Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] 'wextract_cleanup0' = 'rundll32.exe <SYSTEM32>\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP000.TMP\"'
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\mirrorv3] 'ImagePath' = 'system32\DRIVERS\rminiv3.sys'
- [<HKLM>\SYSTEM\ControlSet001\Services\raddrvv3] 'Start' = '00000001'
- [<HKLM>\SYSTEM\ControlSet001\Services\raddrvv3] 'ImagePath' = '<SYSTEM32>\rserver30\raddrvv3.sys'
- [<HKLM>\SYSTEM\ControlSet001\Services\RServer3] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\RServer3] 'ImagePath' = '"<SYSTEM32>\rserver30\RServer3.exe" /service'
- [<HKLM>\SYSTEM\ControlSet001\Services\mirrorv3] 'Start' = '00000001'
Вредоносные функции:
Для обхода брандмауэра удаляет или модифицирует следующие ключи реестра:
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '<SYSTEM32>\rserver30\rserver3.exe' = '<SYSTEM32>\rserver30\rserver3.ex...
Запускает на исполнение:
- '<SYSTEM32>\rserver30\rsetup.exe' /start
- '<SYSTEM32>\rundll32.exe' <SYSTEM32>\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP000.TMP\"
- '<SYSTEM32>\runonce.exe' -r
- '%WINDIR%\sleep.exe' 20
- '<SYSTEM32>\rserver30\FamItrfc.Exe'
- '<SYSTEM32>\rserver30\rserver3.exe' /service
- '<SYSTEM32>\rserver30\rsetup.exe' /intsetup
- '<SYSTEM32>\msiexec.exe' /qn /i C:\migtools\Radmin34\rserv34.msi /norestart
- '%TEMP%\IXP000.TMP\sleep.exe' 10
- '<SYSTEM32>\cmd.exe' /c %TEMP%\IXP000.TMP\McKesson_Install.cmd
- '%TEMP%\{3A8C4C87-D460-488A-A0AA-8993F6D355B1}\rsetup.exe' /stop
- '<SYSTEM32>\msiexec.exe' -Embedding 7DDC86DC0546D9C9A7AD27D9C1C1C452
- '<SYSTEM32>\msiexec.exe' /V
Изменения в файловой системе:
Создает следующие файлы:
- <SYSTEM32>\rserver30\raddrvv3.sys
- <SYSTEM32>\rserver30\eula.txt
- <SYSTEM32>\rserver30\mirrorv3.cat
- <SYSTEM32>\rserver30\mirrorv3.dll
- <SYSTEM32>\rserver30\mirrorv3.inf
- %HOMEPATH%\Start Menu\Programs\Radmin Server 3\Start Radmin Server.lnk
- %HOMEPATH%\Start Menu\Programs\Radmin Server 3\Stop Radmin Server.lnk
- %HOMEPATH%\Start Menu\Programs\Radmin Server 3\Help.lnk
- <SYSTEM32>\rserver30\Radmin30.chm
- %HOMEPATH%\Start Menu\Programs\Radmin Server 3\Settings for Radmin Server.lnk
- <SYSTEM32>\rserver30\rminiv3.sys
- <SYSTEM32>\rserver30\ChatLPCx.dll
- <SYSTEM32>\rserver30\raudiox.dll
- <SYSTEM32>\rserver30\rschatx.dll
- <SYSTEM32>\rserver30\rchatx.dll
- <SYSTEM32>\rserver30\CHATLOGS\info.txt
- <SYSTEM32>\rserver30\vcintsx.dll
- <SYSTEM32>\rserver30\rsetup.exe
- <SYSTEM32>\rserver30\vcintcx.dll
- <SYSTEM32>\rserver30\voicex.dll
- <SYSTEM32>\rserver30\rsaudiox.dll
- %APPDATA%\Microsoft\Installer\{3A8C4C87-D460-488A-A0AA-8993F6D355B1}\NewShortcut4_6BF1780B36EA432B9451DD84FF5C9D52.exe
- %APPDATA%\Microsoft\Installer\{3A8C4C87-D460-488A-A0AA-8993F6D355B1}\NewShortcut3_6BF1780B36EA432B9451DD84FF5C9D52.exe
- %APPDATA%\Microsoft\Installer\{3A8C4C87-D460-488A-A0AA-8993F6D355B1}\Z_MENU_SRVCFG_6BF1780B36EA432B9451DD84FF5C9D52.exe
- %WINDIR%\Installer\3063f.msi
- %APPDATA%\Microsoft\Installer\{3A8C4C87-D460-488A-A0AA-8993F6D355B1}\ARPPRODUCTICON.exe
- %WINDIR%\Installer\MSI15.tmp
- <SYSTEM32>\rserver30\Radm_log.htm
- %WINDIR%\Installer\MSI14.tmp
- %WINDIR%\Installer\MSI12.tmp
- %TEMP%\~DFDC2F.tmp
- %WINDIR%\Installer\MSI11.tmp
- <SYSTEM32>\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\oem3.CAT
- %WINDIR%\inf\oem3.inf
- %WINDIR%\Installer\MSIA.tmp
- %HOMEPATH%\Start Menu\Programs\Radmin Server 3\Uninstall.lnk
- %WINDIR%\Installer\MSI9.tmp
- %WINDIR%\Installer\MSIF.tmp
- %WINDIR%\Installer\MSI10.tmp
- <SYSTEM32>\SETE.tmp
- %WINDIR%\inf\oem3.PNF
- <DRIVERS>\SETD.tmp
- <SYSTEM32>\rserver30\rsl.exe
- C:\migtools\radmin34\rserv34.msi
- C:\migtools\radmin34\Customization.cmd
- C:\migtools\radmin34\sleep.exe
- C:\migtools\radmin34\Radmin30.chm
- C:\migtools\radmin34\Radmin.exe
- %APPDATA%\Microsoft\CryptnetUrlCache\MetaData\0797C381B2F87EB5A1D5573BD15BA4F4
- %APPDATA%\Microsoft\CryptnetUrlCache\Content\0797C381B2F87EB5A1D5573BD15BA4F4
- %APPDATA%\Microsoft\CryptnetUrlCache\Content\60E31627FDA0A46932B0E5948949F2A5
- %WINDIR%\Installer\3063b.msi
- %APPDATA%\Microsoft\CryptnetUrlCache\MetaData\60E31627FDA0A46932B0E5948949F2A5
- C:\migtools\radmin34\McKesson_HC_Uninstall.cmd
- %TEMP%\IXP000.TMP\McKesson_HC_Uninstall.cmd
- %TEMP%\IXP000.TMP\McKesson_Install.cmd
- %TEMP%\IXP000.TMP\McKesson_HC_Activation.cmd
- %TEMP%\IXP000.TMP\Customization.cmd
- %TEMP%\IXP000.TMP\HC_Radmin.reg
- %TEMP%\IXP000.TMP\sleep.exe
- C:\migtools\radmin34\McKesson_HC_Activation.cmd
- %TEMP%\IXP000.TMP\rserv34.msi
- %TEMP%\IXP000.TMP\Radmin30.chm
- %TEMP%\IXP000.TMP\Radmin.exe
- <SYSTEM32>\rserver30\WinLpcDl2.dll
- <SYSTEM32>\rserver30\FamItrfc.Exe
- <SYSTEM32>\rserver30\WinLpcDl.dll
- %WINDIR%\Installer\MSI7.tmp
- %WINDIR%\Installer\MSI8.tmp
- <SYSTEM32>\rserver30\R_sui.dll
- <SYSTEM32>\rserver30\RCursor.dll
- <SYSTEM32>\rserver30\rserver3.exe
- <SYSTEM32>\rserver30\FamItrf2.Exe
- <SYSTEM32>\rserver30\FirewallInstallHelper.dll
- C:\Config.Msi\3063e.rbs
- %TEMP%\{3A8C4C87-D460-488A-A0AA-8993F6D355B1}\FirewallInstallHelper.dll
- %WINDIR%\Installer\MSI2.tmp
- %TEMP%\{3A8C4C87-D460-488A-A0AA-8993F6D355B1}\rsetup64.exe
- %WINDIR%\Installer\MSI1.tmp
- %TEMP%\{3A8C4C87-D460-488A-A0AA-8993F6D355B1}\rsetup.exe
- %WINDIR%\Installer\MSI4.tmp
- %WINDIR%\Installer\MSI5.tmp
- %TEMP%\~DFAA26.tmp
- %WINDIR%\Installer\MSI3.tmp
- %WINDIR%\Installer\3063d.ipi
Присваивает атрибут 'скрытый' для следующих файлов:
- <SYSTEM32>\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\oem3.CAT
Удаляет следующие файлы:
- %WINDIR%\Installer\MSI11.tmp
- %WINDIR%\Installer\MSI12.tmp
- %WINDIR%\Installer\MSI5.tmp
- %WINDIR%\Installer\MSI10.tmp
- %TEMP%\IXP000.TMP\sleep.exe
- %WINDIR%\Installer\MSIA.tmp
- %WINDIR%\Installer\MSIF.tmp
- C:\Config.Msi\3063e.rbs
- %WINDIR%\Installer\MSI15.tmp
- %WINDIR%\Installer\3063b.msi
- %WINDIR%\Installer\3063d.ipi
- %TEMP%\{3A8C4C87-D460-488A-A0AA-8993F6D355B1}\rsetup64.exe
- %WINDIR%\Installer\MSI14.tmp
- %TEMP%\{3A8C4C87-D460-488A-A0AA-8993F6D355B1}\FirewallInstallHelper.dll
- %TEMP%\{3A8C4C87-D460-488A-A0AA-8993F6D355B1}\rsetup.exe
- %WINDIR%\Installer\MSI7.tmp
- %WINDIR%\Installer\MSI8.tmp
- %WINDIR%\Installer\MSI9.tmp
- %WINDIR%\Installer\MSI4.tmp
- %WINDIR%\Installer\MSI1.tmp
- %WINDIR%\Installer\MSI2.tmp
- %WINDIR%\Installer\MSI3.tmp
- %TEMP%\IXP000.TMP\Customization.cmd
- %TEMP%\IXP000.TMP\Radmin.exe
- %TEMP%\IXP000.TMP\Radmin30.chm
- %TEMP%\IXP000.TMP\rserv34.msi
- %TEMP%\IXP000.TMP\McKesson_Install.cmd
- %TEMP%\IXP000.TMP\HC_Radmin.reg
- %TEMP%\IXP000.TMP\McKesson_HC_Activation.cmd
- %TEMP%\IXP000.TMP\McKesson_HC_Uninstall.cmd
Перемещает следующие файлы:
- <SYSTEM32>\SETE.tmp в <SYSTEM32>\mirrorv3.dll
- <DRIVERS>\SETD.tmp в <DRIVERS>\rminiv3.sys
Сетевая активность:
Подключается к:
- 'cs#######-2-crl.verisign.com':80
- 'crl.verisign.com':80
- 'wp#d':80
TCP:
Запросы HTTP GET:
- http://cs#######-2-crl.verisign.com/CSC3-2009-2.crl
- http://crl.verisign.com/pca3.crl
- http://11#.#11.111.1/wpad.dat via wp#d
UDP:
- DNS ASK cs#######-2-crl.verisign.com
- DNS ASK crl.verisign.com
- DNS ASK wp#d
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: ''
