11.tmp\ns21.tmp
- %TEMP%\nso11.tmp\ns22.tmp
- %TEMP%\nsisdt.dll
- %PROGRAM_FILES%\RZ2.2.0201212031412\Advantig.txt
- %TEMP%\nsg5.tmp
- %TEMP%\nsw6.tmp\Splash.dll
- %TEMP%\nsw6.tmp\nsExec.dll
- %TEMP%\nsw6.tmp\ns7.tmp
- %HOMEPATH%\Start Menu\Programs\Administrative Tools\desktop.ini
- %HOMEPATH%\My Documents\My Videos\Desktop.ini
- <SYSTEM32>\wbem\Performance\WmiApRpl_new.ini
- %TEMP%\nsy3.tmp\rzHelper.exe
- %TEMP%\nsy3.tmp\RZ.txt
- %TEMP%\nsi2.tmp
- %TEMP%\nsy3.tmp\RZ_65.46.14.186_5500.exe
- %TEMP%\nsy3.tmp\Blank.bmp
- %TEMP%\nsy3.tmp\Ring.wav
- %TEMP%\nsy3.tmp\Icon1.ico
- %TEMP%\nsy3.tmp\Icon2.ico
- %HOMEPATH%\Desktop\Stop Remote Support.lnk
- %HOMEPATH%\Desktop\ToolBox 2.2.0.0.lnk
- %PROGRAM_FILES%\RZ2.2.0201212031412\StopRZ.reg
- %PROGRAM_FILES%\RZ2.2.0201212031412\Uninst.exe
- %PROGRAM_FILES%\RZ2.2.0201212031412\RZ.txt
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\31067835296[1].txt
- %PROGRAM_FILES%\RZ2.2.0201212031412\ToolBox\RZHelper.lnk
- %PROGRAM_FILES%\RZ2.2.0201212031412\ToolBox\RemoteZilla.lnk
- %TEMP%\nsw6.tmp\nsC.tmp
- %TEMP%\nsw6.tmp\nsA.tmp
- %TEMP%\nsw6.tmp\RemoteZilla.exe
- %TEMP%\nsw6.tmp\ns8.tmp
- %TEMP%\nsw6.tmp\ns9.tmp
- %TEMP%\nsy3.tmp\ToolBox\RZ2.2.0.txt
- %TEMP%\nsw6.tmp\nsB.tmp
- %TEMP%\nsw6.tmp\cad.exe
- %TEMP%\nsy3.tmp\Configs\RZ2.2.0.txt
Присваивает атрибут 'скрытый' для следующих файлов:
- %HOMEPATH%\My Documents\My Videos\Desktop.ini
Удаляет следующие файлы:
- C:\RZ.txt
- %PROGRAM_FILES%\RZ2.2.0201212031412\RZ.txt
- %PROGRAM_FILES%\RZ2.2.0201212031412\RZHelper.exe
- %PROGRAM_FILES%\RZ2.2.0201212031412\RemoteZilla.exe
- %PROGRAM_FILES%\RZ2.2.0201212031412\Uninst.exe
- %PROGRAM_FILES%\RZ2.2.0201212031412\ToolBox\RZHelper.lnk
- %PROGRAM_FILES%\RZ2.2.0201212031412\ToolBox\RemoteZilla.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\Startup\RemoteZilla.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\Startup\RZHelper.lnk
- %TEMP%\nso11.tmp\ns21.tmp
- %PROGRAM_FILES%\RZ2.2.0201212031412\icon1.ico
- %PROGRAM_FILES%\RZ2.2.0201212031412\Ring.wav
- %PROGRAM_FILES%\RZ2.2.0201212031412\Blank.bmp
- %PROGRAM_FILES%\RZ2.2.0201212031412\icon2.ico
- %TEMP%\nso11.tmp\ns29.tmp
- %TEMP%\nso11.tmp\ns28.tmp
- %TEMP%\StopRZ.reg
- %TEMP%\nso11.tmp\ns2A.tmp
- %TEMP%\nso11.tmp\nsExec.dll
- %TEMP%\nso11.tmp\ns2C.tmp
- %TEMP%\nso11.tmp\ns2B.tmp
- %TEMP%\nso11.tmp\ns24.tmp
- %TEMP%\nso11.tmp\ns23.tmp
- %TEMP%\nso11.tmp\ns22.tmp
- %TEMP%\nso11.tmp\ns25.tmp
- %TEMP%\nso11.tmp\ns27.tmp
- %PROGRAM_FILES%\RZ2.2.0201212031412\StopRZ.reg
- %TEMP%\nso11.tmp\ns26.tmp
- %TEMP%\nso11.tmp\ns20.tmp
- %TEMP%\nsw6.tmp\nsExec.dll
- %TEMP%\nsw6.tmp\cad.exe
- %TEMP%\nsw6.tmp\nsC.tmp
- %TEMP%\nsw6.tmp\Splash.dll
- %HOMEPATH%\Desktop\ToolBox 2.2.0.0.lnk
- %HOMEPATH%\Desktop\Stop Remote Support.lnk
- %TEMP%\nsy3.tmp\RZ_65.46.14.186_5500.exe
- %TEMP%\nsw6.tmp\ns7.tmp
- %PROGRAM_FILES%\RZ2.2.0201212031412\Advantig.txt
- %TEMP%\nsisdt.dll
- %TEMP%\nsw6.tmp\ns8.tmp
- %TEMP%\nsw6.tmp\nsB.tmp
- %TEMP%\nsw6.tmp\nsA.tmp
- %TEMP%\nsw6.tmp\ns9.tmp
- %TEMP%\nso11.tmp\ns1B.tmp
- %TEMP%\nso11.tmp\ns1A.tmp
- %TEMP%\nso11.tmp\ns19.tmp
- %TEMP%\nso11.tmp\ns1C.tmp
- %TEMP%\nso11.tmp\ns1F.tmp
- %TEMP%\nso11.tmp\ns1E.tmp
- %TEMP%\nso11.tmp\ns1D.tmp
- %TEMP%\nso11.tmp\ns14.tmp
- %TEMP%\nso11.tmp\ns13.tmp
- %TEMP%\nso11.tmp\ns12.tmp
- %TEMP%\nso11.tmp\ns15.tmp
- %TEMP%\nso11.tmp\ns18.tmp
- %TEMP%\nso11.tmp\ns17.tmp
- %TEMP%\nso11.tmp\ns16.tmp
Перемещает следующие файлы:
- %TEMP%\nsy3.tmp\RZ.txt в %PROGRAM_FILES%\RZ2.2.0201212031412\RZ.txt
- %TEMP%\nsy3.tmp\rzHelper.exe в %PROGRAM_FILES%\RZ2.2.0201212031412\RZHelper.exe
- %TEMP%\nsw6.tmp\RemoteZilla.exe в %PROGRAM_FILES%\RZ2.2.0201212031412\RemoteZilla.exe
- %TEMP%\nsy3.tmp\Ring.wav в %PROGRAM_FILES%\RZ2.2.0201212031412\Ring.wav
- %TEMP%\nsy3.tmp\Icon1.ico в %PROGRAM_FILES%\RZ2.2.0201212031412\icon1.ico
- %TEMP%\nsy3.tmp\Icon2.ico в %PROGRAM_FILES%\RZ2.2.0201212031412\icon2.ico
- %TEMP%\nsy3.tmp\Blank.bmp в %PROGRAM_FILES%\RZ2.2.0201212031412\Blank.bmp
Сетевая активность:
Подключается к:
- '65.##.14.186':5500
- 'www.re###ezilla.com':80
- 'localhost':1039
TCP:
Запросы HTTP GET:
- www.re###ezilla.com/unreg/31067835296.txt
UDP:
- DNS ASK www.re###ezilla.com
Другое:
Ищет следующие окна:
- ClassName: 'RemoteZilla Tray Icon' WindowName: ''
- ClassName: '' WindowName: ''
- ClassName: 'RegEdit_RegEdit' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'RemoteZilla desktop sink' WindowName: ''
- ClassName: '#32770' WindowName: ''
- ClassName: 'SysListView32' WindowName: ''
