Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\GoToAssist Express Customer] 'Startup' = 'Startup'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\GoToAssist Express Customer] 'Logon' = 'Logon'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\GoToAssist Express Customer] 'DLLName' = '%ProgramFiles%\Citrix\GoToAssist Remote Support Customer\948\g2ax_winlogon.dll'
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\GoToAssist Remote Support Customer] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\GoToAssist Remote Support Customer] 'ImagePath' = '"%ProgramFiles%\Citrix\GoToAssist Remote Support Customer\948\g2ax_service.exe" "Start=service"'
Вредоносные функции:
Запускает на исполнение:
- '%ProgramFiles%\Citrix\GoToAssist Remote Support Customer\948\g2ax_service.exe' "Start=service"
- '%ProgramFiles%\Citrix\GoToAssist Remote Support Customer\948\g2ax_service.exe' "Start=start_session&Action=SetupUnattendedSilent&EGWAddress=216.115.218.197&EGWDNS=egw1.express.gotoassist.com&EGWPort=8200,80,443&LogPath=%TEMP%\CitrixLogs\GoToAssist Remote Support\948\20160...
- '%ProgramFiles%\Citrix\GoToAssist Remote Support Customer\948\g2ax_comm_customer.exe' "Action=SetupUnattendedSilent&EGWAddress=216.115.218.197&EGWDNS=egw1.express.gotoassist.com&EGWPort=8200,80,443&LogName=%TEMP%\CitrixLogs\GoToAssist Remote Support\948\20160902_034122\GoToAssis...
- '%ProgramFiles%\Citrix\GoToAssist Remote Support Customer\948\g2ax_user_customer.exe' "StartID={45CB397D-781F-4B69-955E-7EB5F5BDC348}&ResourceDll=g2ax_customer_resource_win32_x86_en_US.dll&RunningAsService=YES&Debug=Off&Stat=On&StatDb=On&Index=0"
- '%ProgramFiles%\Citrix\GoToAssist Remote Support Customer\948\g2ax_system_customer.exe' "StartID={24696E72-0660-4FAF-A387-C7EBA8A11939}&ResourceDll=g2ax_customer_resource_win32_x86_en_US.dll&RunningAsService=YES&Debug=Off&Stat=On&StatDb=On&Index=0"
- '%ProgramFiles%\Citrix\GoToAssist Remote Support Customer\948\g2ax_service.exe' "Start=install_manual&Action=SetupUnattendedSilent&EGWAddress=216.115.218.197&EGWDNS=egw1.express.gotoassist.com&EGWPort=8200,80,443&LogPath=%TEMP%\CitrixLogs\GoToAssist Remote Support\948\2016...
- '<SYSTEM32>\net.exe' session
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\7ZipSfx.000\ammann_support_installer_unattended.cmd" "
- '<SYSTEM32>\net1.exe' session
- '%ProgramFiles%\Citrix\GoToAssist Remote Support Customer\948\g2ax_installer_customer.exe' "/EGWAddress 216.115.218.197" "/EGWPort 8200,80,443" "/EGWDNS egw1.express.gotoassist.com" "/Trigger Web" "/Mode Normal" "/Action SetupUnattendedSilent" "/MeetingId " "/PluginDebug " "/Debug " ...
- '<SYSTEM32>\taskkill.exe' /F /IM "g2ax_installer_customer.exe" /T
Изменения в файловой системе:
Создает следующие файлы:
- %ProgramFiles%\Citrix\GoToAssist Remote Support Customer\948\g2ax_processfactory.exe
- %ProgramFiles%\Citrix\GoToAssist Remote Support Customer\948\g2ax_installer_customer.exe
- %ProgramFiles%\Citrix\GoToAssist Remote Support Customer\948\g2ax_host_service.exe
- %ProgramFiles%\Citrix\GoToAssist Remote Support Customer\948\g2ax_uninstaller_customer.exe
- %ProgramFiles%\Citrix\GoToAssist Remote Support Customer\948\g2ax_system_customer.exe
- %ProgramFiles%\Citrix\GoToAssist Remote Support Customer\948\g2ax_service.exe
- %ProgramFiles%\Citrix\GoToAssist Remote Support Customer\948\g2ax_host.exe
- %ProgramFiles%\Citrix\GoToAssist Remote Support Customer\948\g2ax_customer_resource_win32_x86_es.dll
- %ProgramFiles%\Citrix\GoToAssist Remote Support Customer\948\g2ax_customer_resource_win32_x86_en_US.dll
- %ProgramFiles%\Citrix\GoToAssist Remote Support Customer\948\g2ax_customer_resource_win32_x86_de.dll
- %ProgramFiles%\Citrix\GoToAssist Remote Support Customer\948\g2ax_customer_resource_win32_x86_pt.dll
- %ProgramFiles%\Citrix\GoToAssist Remote Support Customer\948\g2ax_customer_resource_win32_x86_it.dll
- %ProgramFiles%\Citrix\GoToAssist Remote Support Customer\948\g2ax_customer_resource_win32_x86_fr.dll
- %ProgramFiles%\Citrix\GoToAssist Remote Support Customer\948\g2ax_user_customer.exe
- %ProgramFiles%\Citrix\GoToAssist Remote Support Customer\948\shortcuts.txt
- %HOMEPATH%\Start Menu\Programs\Citrix\GoToAssist Customer.lnk
- %HOMEPATH%\Desktop\GoToAssist Customer.lnk
- %TEMP%\CitrixLogs\GoToAssist Remote Support\948\20160902_034122\GoToAssist Remote Support Customer_00.LOG
- %TEMP%\CitrixLogs\GoToAssist Remote Support\948\20160902_034122\mgn_service-service_00.log
- %TEMP%\CitrixLogs\GoToAssist Remote Support\948\20160902_034122\mgn_service-start_session_00.log
- %TEMP%\CitrixLogs\GoToAssist Remote Support\948\20160902_034122\mgn_service-install_manual_00.log
- %ProgramFiles%\Citrix\GoToAssist Remote Support Customer\948\g2ax_winlogon.dll
- %ProgramFiles%\Citrix\GoToAssist Remote Support Customer\948\g2ax_user_medium_customer.exe
- %ProgramFiles%\Citrix\GoToAssist Remote Support Customer\948\g2ax_user_high_customer.exe
- %TEMP%\CitrixLogs\GoToAssist Remote Support\948\20160902_034122\g2ax_installer_customer.log
- %ProgramFiles%\Citrix\GoToAssist Remote Support Customer\948\uninshlp.dll
- %ProgramFiles%\Citrix\GoToAssist Remote Support Customer\948\g2ax_winlogonx64.dll
- %ProgramFiles%\Citrix\GoToAssist Remote Support Customer\948\g2ax_credential_provider64.dll
- %TEMP%\7ZipSfx.000\.rsrc\g2ax_customer_resource_win32_x86_it.dll
- %TEMP%\7ZipSfx.000\.rsrc\g2ax_customer_resource_win32_x86_fr.dll
- %TEMP%\7ZipSfx.000\.rsrc\g2ax_customer_resource_win32_x86_es.dll
- %TEMP%\7ZipSfx.000\.rsrc\g2ax_host_service.exe
- %TEMP%\7ZipSfx.000\.rsrc\g2ax_host.exe
- %TEMP%\7ZipSfx.000\.rsrc\g2ax_customer_resource_win32_x86_pt.dll
- %TEMP%\7ZipSfx.000\.rsrc\g2ax_customer_resource_win32_x86_en_US.dll
- %TEMP%\7ZipSfx.000\.rsrc\g2ax_comm_customer.exe
- %TEMP%\7ZipSfx.000\.rsrc\g2ax_combined_customer.dll
- %TEMP%\7ZipSfx.000\ammann_support_installer_unattended.cmd
- %TEMP%\7ZipSfx.000\.rsrc\g2ax_customer_resource_win32_x86_de.dll
- %TEMP%\7ZipSfx.000\.rsrc\g2ax_credential_provider64.dll
- %TEMP%\7ZipSfx.000\.rsrc\g2ax_credential_provider.dll
- %TEMP%\7ZipSfx.000\.rsrc\g2ax_installer_customer.exe
- %TEMP%\7ZipSfx.000\.rsrc\uninshlp.dll
- %TEMP%\7ZipSfx.000\.rsrc\g2ax_winlogonx64.dll
- %TEMP%\7ZipSfx.000\.rsrc\g2ax_winlogon.dll
- %ProgramFiles%\Citrix\GoToAssist Remote Support Customer\948\g2ax_credential_provider.dll
- %ProgramFiles%\Citrix\GoToAssist Remote Support Customer\948\g2ax_comm_customer.exe
- %ProgramFiles%\Citrix\GoToAssist Remote Support Customer\948\g2ax_combined_customer.dll
- %TEMP%\7ZipSfx.000\.rsrc\g2ax_user_medium_customer.exe
- %TEMP%\7ZipSfx.000\.rsrc\g2ax_system_customer.exe
- %TEMP%\7ZipSfx.000\.rsrc\g2ax_service.exe
- %TEMP%\7ZipSfx.000\.rsrc\g2ax_processfactory.exe
- %TEMP%\7ZipSfx.000\.rsrc\g2ax_user_high_customer.exe
- %TEMP%\7ZipSfx.000\.rsrc\g2ax_user_customer.exe
- %TEMP%\7ZipSfx.000\.rsrc\g2ax_uninstaller_customer.exe
Сетевая активность:
Подключается к:
- '21#.#15.218.197':80
- '21#.#15.218.197':8200
- '21#.#15.218.197':443
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: '' WindowName: ''
