Trojan.DownLoader3.54255

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Kaseya Agent Service Helper' = '"%PROGRAM_FILES%\Kaseya\Agent\KaUsrTsk.exe"'

Создает следующие сервисы:

[<HKLM>\SYSTEM\ControlSet001\Services\KaseyaAgent] 'Start' = '00000002'
[<HKLM>\SYSTEM\ControlSet001\Services\KaseyaAgent] 'ImagePath' = '"%PROGRAM_FILES%\Kaseya\Agent\AgentMon.exe"'

Вредоносные функции:

Создает и запускает на исполнение:

%PROGRAM_FILES%\Kaseya\Agent\AgentMon.exe -s
%PROGRAM_FILES%\Kaseya\Agent\KaUsrTsk.exe
%CommonProgramFiles%\InstallShield\Engine\6\Intel 32\IKernel.exe /REGSERVER -Embedding -RegServer

Изменения в файловой системе:

Создает следующие файлы:

%ALLUSERSPROFILE%\Start Menu\Programs\Kaseya\Kaseya Agent.lnk
%PROGRAM_FILES%\InstallShield Installation Information\{48C76121-4F90-11D5-9884-0050BA85A903}\Setup.ini
%PROGRAM_FILES%\InstallShield Installation Information\{48C76121-4F90-11D5-9884-0050BA85A903}\setuf680.rra
%PROGRAM_FILES%\Kaseya\Agent\KPrtfb24.rra
%PROGRAM_FILES%\Kaseya\Agent\kGetfc0e.rra
%PROGRAM_FILES%\Kaseya\Agent\Agenfb81.rra
%PROGRAM_FILES%\Kaseya\Agent\KaUsfb43.rra
%PROGRAM_FILES%\InstallShield Installation Information\{48C76121-4F90-11D5-9884-0050BA85A903}\layof5a5.rra
%TEMP%\pft3.tmp\setup.log
%TEMP%\{48c76121-4f90-11d5-9884-0050ba85a903}\_IsRebf1.rra
%PROGRAM_FILES%\InstallShield Installation Information\{48C76121-4F90-11D5-9884-0050BA85A903}\dataf5c5.rra
%PROGRAM_FILES%\InstallShield Installation Information\{48C76121-4F90-11D5-9884-0050BA85A903}\Setuf651.rra
%PROGRAM_FILES%\InstallShield Installation Information\{48C76121-4F90-11D5-9884-0050BA85A903}\Setuf622.rra
%PROGRAM_FILES%\InstallShield Installation Information\{48C76121-4F90-11D5-9884-0050BA85A903}\dataf5e4.rra
%PROGRAM_FILES%\Kaseya\Agent\sporfc9b.rra
<DRIVERS>\kapf15.rra
<DRIVERS>\Kasefff6.rra
<DRIVERS>\KaPFffc7.rra
<DRIVERS>\kase25.rra
%PROGRAM_FILES%\Kaseya\Agent\AgentMon.log
%PROGRAM_FILES%\Kaseya\Agent\KasError.log
%PROGRAM_FILES%\Kaseya\Agent\KaseyaD.ini
%PROGRAM_FILES%\Kaseya\Agent\LogPfd18.rra
%PROGRAM_FILES%\Kaseya\Agent\KEvefcd9.rra
%PROGRAM_FILES%\Kaseya\Agent\Psapfcba.rra
%PROGRAM_FILES%\Kaseya\Agent\KAgefd47.rra
%PROGRAM_FILES%\Kaseya\Agent\Kasefebe.rra
%PROGRAM_FILES%\Kaseya\Agent\Kasefe9e.rra
<SYSTEM32>\kasefdb4.rra
%TEMP%\pft3.tmp\Setup.exe
%TEMP%\pft3.tmp\Setup.bmp
%TEMP%\pft3.tmp\data1.hdr
%TEMP%\pft3.tmp\setup.iss
%TEMP%\pft3.tmp\Setup.ini
%TEMP%\pft3.tmp\layout.bin
%TEMP%\pft3.tmp\data2.cab
%TEMP%\KaseyaD.ini
%TEMP%\KAgentSilent.exe
%TEMP%\KASetup.log
%TEMP%\ext2.tmp
%TEMP%\pft3.tmp\data1.cab
%TEMP%\pft3.tmp\pftw1.pkg
%TEMP%\plf1.tmp
%TEMP%\pft3.tmp\setup.inx
%TEMP%\{48c76121-4f90-11d5-9884-0050ba85a903}\KSete9bf.rra
%TEMP%\{48c76121-4f90-11d5-9884-0050ba85a903}\setue951.rra
%CommonProgramFiles%\InstallShield\IScript\iscrdf4f.rra
%TEMP%\{48c76121-4f90-11d5-9884-0050ba85a903}\Psape9de.rra
%TEMP%\{48c76121-4f90-11d5-9884-0050ba85a903}\defaeb74.rra
%TEMP%\{48c76121-4f90-11d5-9884-0050ba85a903}\isrteaf7.rra
%TEMP%\{48c76121-4f90-11d5-9884-0050ba85a903}\valuea5b.rra
%CommonProgramFiles%\InstallShield\Engine\6\Intel 32\temp.000
%TEMP%\IEC4.tmp
%TEMP%\pft3.tmp\ikernel.ex_
%CommonProgramFiles%\InstallShield\Engine\6\Intel 32\cored9b1.rra
%CommonProgramFiles%\InstallShield\Engine\6\Intel 32\iusedcbe.rra
%CommonProgramFiles%\InstallShield\Engine\6\Intel 32\objedc51.rra
%CommonProgramFiles%\InstallShield\Engine\6\Intel 32\ctord9ff.rra