Trojan.Siggen18.27338

Техническая информация

Для обеспечения автозапуска и распространения

Устанавливает следующие настройки сервисов

[<HKLM>\System\CurrentControlSet\Services\RManService] 'Start' = '00000002'
[<HKLM>\System\CurrentControlSet\Services\RManService] 'ImagePath' = '"%ProgramFiles(x86)%\Remote Utilities - Host\rutserv.exe" -service'

Создает следующие сервисы

'RManService' "%ProgramFiles(x86)%\Remote Utilities - Host\rutserv.exe" -service

Изменения в файловой системе

Создает следующие файлы

%TEMP%\rut_{6698bdc1-c86d-4eab-8b44-80a96e9ee9af}\host.msi
%ProgramFiles(x86)%\remote utilities - host\printer\x64\rupd.gpd
%ProgramFiles(x86)%\remote utilities - host\printer\x64\rupd.lng
%ProgramFiles(x86)%\remote utilities - host\printer\x64\rupdui.dll
%ProgramFiles(x86)%\remote utilities - host\printer\x64\ntprint.inf
%ProgramFiles(x86)%\remote utilities - host\printer\x64\unidrv_rupd.hlp
%ProgramFiles(x86)%\remote utilities - host\printer\x64\unidrvui_rupd.dll
%ProgramFiles(x86)%\remote utilities - host\printer\x64\stdnames_vpd.gpd
%ProgramFiles(x86)%\remote utilities - host\printer\x64\unidrv_rupd.dll
%ProgramFiles(x86)%\remote utilities - host\printer\x64\unires_vpd.dll
%ProgramFiles(x86)%\remote utilities - host\printer\x64\setupdrv.exe
%ProgramFiles(x86)%\remote utilities - host\printer\common\fwproc.exe
%ProgramFiles(x86)%\remote utilities - host\printer\common\emf2pdf.dll
%ProgramFiles(x86)%\remote utilities - host\printer\x64\rupdpm.dll
%ProgramFiles(x86)%\remote utilities - host\printer\x64\rupd.ini
%ProgramFiles(x86)%\remote utilities - host\printer\common\pdfout.dll
%ProgramFiles(x86)%\remote utilities - host\printer\common\messagebox.exe
%ProgramFiles(x86)%\remote utilities - host\printer\common\vpdisp.exe
%ProgramFiles(x86)%\remote utilities - host\printer\common\vpdagent.exe
%ProgramFiles(x86)%\remote utilities - host\printer\common\vpd_sdk.dll
%ProgramFiles(x86)%\remote utilities - host\printer\common\srvinst.exe
%ProgramFiles(x86)%\remote utilities - host\printer\common\rupd.lng
%ProgramFiles(x86)%\remote utilities - host\printer\common\properties.exe
%WINDIR%\installer\{7e3624ec-8573-4f17-a6f1-c3b6b7b18506}\arpproducticon.exe
%WINDIR%\installer\{7e3624ec-8573-4f17-a6f1-c3b6b7b18506}\en_server_stop_b603677802d142c98e7a415b72132e14.exe
%WINDIR%\installer\{7e3624ec-8573-4f17-a6f1-c3b6b7b18506}\uninst_uninstall_r_3b1e3c8b7d0945898da82ceeed02f0c7.exe
%WINDIR%\installer\{7e3624ec-8573-4f17-a6f1-c3b6b7b18506}\en_server_settings_e3bfc76be38f4cf79d2ed7163b7decee.exe
%WINDIR%\installer\{7e3624ec-8573-4f17-a6f1-c3b6b7b18506}\en_server_start_85db64512c79429fa70ac6c0611579dd.exe
%ProgramFiles(x86)%\remote utilities - host\printer\common\progressbar.exe
%ProgramFiles(x86)%\remote utilities - host\printer\common\printer.ico
%ProgramFiles(x86)%\remote utilities - host\printer\x64\msvcp120.dll
%ProgramFiles(x86)%\remote utilities - host\printer\x64\msvcr120.dll
%ProgramFiles(x86)%\remote utilities - host\printer\x64\printer.ico
%ProgramFiles(x86)%\remote utilities - host\rutserv.exe
%ProgramFiles(x86)%\remote utilities - host\rfusclient.exe
%ProgramFiles(x86)%\remote utilities - host\eventmsg.dll
%ProgramFiles(x86)%\remote utilities - host\vp8decoder.dll
%ProgramFiles(x86)%\remote utilities - host\eula.rtf
%ProgramFiles(x86)%\remote utilities - host\vp8encoder.dll
%ProgramFiles(x86)%\remote utilities - host\webmmux.dll
%ProgramFiles(x86)%\remote utilities - host\webmvorbisdecoder.dll
%ProgramFiles(x86)%\remote utilities - host\webmvorbisencoder.dll
%ProgramFiles(x86)%\remote utilities - host\libeay32.dll
%ProgramFiles(x86)%\remote utilities - host\ssleay32.dll
%ProgramFiles(x86)%\remote utilities - host\printer\x86\vccorlib120.dll
%ProgramFiles(x86)%\remote utilities - host\printer\x86\msvcr120.dll
%ALLUSERSPROFILE%\remote utilities\install.log
%ProgramFiles(x86)%\remote utilities - host\printer\x86\msvcp120.dll
%ProgramFiles(x86)%\remote utilities - host\printer\x86\ntprint.inf
%ProgramFiles(x86)%\remote utilities - host\printer\x86\rupd.ini
%ProgramFiles(x86)%\remote utilities - host\printer\x86\unidrv_rupd.hlp
%ProgramFiles(x86)%\remote utilities - host\printer\x86\unidrvui_rupd.dll
%ProgramFiles(x86)%\remote utilities - host\printer\x86\unires_vpd.dll
%ProgramFiles(x86)%\remote utilities - host\printer\x86\stdnames_vpd.gpd
%ProgramFiles(x86)%\remote utilities - host\printer\x86\unidrv_rupd.dll
%ProgramFiles(x86)%\remote utilities - host\printer\x86\rupd.gpd
%ProgramFiles(x86)%\remote utilities - host\printer\x86\printer.ico
%ProgramFiles(x86)%\remote utilities - host\printer\x86\rupd.lng
%ProgramFiles(x86)%\remote utilities - host\printer\x86\rupdui.dll
%ProgramFiles(x86)%\remote utilities - host\printer\x86\setupdrv.exe
%ProgramFiles(x86)%\remote utilities - host\printer\x64\vccorlib120.dll
%ProgramFiles(x86)%\remote utilities - host\printer\x86\rupdpm.dll
%ALLUSERSPROFILE%\remote utilities\msi\70120_{7e3624ec-8573-4f17-a6f1-c3b6b7b18506}\host.msi
%ProgramFiles(x86)%\remote utilities - host\logs\rut_log_2022-07.html

Удаляет следующие файлы

%TEMP%\rut_{6698bdc1-c86d-4eab-8b44-80a96e9ee9af}\host.msi

Сетевая активность

Подключается к

'microsoft.com':80
'ma##.##ivateemail.com':587

TCP

Запросы HTTP GET

http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt

Другие

'ma##.##ivateemail.com':587

UDP

DNS ASK microsoft.com
DNS ASK ma##.##ivateemail.com

Другое

Создает и запускает на исполнение

'%ProgramFiles(x86)%\remote utilities - host\rfusclient.exe' -msi_copy "%TEMP%\RUT_{6698BDC1-C86D-4EAB-8B44-80A96E9EE9AF}\host.msi"
'%ProgramFiles(x86)%\remote utilities - host\rutserv.exe' /silentinstall
'%ProgramFiles(x86)%\remote utilities - host\rutserv.exe' /firewall
'%ProgramFiles(x86)%\remote utilities - host\rutserv.exe' /start
'%ProgramFiles(x86)%\remote utilities - host\rutserv.exe' -service
'%ProgramFiles(x86)%\remote utilities - host\rfusclient.exe'
'%ProgramFiles(x86)%\remote utilities - host\rfusclient.exe' /tray

Запускает на исполнение