Trojan.DownLoader3.43790

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Kaseya Agent Service Helper' = '%PROGRAM_FILES%\Kaseya\Agent\KaUsrTsk.exe'

Создает следующие сервисы:

[<HKLM>\SYSTEM\ControlSet001\Services\KaseyaAgent] 'Start' = '00000002'
[<HKLM>\SYSTEM\ControlSet001\Services\KaseyaAgent] 'ImagePath' = '%PROGRAM_FILES%\Kaseya\Agent\AgentMon.exe'

Вредоносные функции:

Создает и запускает на исполнение:

%PROGRAM_FILES%\Kaseya\Agent\AgentMon.exe -s
%PROGRAM_FILES%\Kaseya\Agent\KaUsrTsk.exe
%CommonProgramFiles%\InstallShield\Engine\6\Intel 32\IKernel.exe /REGSERVER -Embedding -RegServer

Изменения в файловой системе:

Создает следующие файлы:

%ALLUSERSPROFILE%\Start Menu\Programs\Kaseya\Kaseya Agent.lnk
%PROGRAM_FILES%\InstallShield Installation Information\{48C76121-4F90-11D5-9884-0050BA85A903}\Setup.ini
%PROGRAM_FILES%\InstallShield Installation Information\{48C76121-4F90-11D5-9884-0050BA85A903}\setu517.rra
%PROGRAM_FILES%\Kaseya\Agent\KPrt8ef.rra
%PROGRAM_FILES%\Kaseya\Agent\kGet9e9.rra
%PROGRAM_FILES%\Kaseya\Agent\Agen95c.rra
%PROGRAM_FILES%\Kaseya\Agent\KaUs91e.rra
%PROGRAM_FILES%\InstallShield Installation Information\{48C76121-4F90-11D5-9884-0050BA85A903}\layo46b.rra
%TEMP%\pft3~tmp\setup.log
%TEMP%\{48c76121-4f90-11d5-9884-0050ba85a903}\_IsRf9eb.rra
%PROGRAM_FILES%\InstallShield Installation Information\{48C76121-4F90-11D5-9884-0050BA85A903}\data48a.rra
%PROGRAM_FILES%\InstallShield Installation Information\{48C76121-4F90-11D5-9884-0050BA85A903}\Setu4f7.rra
%PROGRAM_FILES%\InstallShield Installation Information\{48C76121-4F90-11D5-9884-0050BA85A903}\Setu4d8.rra
%PROGRAM_FILES%\InstallShield Installation Information\{48C76121-4F90-11D5-9884-0050BA85A903}\data49a.rra
%PROGRAM_FILES%\Kaseya\Agent\spora56.rra
%PROGRAM_FILES%\Kaseya\Agent\custom\noremote.ico
%PROGRAM_FILES%\Kaseya\Agent\KaseyaD.ini
<DRIVERS>\kasec98.rra
%PROGRAM_FILES%\Kaseya\Agent\custom\blink.ico
%PROGRAM_FILES%\Kaseya\Agent\KasError.log
%PROGRAM_FILES%\Kaseya\Agent\custom\online.ico
%PROGRAM_FILES%\Kaseya\Agent\custom\offline.ico
%PROGRAM_FILES%\Kaseya\Agent\Kaseb70.rra
<SYSTEM32>\kasead3.rra
%PROGRAM_FILES%\Kaseya\Agent\Psapa76.rra
%PROGRAM_FILES%\Kaseya\Agent\Kaseb7f.rra
<DRIVERS>\kapfc6a.rra
<DRIVERS>\Kasec4a.rra
<DRIVERS>\KaPFc1b.rra
%TEMP%\pft3~tmp\Setup.exe
%TEMP%\pft3~tmp\Setup.bmp
%TEMP%\pft3~tmp\data1.hdr
%TEMP%\pft3~tmp\setup.iss
%TEMP%\pft3~tmp\Setup.ini
%TEMP%\pft3~tmp\layout.bin
%TEMP%\pft3~tmp\data2.cab
%TEMP%\KaseyaD.ini
%TEMP%\KAgentSilent.exe
%TEMP%\KASetup.log
%TEMP%\ext2.tmp
%TEMP%\pft3~tmp\data1.cab
%TEMP%\pft3~tmp\pftw1.pkg
%TEMP%\plf1.tmp
%TEMP%\pft3~tmp\setup.inx
%TEMP%\{48c76121-4f90-11d5-9884-0050ba85a903}\KSetf816.rra
%TEMP%\{48c76121-4f90-11d5-9884-0050ba85a903}\setuf799.rra
%CommonProgramFiles%\InstallShield\IScript\iscrec3f.rra
%TEMP%\{48c76121-4f90-11d5-9884-0050ba85a903}\Psapf845.rra
%TEMP%\{48c76121-4f90-11d5-9884-0050ba85a903}\defaf99d.rra
%TEMP%\{48c76121-4f90-11d5-9884-0050ba85a903}\isrtf93f.rra
%TEMP%\{48c76121-4f90-11d5-9884-0050ba85a903}\valuf8a3.rra
%CommonProgramFiles%\InstallShield\Engine\6\Intel 32\temp.000
%TEMP%\IEC4.tmp
%TEMP%\pft3~tmp\ikernel.ex_
%CommonProgramFiles%\InstallShield\Engine\6\Intel 32\coree6c1.rra
%CommonProgramFiles%\InstallShield\Engine\6\Intel 32\iusee970.rra
%CommonProgramFiles%\InstallShield\Engine\6\Intel 32\objee903.rra
%CommonProgramFiles%\InstallShield\Engine\6\Intel 32\ctore70f.rra