Trojan.DownLoader11.9333

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\RWLN] 'Startup' = 'WLEventStartup'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\RWLN] 'Logon' = 'WLEventLogon'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\RWLN] 'DllName' = 'RWLN.dll'

Создает следующие сервисы:

[<HKLM>\SYSTEM\ControlSet001\Services\RManService] 'Start' = '00000002'

Вредоносные функции:

Создает и запускает на исполнение:

'%PROGRAM_FILES%\Remote Manipulator System - Server\rfusclient.exe' /server /start
'%PROGRAM_FILES%\Remote Manipulator System - Server\rutserv.exe' /firewall
'%PROGRAM_FILES%\Remote Manipulator System - Server\rutserv.exe' /start
'%PROGRAM_FILES%\Remote Manipulator System - Server\rfusclient.exe' /tray
'%PROGRAM_FILES%\Remote Manipulator System - Server\rutserv.exe'
'%PROGRAM_FILES%\Remote Manipulator System - Server\rfusclient.exe' /server /firewall
'%TEMP%\autorun2.exe'
'%TEMP%\autorun1.exe'
'%TEMP%\installers.exe'
'%PROGRAM_FILES%\Remote Manipulator System - Server\rutserv.exe' /silentinstall
'%PROGRAM_FILES%\Remote Manipulator System - Server\rfusclient.exe' /server /silentinstall

Запускает на исполнение:

'<SYSTEM32>\msiexec.exe' /I "installers.msi" /qn
'<SYSTEM32>\msiexec.exe' /x {11A90858-40BB-4858-A2DA-CA6495B5E907} /qn REBOOT=ReallySuppress
'<SYSTEM32>\msiexec.exe' /V
'<SYSTEM32>\msiexec.exe' -Embedding 897D59C452A1A7DCF7CD27B281D08700
'<SYSTEM32>\attrib.exe' +S +H "\Remote Manipulator System - Server"
'<SYSTEM32>\attrib.exe' +S +H "%PROGRAM_FILES%\Remote Manipulator System - Server"
'<SYSTEM32>\msiexec.exe' -Embedding 7191275C56E9C0039FDFD7FCAA38C0F4 M Global\MSI0000
'<SYSTEM32>\attrib.exe' +S +H %TEMP%\cuploader
'<SYSTEM32>\taskkill.exe' /f /im rfusclient.exe
'<SYSTEM32>\cmd.exe' /c ""%TEMP%\1.tmp\cuploader.cmd" "
'<SYSTEM32>\cmd.exe' /c ""%TEMP%\2.tmp\installers.bat" "
'<SYSTEM32>\ping.exe' -n 5 ya.ru
'<SYSTEM32>\msiexec.exe' /x {61FFA475-24D5-44FB-A51F-39B699E3D82C} /qn REBOOT=ReallySuppress
'<SYSTEM32>\chcp.com' 1251
'<SYSTEM32>\taskkill.exe' /f /im rutserv.exe

Изменения в файловой системе:

Создает следующие файлы:

%PROGRAM_FILES%\Remote Manipulator System - Server\rutserv.exe
%PROGRAM_FILES%\Remote Manipulator System - Server\msvcr90.dll
%PROGRAM_FILES%\Remote Manipulator System - Server\vp8decoder.dll
%PROGRAM_FILES%\Remote Manipulator System - Server\rfusclient.exe
%PROGRAM_FILES%\Remote Manipulator System - Server\EULA.rtf
%PROGRAM_FILES%\Remote Manipulator System - Server\English.lg
%PROGRAM_FILES%\Remote Manipulator System - Server\Microsoft.VC90.CRT.manifest
%PROGRAM_FILES%\Remote Manipulator System - Server\RWLN.dll
%WINDIR%\Installer\MSI7.tmp
%PROGRAM_FILES%\Remote Manipulator System - Server\vp8encoder.dll
%PROGRAM_FILES%\Remote Manipulator System - Server\Russian.lg
%PROGRAM_FILES%\Remote Manipulator System - Server\dsfVorbisEncoder.dll
%PROGRAM_FILES%\Remote Manipulator System - Server\HookDrv.dll
%WINDIR%\Installer\{11A90858-40BB-4858-A2DA-CA6495B5E907}\stop_server_F11ADA9A6E8F4FE79139D84A6B091D47.exe
%WINDIR%\Installer\{11A90858-40BB-4858-A2DA-CA6495B5E907}\ROMServer.exe_84521F20C7744F7FAAC4E478858A721D.exe
%WINDIR%\Installer\{11A90858-40BB-4858-A2DA-CA6495B5E907}\UNINST_Uninstall_R_3B1E3C8B7D0945898DA82CEEED02F0C7.exe
%WINDIR%\Installer\MSIA.tmp
<SYSTEM32>\RWLN.dll
%WINDIR%\Installer\{11A90858-40BB-4858-A2DA-CA6495B5E907}\config_server_066CADD456D84808BDCEE928E4286C5B.exe
%PROGRAM_FILES%\Remote Manipulator System - Server\dsfVorbisDecoder.dll
%PROGRAM_FILES%\Remote Manipulator System - Server\msvcp90.dll
%PROGRAM_FILES%\Remote Manipulator System - Server\RIPCServer.dll
%WINDIR%\Installer\{11A90858-40BB-4858-A2DA-CA6495B5E907}\ARPPRODUCTICON.exe
%WINDIR%\Installer\MSI8.tmp
%PROGRAM_FILES%\Remote Manipulator System - Server\help.chm
%TEMP%\mk-ca-bundle.vbs
%TEMP%\ssleay32.dll
%TEMP%\libidn-11.dll
%TEMP%\libcurl.dll
%TEMP%\upload.exe
%TEMP%\curl.exe
%TEMP%\1.tmp\cuploader.cmd
%TEMP%\autorun2.exe
%TEMP%\autorun1.exe
%TEMP%\installers.msi
%TEMP%\installers.exe
%TEMP%\libeay32.dll
%TEMP%\2.tmp\installers.bat
%WINDIR%\Installer\MSI4.tmp
%WINDIR%\Installer\37909.msi
%TEMP%\cuploader\upload.exe
C:\Config.Msi\3790c.rbs
%WINDIR%\Installer\MSI3.tmp
%TEMP%\~5.tmp
%TEMP%\cuploader\libidn-11.dll
%TEMP%\cuploader\libeay32.dll
%TEMP%\cuploader\libcurl.dll
%TEMP%\cuploader\curl.exe
%TEMP%\cuploader\mk-ca-bundle.vbs
%TEMP%\cuploader\ssleay32.dll