Trojan.DownLoader8.31029

Техническая информация

Для обеспечения автозапуска и распространения:

Создает следующие сервисы:

[<HKLM>\SYSTEM\ControlSet001\Services\uvnc_service] 'Start' = '00000002'

Вредоносные функции:

Для обхода брандмауэра удаляет или модифицирует следующие ключи реестра:

[<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%PROGRAM_FILES%\UltraVNC\winvnc.exe' = '%PROGRAM_FILES%\UltraVNC\winvnc.exe:*:Enabled:winvnc.exe'

Создает и запускает на исполнение:

%PROGRAM_FILES%\UltraVNC\winvnc.exe -service
%PROGRAM_FILES%\UltraVNC\winvnc.exe -service_run
%PROGRAM_FILES%\UltraVNC\winvnc.exe -servicehelper
%PROGRAM_FILES%\UltraVNC\winvnc.exe -install
%WINDIR%\Temp\UltraVNC_1.0.8.2_Setup.exe /verysilent /loadinf=vnc.inf
%TEMP%\is-V1GT2.tmp\UltraVNC_1.0.8.2_Setup.tmp /SL5="$100EC,1523807,346112,%WINDIR%\Temp\UltraVNC_1.0.8.2_Setup.exe" /verysilent /loadinf=vnc.inf
%TEMP%\is-DC5PH.tmp\check_install.exe silent

Запускает на исполнение:

<SYSTEM32>\netsh.exe firewall add portopening TCP 5800 vnc5800
<SYSTEM32>\netsh.exe firewall add allowedprogram "%PROGRAM_FILES%\UltraVNC\winvnc.exe" "winvnc.exe" ENABLE ALL
<SYSTEM32>\net1.exe start WinVNC
<SYSTEM32>\netsh.exe firewall add portopening protocol=TCP port=5900 name=UltraVNC interface="local area connection"
<SYSTEM32>\net1.exe start "uvnc_service"
<SYSTEM32>\netsh.exe firewall add portopening TCP 5900 vnc5900

Изменения в файловой системе:

Создает следующие файлы:

%PROGRAM_FILES%\UltraVNC\is-VG1MQ.tmp
%PROGRAM_FILES%\UltraVNC\is-DGN7H.tmp
%PROGRAM_FILES%\UltraVNC\is-SNOGG.tmp
%PROGRAM_FILES%\UltraVNC\is-4K9BM.tmp
%PROGRAM_FILES%\UltraVNC\is-3AUJ5.tmp
%PROGRAM_FILES%\UltraVNC\is-MSKTA.tmp
%PROGRAM_FILES%\UltraVNC\is-C8CMO.tmp
%PROGRAM_FILES%\UltraVNC\is-J625K.tmp
%PROGRAM_FILES%\UltraVNC\is-4F4VM.tmp
%PROGRAM_FILES%\UltraVNC\is-L13EA.tmp
%PROGRAM_FILES%\UltraVNC\is-EJOCI.tmp
%PROGRAM_FILES%\UltraVNC\is-O54UM.tmp
%ALLUSERSPROFILE%\Start Menu\Programs\UltraVNC\Edit Settings.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\UltraVNC\UltraVNC Server\Stop WinVNC Service.lnk
%PROGRAM_FILES%\UltraVNC\unins000.dat
%PROGRAM_FILES%\UltraVNC\ultravnc.ini
%PROGRAM_FILES%\UltraVNC\rc4.key
%ALLUSERSPROFILE%\Start Menu\Programs\UltraVNC\UltraVNC Server\Start WinVNC Service.lnk
%PROGRAM_FILES%\UltraVNC\is-OQTE0.tmp
%PROGRAM_FILES%\UltraVNC\is-T4JMS.tmp
%ALLUSERSPROFILE%\Start Menu\Programs\UltraVNC\UltraVNC Server.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\UltraVNC\UltraVNC Server\Remove WinVNC Service.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\UltraVNC\UltraVNC Server\Install WinVNC Service.lnk
%WINDIR%\Temp\rc4.key
%TEMP%\aut4.tmp
%TEMP%\aut5.tmp
%TEMP%\is-V1GT2.tmp\UltraVNC_1.0.8.2_Setup.tmp
%WINDIR%\Temp\ultravnc.ini
%WINDIR%\Temp\vnc.inf
%WINDIR%\Temp\tsi-logo.JPG
%TEMP%\aut1.tmp
%TEMP%\aut2.tmp
%TEMP%\aut3.tmp
%WINDIR%\Temp\UltraVNC_1.0.8.2_Setup.exe
%TEMP%\is-DC5PH.tmp\_isetup\_RegDLL.tmp
%PROGRAM_FILES%\UltraVNC\is-KLTVJ.tmp
%PROGRAM_FILES%\UltraVNC\is-G7N61.tmp
%PROGRAM_FILES%\UltraVNC\is-TBSDM.tmp
%PROGRAM_FILES%\UltraVNC\is-CLA48.tmp
%PROGRAM_FILES%\UltraVNC\is-JQARD.tmp
%PROGRAM_FILES%\UltraVNC\is-LLDLV.tmp
%TEMP%\is-DC5PH.tmp\isxdl.dll
%TEMP%\is-DC5PH.tmp\_isetup\_shfoldr.dll
%TEMP%\is-DC5PH.tmp\UltraVNC.ico
%TEMP%\is-DC5PH.tmp\check_install.exe
%PROGRAM_FILES%\UltraVNC\is-DLMKD.tmp

Удаляет следующие файлы:

%TEMP%\is-DC5PH.tmp\_isetup\_shfoldr.dll
%TEMP%\is-V1GT2.tmp\UltraVNC_1.0.8.2_Setup.tmp
%TEMP%\is-DC5PH.tmp\UltraVNC.ico
%TEMP%\is-DC5PH.tmp\_isetup\_RegDLL.tmp
%WINDIR%\Temp\vnc.inf
%WINDIR%\Temp\UltraVNC_1.0.8.2_Setup.exe
%WINDIR%\Temp\tsi-logo.JPG
%WINDIR%\Temp\rc4.key
%WINDIR%\Temp\ultravnc.ini
%TEMP%\aut3.tmp
%TEMP%\aut4.tmp
%TEMP%\aut1.tmp
%TEMP%\aut2.tmp
%TEMP%\aut5.tmp
%TEMP%\is-DC5PH.tmp\check_install.exe
%TEMP%\is-DC5PH.tmp\isxdl.dll
%PROGRAM_FILES%\UltraVNC\Whatsnew.txt
%PROGRAM_FILES%\UltraVNC\Licence.txt

Перемещает следующие файлы:

%PROGRAM_FILES%\UltraVNC\is-VG1MQ.tmp в %PROGRAM_FILES%\UltraVNC\MSRC4Plugin.dsm
%PROGRAM_FILES%\UltraVNC\is-SNOGG.tmp в %PROGRAM_FILES%\UltraVNC\Whatsnew.txt
%PROGRAM_FILES%\UltraVNC\is-DGN7H.tmp в %PROGRAM_FILES%\UltraVNC\MSLogonACL.exe
%PROGRAM_FILES%\UltraVNC\is-L13EA.tmp в %PROGRAM_FILES%\UltraVNC\ldapauth.dll
%PROGRAM_FILES%\UltraVNC\is-MSKTA.tmp в %PROGRAM_FILES%\UltraVNC\authSSP.dll
%PROGRAM_FILES%\UltraVNC\is-T4JMS.tmp в %PROGRAM_FILES%\UltraVNC\SecureVNCPluginARC4.dsm
%PROGRAM_FILES%\UltraVNC\is-OQTE0.tmp в %PROGRAM_FILES%\UltraVNC\uvnc_settings.exe
%PROGRAM_FILES%\UltraVNC\is-O54UM.tmp в %PROGRAM_FILES%\UltraVNC\SecureVNCPlugin.dsm
%PROGRAM_FILES%\UltraVNC\is-3AUJ5.tmp в %PROGRAM_FILES%\UltraVNC\Licence.txt
%PROGRAM_FILES%\UltraVNC\is-4K9BM.tmp в %PROGRAM_FILES%\UltraVNC\Readme_dsm.txt
%PROGRAM_FILES%\UltraVNC\is-EJOCI.tmp в %PROGRAM_FILES%\UltraVNC\workgrpdomnt4.dll
%PROGRAM_FILES%\UltraVNC\is-KLTVJ.tmp в %PROGRAM_FILES%\UltraVNC\Licence.txt
%PROGRAM_FILES%\UltraVNC\is-TBSDM.tmp в %PROGRAM_FILES%\UltraVNC\Readme.txt
%PROGRAM_FILES%\UltraVNC\is-G7N61.tmp в %PROGRAM_FILES%\UltraVNC\Whatsnew.txt
%PROGRAM_FILES%\UltraVNC\is-DLMKD.tmp в %PROGRAM_FILES%\UltraVNC\unins000.exe
%PROGRAM_FILES%\UltraVNC\is-LLDLV.tmp в %PROGRAM_FILES%\UltraVNC\check_install.exe
%PROGRAM_FILES%\UltraVNC\is-C8CMO.tmp в %PROGRAM_FILES%\UltraVNC\logging.dll
%PROGRAM_FILES%\UltraVNC\is-4F4VM.tmp в %PROGRAM_FILES%\UltraVNC\authadmin.dll
%PROGRAM_FILES%\UltraVNC\is-J625K.tmp в %PROGRAM_FILES%\UltraVNC\vnchooks.dll
%PROGRAM_FILES%\UltraVNC\is-JQARD.tmp в %PROGRAM_FILES%\UltraVNC\winvnc.exe
%PROGRAM_FILES%\UltraVNC\is-CLA48.tmp в %PROGRAM_FILES%\UltraVNC\logmessages.dll