Техническая информация
Для обеспечения автозапуска и распространения
Устанавливает следующие настройки сервисов
- [<HKLM>\System\CurrentControlSet\Services\RManService] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\RManService] 'ImagePath' = '"%ProgramFiles(x86)%\Remote Utilities - Host\rutserv.exe" -service'
Создает следующие сервисы
- 'RManService' "%ProgramFiles(x86)%\Remote Utilities - Host\rutserv.exe" -service
Изменения в файловой системе
Создает следующие файлы
- %TEMP%\1.docx
- %ProgramFiles(x86)%\remote utilities - host\printer\x64\unidrv_rupd.hlp
- %ProgramFiles(x86)%\remote utilities - host\printer\x64\ntprint.inf
- %ProgramFiles(x86)%\remote utilities - host\printer\x64\rupdui.dll
- %ProgramFiles(x86)%\remote utilities - host\printer\x64\rupd.lng
- %ProgramFiles(x86)%\remote utilities - host\printer\x64\rupd.gpd
- %ProgramFiles(x86)%\remote utilities - host\printer\x64\rupd.ini
- %ProgramFiles(x86)%\remote utilities - host\printer\x64\rupdpm.dll
- %ProgramFiles(x86)%\remote utilities - host\printer\x64\msvcp120.dll
- %ProgramFiles(x86)%\remote utilities - host\printer\x64\unidrvui_rupd.dll
- %ProgramFiles(x86)%\remote utilities - host\printer\x64\msvcr120.dll
- %ProgramFiles(x86)%\remote utilities - host\printer\x64\vccorlib120.dll
- %ProgramFiles(x86)%\remote utilities - host\printer\x86\setupdrv.exe
- %ProgramFiles(x86)%\remote utilities - host\printer\x86\rupdui.dll
- %ProgramFiles(x86)%\remote utilities - host\printer\x86\rupd.lng
- %ProgramFiles(x86)%\remote utilities - host\printer\x86\printer.ico
- %ProgramFiles(x86)%\remote utilities - host\printer\x86\rupd.gpd
- %ProgramFiles(x86)%\remote utilities - host\printer\x86\unidrv_rupd.dll
- %ProgramFiles(x86)%\remote utilities - host\printer\x86\stdnames_vpd.gpd
- %ProgramFiles(x86)%\remote utilities - host\printer\x64\printer.ico
- %ProgramFiles(x86)%\remote utilities - host\printer\common\vpdagent.exe
- %ALLUSERSPROFILE%\remote utilities\msi\70003_{74041cf2-be4f-411b-87d8-1c0faa76d1f1}\host7.0.0.3_unsigned.msi
- %ProgramFiles(x86)%\remote utilities - host\printer\x64\unires_vpd.dll
- %WINDIR%\installer\{74041cf2-be4f-411b-87d8-1c0faa76d1f1}\en_server_start_85db64512c79429fa70ac6c0611579dd.exe
- %WINDIR%\installer\{74041cf2-be4f-411b-87d8-1c0faa76d1f1}\en_server_settings_e3bfc76be38f4cf79d2ed7163b7decee.exe
- %WINDIR%\installer\{74041cf2-be4f-411b-87d8-1c0faa76d1f1}\uninst_uninstall_r_3b1e3c8b7d0945898da82ceeed02f0c7.exe
- %WINDIR%\installer\{74041cf2-be4f-411b-87d8-1c0faa76d1f1}\en_server_stop_b603677802d142c98e7a415b72132e14.exe
- %WINDIR%\installer\{74041cf2-be4f-411b-87d8-1c0faa76d1f1}\arpproducticon.exe
- %ProgramFiles(x86)%\remote utilities - host\printer\common\properties.exe
- %ProgramFiles(x86)%\remote utilities - host\printer\common\rupd.lng
- %ProgramFiles(x86)%\remote utilities - host\printer\common\srvinst.exe
- %ProgramFiles(x86)%\remote utilities - host\printer\x86\unires_vpd.dll
- %ProgramFiles(x86)%\remote utilities - host\printer\common\vpd_sdk.dll
- %ProgramFiles(x86)%\remote utilities - host\printer\common\vpdisp.exe
- %ProgramFiles(x86)%\remote utilities - host\printer\common\messagebox.exe
- %ProgramFiles(x86)%\remote utilities - host\printer\common\printer.ico
- %ProgramFiles(x86)%\remote utilities - host\printer\common\progressbar.exe
- %ProgramFiles(x86)%\remote utilities - host\printer\common\pdfout.dll
- %ProgramFiles(x86)%\remote utilities - host\printer\common\emf2pdf.dll
- %ProgramFiles(x86)%\remote utilities - host\printer\common\fwproc.exe
- %ProgramFiles(x86)%\remote utilities - host\printer\x64\setupdrv.exe
- %ProgramFiles(x86)%\remote utilities - host\printer\x64\stdnames_vpd.gpd
- %ProgramFiles(x86)%\remote utilities - host\printer\x64\unidrv_rupd.dll
- %ProgramFiles(x86)%\remote utilities - host\printer\x86\unidrvui_rupd.dll
- %ProgramFiles(x86)%\remote utilities - host\dutch.lg
- %ProgramFiles(x86)%\remote utilities - host\portuguese, brazilian.lg
- %ProgramFiles(x86)%\remote utilities - host\arabic.lg
- %ProgramFiles(x86)%\remote utilities - host\german.lg
- %ProgramFiles(x86)%\remote utilities - host\french.lg
- %ProgramFiles(x86)%\remote utilities - host\japanese.lg
- %ProgramFiles(x86)%\remote utilities - host\polish.lg
- %ProgramFiles(x86)%\remote utilities - host\turkish.lg
- %ProgramFiles(x86)%\remote utilities - host\hebrew.lg
- %ProgramFiles(x86)%\remote utilities - host\chinese traditional.lg
- %ProgramFiles(x86)%\remote utilities - host\spanish.lg
- %ProgramFiles(x86)%\remote utilities - host\english.lg
- %ProgramFiles(x86)%\remote utilities - host\vp8decoder.dll
- %ProgramFiles(x86)%\remote utilities - host\greek.lg
- %ProgramFiles(x86)%\remote utilities - host\rutserv.exe
- %ProgramFiles(x86)%\remote utilities - host\rfusclient.exe
- %ALLUSERSPROFILE%\remote utilities\install.log
- %TEMP%\rut_{80e20d33-37ca-4bbe-bef5-5f42d982a3a9}\host7.0.0.3_unsigned.msi
- %TEMP%\2.exe
- %ProgramFiles(x86)%\remote utilities - host\eula.rtf
- %ProgramFiles(x86)%\remote utilities - host\webmvorbisencoder.dll
- %ProgramFiles(x86)%\remote utilities - host\printer\x86\rupd.ini
- %ProgramFiles(x86)%\remote utilities - host\italian.lg
- %ProgramFiles(x86)%\remote utilities - host\printer\x86\ntprint.inf
- %ProgramFiles(x86)%\remote utilities - host\printer\x86\rupdpm.dll
- %ProgramFiles(x86)%\remote utilities - host\printer\x86\msvcp120.dll
- %ProgramFiles(x86)%\remote utilities - host\printer\x86\msvcr120.dll
- %ProgramFiles(x86)%\remote utilities - host\printer\x86\vccorlib120.dll
- %ProgramFiles(x86)%\remote utilities - host\eventmsg.dll
- %ProgramFiles(x86)%\remote utilities - host\ssleay32.dll
- %ProgramFiles(x86)%\remote utilities - host\libeay32.dll
- %ProgramFiles(x86)%\remote utilities - host\printer\x86\unidrv_rupd.hlp
- %ProgramFiles(x86)%\remote utilities - host\portuguese.lg
- %ProgramFiles(x86)%\remote utilities - host\webmvorbisdecoder.dll
- %ProgramFiles(x86)%\remote utilities - host\webmmux.dll
- %ProgramFiles(x86)%\remote utilities - host\vp8encoder.dll
- %ProgramFiles(x86)%\remote utilities - host\chinese simplified.lg
- %ProgramFiles(x86)%\remote utilities - host\danish.lg
- %ProgramFiles(x86)%\remote utilities - host\swedish.lg
- %ProgramFiles(x86)%\remote utilities - host\norwegian.lg
- %ProgramFiles(x86)%\remote utilities - host\korean.lg
- %ProgramFiles(x86)%\remote utilities - host\czech.lg
- %ProgramFiles(x86)%\remote utilities - host\logs\rut_log_2021-08.html
Удаляет следующие файлы
- %TEMP%\rut_{80e20d33-37ca-4bbe-bef5-5f42d982a3a9}\host7.0.0.3_unsigned.msi
Сетевая активность
Подключается к
- 'microsoft.com':80
UDP
- DNS ASK microsoft.com
Другое
Ищет следующие окна
- ClassName: 'EDIT' WindowName: ''
Создает и запускает на исполнение
- '%TEMP%\2.exe'
- '%ProgramFiles(x86)%\remote utilities - host\rfusclient.exe' -msi_copy "%TEMP%\RUT_{80E20D33-37CA-4BBE-BEF5-5F42D982A3A9}\host7.0.0.3_unsigned.msi"
- '%ProgramFiles(x86)%\remote utilities - host\rutserv.exe' /silentinstall
- '%ProgramFiles(x86)%\remote utilities - host\rutserv.exe' /firewall
- '%ProgramFiles(x86)%\remote utilities - host\rutserv.exe' /start
- '%ProgramFiles(x86)%\remote utilities - host\rutserv.exe' -service
- '%ProgramFiles(x86)%\remote utilities - host\rfusclient.exe'
- '%ProgramFiles(x86)%\remote utilities - host\rfusclient.exe' /tray
- '%ProgramFiles(x86)%\remote utilities - host\rutserv.exe' -firewall
Запускает на исполнение
- '%ProgramFiles%\microsoft office\office14\winword.exe' /n "%TEMP%\1.docx"
- '%WINDIR%\syswow64\msiexec.exe' /i "%TEMP%\RUT_{80E20D33-37CA-4BBE-BEF5-5F42D982A3A9}\host7.0.0.3_unsigned.msi" /qn
