Trojan.MulDrop5.37220

Техническая информация

Вредоносные функции:

Для обхода брандмауэра удаляет или модифицирует следующие ключи реестра:

[<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%PROGRAM_FILES%\uvnc bvba\UltraVNC\vncviewer.exe' = '%PROGRAM_FILES%\uvnc bvba\UltraVNC\vncviewer.exe:*:Enabled:vncviewer.exe'
[<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%PROGRAM_FILES%\uvnc bvba\UltraVNC\winvnc.exe' = '%PROGRAM_FILES%\uvnc bvba\UltraVNC\winvnc.exe:*:Enabled:winvnc.exe'

Создает и запускает на исполнение:

'%PROGRAM_FILES%\uvnc bvba\UltraVNC\setpasswd.exe'
'%PROGRAM_FILES%\uvnc bvba\UltraVNC\setcad.exe'
'%TEMP%\7zS1.tmp\UltraVNC_1_2_01_X86_Setup.exe' /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-S
'%TEMP%\is-D1CDT.tmp\UltraVNC_1_2_01_X86_Setup.tmp' /SL5="$40092,3095337,349696,%TEMP%\7zS1.tmp\UltraVNC_1_2_01_X86_Setup.exe" /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-S

Запускает на исполнение:

'<SYSTEM32>\netsh.exe' firewall add allowedprogram "%PROGRAM_FILES%\uvnc bvba\UltraVNC\winvnc.exe" "winvnc.exe" ENABLE ALL
'<SYSTEM32>\netsh.exe' firewall add allowedprogram "%PROGRAM_FILES%\uvnc bvba\UltraVNC\vncviewer.exe" "vncviewer.exe" ENABLE ALL
'<SYSTEM32>\netsh.exe' firewall add portopening TCP 5900 vnc5900
'<SYSTEM32>\netsh.exe' firewall add portopening TCP 5800 vnc5800

Изменения в файловой системе:

Создает следующие файлы:

%PROGRAM_FILES%\uvnc bvba\UltraVNC\is-DENR4.tmp
%PROGRAM_FILES%\uvnc bvba\UltraVNC\is-IGJ4U.tmp
%PROGRAM_FILES%\uvnc bvba\UltraVNC\is-E3ETQ.tmp
%PROGRAM_FILES%\uvnc bvba\UltraVNC\is-R73SC.tmp
%PROGRAM_FILES%\uvnc bvba\UltraVNC\is-MIRRP.tmp
%PROGRAM_FILES%\uvnc bvba\UltraVNC\is-N94R9.tmp
%PROGRAM_FILES%\uvnc bvba\UltraVNC\is-ETJVU.tmp
%PROGRAM_FILES%\uvnc bvba\UltraVNC\is-BRHKJ.tmp
%PROGRAM_FILES%\uvnc bvba\UltraVNC\is-H0OD8.tmp
%PROGRAM_FILES%\uvnc bvba\UltraVNC\unins000.msg
%ALLUSERSPROFILE%\Start Menu\Programs\UltraVNC\Edit Settings.lnk
%PROGRAM_FILES%\uvnc bvba\UltraVNC\ultravnc.ini
%PROGRAM_FILES%\uvnc bvba\UltraVNC\unins000.dat
%ALLUSERSPROFILE%\Start Menu\Programs\UltraVNC\UltraVNC Server.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\UltraVNC\UltraVNC Viewer.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\UltraVNC\UltraVNC Viewer\Run UltraVNC Viewer (Listen Mode Encrypt)).lnk
%ALLUSERSPROFILE%\Start Menu\Programs\UltraVNC\UltraVNC Viewer\Run UltraVNC Viewer (Listen Mode).lnk
%PROGRAM_FILES%\uvnc bvba\UltraVNC\is-F81KJ.tmp
%TEMP%\is-U0TI9.tmp\Vista.cjstyles
%PROGRAM_FILES%\uvnc bvba\UltraVNC\is-TP9BS.tmp
%PROGRAM_FILES%\uvnc bvba\UltraVNC\is-5QPDE.tmp
%TEMP%\is-D1CDT.tmp\UltraVNC_1_2_01_X86_Setup.tmp
%TEMP%\7zS1.tmp\UltraVNC_1_2_01_X86_Setup.exe
%TEMP%\is-U0TI9.tmp\isskin.dll
%TEMP%\is-U0TI9.tmp\_isetup\_shfoldr.dll
%PROGRAM_FILES%\uvnc bvba\UltraVNC\is-NVUFB.tmp
%PROGRAM_FILES%\uvnc bvba\UltraVNC\is-NPRAS.tmp
%PROGRAM_FILES%\uvnc bvba\UltraVNC\is-QTJ4G.tmp
%PROGRAM_FILES%\uvnc bvba\UltraVNC\is-40OBD.tmp
%PROGRAM_FILES%\uvnc bvba\UltraVNC\is-63753.tmp
%PROGRAM_FILES%\uvnc bvba\UltraVNC\is-26U1M.tmp
%PROGRAM_FILES%\uvnc bvba\UltraVNC\is-BRAOR.tmp
%PROGRAM_FILES%\uvnc bvba\UltraVNC\is-JAENF.tmp
%PROGRAM_FILES%\uvnc bvba\UltraVNC\is-KFJC3.tmp

Удаляет следующие файлы:

%TEMP%\is-D1CDT.tmp\UltraVNC_1_2_01_X86_Setup.tmp
%TEMP%\7zS1.tmp\UltraVNC_1_2_01_X86_Setup.exe
%TEMP%\is-U0TI9.tmp\_isetup\_shfoldr.dll
%TEMP%\is-U0TI9.tmp\isskin.dll
%TEMP%\is-U0TI9.tmp\Vista.cjstyles

Перемещает следующие файлы:

%PROGRAM_FILES%\uvnc bvba\UltraVNC\is-BRHKJ.tmp в %PROGRAM_FILES%\uvnc bvba\UltraVNC\MSLogonACL.exe
%PROGRAM_FILES%\uvnc bvba\UltraVNC\is-ETJVU.tmp в %PROGRAM_FILES%\uvnc bvba\UltraVNC\vncviewer.exe
%PROGRAM_FILES%\uvnc bvba\UltraVNC\is-MIRRP.tmp в %PROGRAM_FILES%\uvnc bvba\UltraVNC\authSSP.dll
%PROGRAM_FILES%\uvnc bvba\UltraVNC\is-40OBD.tmp в %PROGRAM_FILES%\uvnc bvba\UltraVNC\ldapauthnt4.dll
%PROGRAM_FILES%\uvnc bvba\UltraVNC\is-N94R9.tmp в %PROGRAM_FILES%\uvnc bvba\UltraVNC\ldapauth9x.dll
%PROGRAM_FILES%\uvnc bvba\UltraVNC\is-E3ETQ.tmp в %PROGRAM_FILES%\uvnc bvba\UltraVNC\testauth.exe
%PROGRAM_FILES%\uvnc bvba\UltraVNC\is-H0OD8.tmp в %PROGRAM_FILES%\uvnc bvba\UltraVNC\ultravnc.ini
%PROGRAM_FILES%\uvnc bvba\UltraVNC\is-R73SC.tmp в %PROGRAM_FILES%\uvnc bvba\UltraVNC\uvnc_settings.exe
%PROGRAM_FILES%\uvnc bvba\UltraVNC\is-IGJ4U.tmp в %PROGRAM_FILES%\uvnc bvba\UltraVNC\setcad.exe
%PROGRAM_FILES%\uvnc bvba\UltraVNC\is-DENR4.tmp в %PROGRAM_FILES%\uvnc bvba\UltraVNC\setpasswd.exe
%PROGRAM_FILES%\uvnc bvba\UltraVNC\is-63753.tmp в %PROGRAM_FILES%\uvnc bvba\UltraVNC\ldapauth.dll
%PROGRAM_FILES%\uvnc bvba\UltraVNC\is-NVUFB.tmp в %PROGRAM_FILES%\uvnc bvba\UltraVNC\Readme.txt
%PROGRAM_FILES%\uvnc bvba\UltraVNC\is-BRAOR.tmp в %PROGRAM_FILES%\uvnc bvba\UltraVNC\winvnc.exe
%PROGRAM_FILES%\uvnc bvba\UltraVNC\is-TP9BS.tmp в %PROGRAM_FILES%\uvnc bvba\UltraVNC\Licence.rtf
%PROGRAM_FILES%\uvnc bvba\UltraVNC\is-F81KJ.tmp в %PROGRAM_FILES%\uvnc bvba\UltraVNC\unins000.exe
%PROGRAM_FILES%\uvnc bvba\UltraVNC\is-5QPDE.tmp в %PROGRAM_FILES%\uvnc bvba\UltraVNC\Whatsnew.rtf
%PROGRAM_FILES%\uvnc bvba\UltraVNC\is-QTJ4G.tmp в %PROGRAM_FILES%\uvnc bvba\UltraVNC\authadmin.dll
%PROGRAM_FILES%\uvnc bvba\UltraVNC\is-NPRAS.tmp в %PROGRAM_FILES%\uvnc bvba\UltraVNC\workgrpdomnt4.dll
%PROGRAM_FILES%\uvnc bvba\UltraVNC\is-JAENF.tmp в %PROGRAM_FILES%\uvnc bvba\UltraVNC\logging.dll
%PROGRAM_FILES%\uvnc bvba\UltraVNC\is-26U1M.tmp в %PROGRAM_FILES%\uvnc bvba\UltraVNC\logmessages.dll
%PROGRAM_FILES%\uvnc bvba\UltraVNC\is-KFJC3.tmp в %PROGRAM_FILES%\uvnc bvba\UltraVNC\vnchooks.dll