Trojan.DownLoader9.45681

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\RWLN] 'Startup' = 'WLEventStartup'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\RWLN] 'Logon' = 'WLEventLogon'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\RWLN] 'DllName' = 'RWLN.dll'

Создает следующие сервисы:

[<HKLM>\SYSTEM\ControlSet001\Services\RManService] 'Start' = '00000002'

Вредоносные функции:

Создает и запускает на исполнение:

'%PROGRAM_FILES%\Remote Manipulator System - Server\rutserv.exe' /start
'%PROGRAM_FILES%\Remote Manipulator System - Server\rfusclient.exe' /server /start
'%PROGRAM_FILES%\Remote Manipulator System - Server\rfusclient.exe' /tray
'%PROGRAM_FILES%\Remote Manipulator System - Server\rutserv.exe'
'%PROGRAM_FILES%\Remote Manipulator System - Server\rutserv.exe' /firewall
'%PROGRAM_FILES%\Remote Manipulator System - Server\rfusclient.exe' /server /silentinstall
'<SYSTEM32>\sysfiles\VkontakteRatingMaster.exe'
'%PROGRAM_FILES%\Remote Manipulator System - Server\rfusclient.exe' /server /firewall
'%PROGRAM_FILES%\Remote Manipulator System - Server\rutserv.exe' /silentinstall

Запускает на исполнение:

'<SYSTEM32>\msiexec.exe' /x {AB7AA605-500F-4153-8207-FB5563419112} /qn REBOOT=ReallySuppress
'<SYSTEM32>\msiexec.exe' /V
'<SYSTEM32>\msiexec.exe' /x {61FFA475-24D5-44FB-A51F-39B699E3D82C} /qn REBOOT=ReallySuppress
'<SYSTEM32>\msiexec.exe' -Embedding 22A85D2E8927D9C1C1C4517CD02C7FB7
'<SYSTEM32>\msiexec.exe' /I "rms.server5.2ru_final2.msi" /qn
'<SYSTEM32>\ping.exe' 127.0.0.1
'<SYSTEM32>\cmd.exe' /c ""%TEMP%\7ZSfx000.cmd" "
'<SYSTEM32>\cmd.exe' /c ""%TEMP%\install.bat" "
'<SYSTEM32>\wscript.exe' "%TEMP%\stop.js"
'<SYSTEM32>\chcp.com' 1251
'<SYSTEM32>\cmd.exe' /c ""%TEMP%\7ZipSfx.000\install.cmd" "
'<SYSTEM32>\attrib.exe' +s +h +r "%WINDIR%/system32/sysfiles/VkontakteRatingMaster.exe"

Изменения в файловой системе:

Создает следующие файлы:

%PROGRAM_FILES%\Remote Manipulator System - Server\ripcserver.dll
%PROGRAM_FILES%\Remote Manipulator System - Server\rfusclient.exe
%PROGRAM_FILES%\Remote Manipulator System - Server\rutserv.exe
%PROGRAM_FILES%\Remote Manipulator System - Server\russian.lg
%PROGRAM_FILES%\Remote Manipulator System - Server\msvcr90.dll
%PROGRAM_FILES%\Remote Manipulator System - Server\msvcp90.dll
%PROGRAM_FILES%\Remote Manipulator System - Server\rasadhlp.dll
%PROGRAM_FILES%\Remote Manipulator System - Server\oledlg.dll
%PROGRAM_FILES%\Remote Manipulator System - Server\rwln.dll
%WINDIR%\Installer\{AB7AA605-500F-4153-8207-FB5563419112}\server_config_C8E9A92497A149D695F92E4E3AE550F0.exe
%WINDIR%\Installer\{AB7AA605-500F-4153-8207-FB5563419112}\server_stop_27D7873393984316BEA10FB36BB4D2F9.exe
<SYSTEM32>\RWLN.dll
%WINDIR%\Installer\{AB7AA605-500F-4153-8207-FB5563419112}\server_start_C00864331B9D4391A8A26292A601EBE2.exe
%PROGRAM_FILES%\Remote Manipulator System - Server\vp8encoder.dll
%PROGRAM_FILES%\Remote Manipulator System - Server\vp8decoder.dll
%WINDIR%\Installer\{AB7AA605-500F-4153-8207-FB5563419112}\UNINST_Uninstall_R_3B1E3C8B7D0945898DA82CEEED02F0C7.exe
%WINDIR%\Installer\{AB7AA605-500F-4153-8207-FB5563419112}\ARPPRODUCTICON.exe
%PROGRAM_FILES%\Remote Manipulator System - Server\microsoft.vc90.crt.manifest
%TEMP%\7ZipSfx.000\rms.server5.2ru_final2.msi
<SYSTEM32>\sysfiles\VkontakteRatingMaster.exe
%WINDIR%\Installer\1fd37.msi
%TEMP%\7ZipSfx.000\install.cmd
%TEMP%\install.bat
%TEMP%\stop.js
%TEMP%\7ZSfx000.cmd
%TEMP%\VkontakteRatingMaster.exe
%WINDIR%\Installer\MSI1.tmp
%PROGRAM_FILES%\Remote Manipulator System - Server\english.lg
%PROGRAM_FILES%\Remote Manipulator System - Server\dsfvorbisencoder.dll
%PROGRAM_FILES%\Remote Manipulator System - Server\gdiplus.dll
%PROGRAM_FILES%\Remote Manipulator System - Server\eula.rtf
%WINDIR%\Installer\MSI2.tmp
%PROGRAM_FILES%\Remote Manipulator System - Server\dsfvorbisdecoder.dll
C:\Config.Msi\1fd3a.rbs