Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'imPcRemoteTray' = '%ProgramFiles%\imPcRemote\imPcRemoteTray.exe'
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\mv2] 'Start' = '00000001'
- [<HKLM>\SYSTEM\ControlSet001\Services\mv2] 'ImagePath' = 'system32\DRIVERS\mv2.sys'
- [<HKLM>\SYSTEM\ControlSet001\Services\imPcRemoteService] 'ImagePath' = '%ProgramFiles%\imPcRemote\impcremote.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\impc_service] 'ImagePath' = '"%ProgramFiles%\imPcRemote\uvnc\rpuvnc.exe" -service'
- [<HKLM>\SYSTEM\ControlSet001\Services\imPcRemoteService] 'Start' = '00000002'
Malicious functions:
Creates and executes the following:
- '%ProgramFiles%\imPcRemote\uvnc\driver\xp\setupdrv.exe' install
- '%ProgramFiles%\imPcRemote\imPcRemoteTray.exe'
- '%ProgramFiles%\imPcRemote\imPcRemote.exe'
- '%TEMP%\RarSFX0\impcremote_tray_setup.exe' /VERYSILENT
- '%TEMP%\is-H2HQL.tmp\impcremote_tray_setup.tmp' /SL5="$2010E,2129648,56832,%TEMP%\RarSFX0\impcremote_tray_setup.exe" /VERYSILENT
- '%ProgramFiles%\imPcRemote\uvnc\setcad.exe'
Executes the following:
- '<SYSTEM32>\runonce.exe' -r
Modifies file system:
Creates the following files:
- %ProgramFiles%\imPcRemote\uvnc\is-OAR7K.tmp
- %ProgramFiles%\imPcRemote\uvnc\is-LPHC6.tmp
- %ProgramFiles%\imPcRemote\uvnc\is-PD08O.tmp
- %ProgramFiles%\imPcRemote\unins.ini
- %ProgramFiles%\imPcRemote\is-784TL.tmp
- %ProgramFiles%\imPcRemote\is-1N0IR.tmp
- %ProgramFiles%\imPcRemote\uvnc\is-EGQ44.tmp
- %ProgramFiles%\imPcRemote\uvnc\is-QVQP4.tmp
- %ProgramFiles%\imPcRemote\uvnc\driver\xp64\driver\is-565PQ.tmp
- %ProgramFiles%\imPcRemote\uvnc\driver\xp64\driver\is-QMOAK.tmp
- %ProgramFiles%\imPcRemote\uvnc\driver\xp64\driver\is-9N1B8.tmp
- %ProgramFiles%\imPcRemote\uvnc\is-M1M0U.tmp
- %ProgramFiles%\imPcRemote\uvnc\is-LLEMR.tmp
- %ProgramFiles%\imPcRemote\uvnc\is-M6VHE.tmp
- %ProgramFiles%\imPcRemote\uvnc\is-KMFCQ.tmp
- %ProgramFiles%\imPcRemote\unins000.dat
- %ALLUSERSPROFILE%\Start Menu\Programs\imPcRemote\Uninstall imPcRemote Tray.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\imPcRemote\imPcRemote.lnk
- %WINDIR%\inf\oem3.inf
- <SYSTEM32>\SETA.tmp
- <DRIVERS>\SET9.tmp
- %WINDIR%\inf\oem3.PNF
- %ProgramFiles%\imPcRemote\is-8PU2Q.tmp
- %ProgramFiles%\imPcRemote\stop
- %ProgramFiles%\imPcRemote\is-S356N.tmp
- %ProgramFiles%\imPcRemote\is-O1MPV.tmp
- %ProgramFiles%\imPcRemote\silent.ini
- %ProgramFiles%\imPcRemote\bckgrnd.jpg
- %ProgramFiles%\imPcRemote\brand.ico
- %ProgramFiles%\imPcRemote\brand.ini
- %ProgramFiles%\imPcRemote\uvnc\driver\vista\driver\is-90MK1.tmp
- %ProgramFiles%\imPcRemote\uvnc\driver\vista\driver\is-60M95.tmp
- %ProgramFiles%\imPcRemote\uvnc\driver\vista\is-NRC0L.tmp
- %ProgramFiles%\imPcRemote\uvnc\driver\vista\driver\is-M41BK.tmp
- %ProgramFiles%\imPcRemote\uvnc\driver\vista64\driver\is-1C0DT.tmp
- %ProgramFiles%\imPcRemote\uvnc\driver\vista64\is-3GKK5.tmp
- %ProgramFiles%\imPcRemote\uvnc\driver\vista\driver\is-CEC7R.tmp
- %ProgramFiles%\imPcRemote\is-6MS2P.tmp
- %TEMP%\RarSFX0\bckgrnd.jpg
- %TEMP%\RarSFX0\silent.ini
- %TEMP%\RarSFX0\impcremote_tray_setup.exe
- %TEMP%\RarSFX0\brand.ico
- %TEMP%\is-E1BI2.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-H2HQL.tmp\impcremote_tray_setup.tmp
- %TEMP%\RarSFX0\brand.ini
- %ProgramFiles%\imPcRemote\uvnc\driver\xp\driver\is-BSIQ1.tmp
- %ProgramFiles%\imPcRemote\uvnc\driver\xp\driver\is-6Q9O1.tmp
- %ProgramFiles%\imPcRemote\uvnc\driver\xp\is-U55HS.tmp
- %ProgramFiles%\imPcRemote\uvnc\driver\xp\driver\is-HECKA.tmp
- %ProgramFiles%\imPcRemote\uvnc\driver\xp64\driver\is-IC1AQ.tmp
- %ProgramFiles%\imPcRemote\uvnc\driver\xp64\is-B836P.tmp
- %ProgramFiles%\imPcRemote\uvnc\driver\xp\driver\is-AVK91.tmp
- %ProgramFiles%\imPcRemote\uvnc\driver\w2k\driver\is-64CS9.tmp
- %ProgramFiles%\imPcRemote\uvnc\driver\vista64\driver\is-2OVPE.tmp
- %ProgramFiles%\imPcRemote\uvnc\driver\vista64\driver\is-COA4A.tmp
- %ProgramFiles%\imPcRemote\uvnc\driver\vista64\driver\is-D9CRU.tmp
- %ProgramFiles%\imPcRemote\uvnc\driver\w2k\is-EU4RD.tmp
- %ProgramFiles%\imPcRemote\uvnc\driver\w2k\driver\is-F1R5Q.tmp
- %ProgramFiles%\imPcRemote\uvnc\driver\w2k\driver\is-8UEBP.tmp
- %ProgramFiles%\imPcRemote\uvnc\driver\w2k\driver\is-N11UD.tmp
Deletes the following files:
- %TEMP%\RarSFX0\bckgrnd.jpg
- %TEMP%\Cab11.tmp
- %TEMP%\CabF.tmp
- %TEMP%\RarSFX0\brand.ico
- %TEMP%\RarSFX0\silent.ini
- %TEMP%\RarSFX0\impcremote_tray_setup.exe
- %TEMP%\RarSFX0\brand.ini
- %TEMP%\CabD.tmp
- %TEMP%\Cab3.tmp
- %TEMP%\is-E1BI2.tmp\_isetup\_shfoldr.dll
- %ProgramFiles%\imPcRemote\stop
- %TEMP%\Cab5.tmp
- %TEMP%\CabB.tmp
- %TEMP%\Cab7.tmp
- %TEMP%\is-H2HQL.tmp\impcremote_tray_setup.tmp
Moves the following files:
- from %ProgramFiles%\imPcRemote\uvnc\is-KMFCQ.tmp to %ProgramFiles%\imPcRemote\uvnc\logging.dll
- from %ProgramFiles%\imPcRemote\uvnc\is-M1M0U.tmp to %ProgramFiles%\imPcRemote\uvnc\rpuvnc.exe
- from %ProgramFiles%\imPcRemote\uvnc\is-M6VHE.tmp to %ProgramFiles%\imPcRemote\uvnc\logmessages.dll
- from %ProgramFiles%\imPcRemote\uvnc\is-QVQP4.tmp to %ProgramFiles%\imPcRemote\uvnc\setcad.exe
- from %ProgramFiles%\imPcRemote\uvnc\is-LLEMR.tmp to %ProgramFiles%\imPcRemote\uvnc\sas.dll
- from %ProgramFiles%\imPcRemote\uvnc\driver\xp64\driver\is-IC1AQ.tmp to %ProgramFiles%\imPcRemote\uvnc\driver\xp64\driver\mv2.cat
- from %ProgramFiles%\imPcRemote\uvnc\driver\xp64\is-B836P.tmp to %ProgramFiles%\imPcRemote\uvnc\driver\xp64\setupdrv.exe
- from %ProgramFiles%\imPcRemote\uvnc\driver\xp64\driver\is-9N1B8.tmp to %ProgramFiles%\imPcRemote\uvnc\driver\xp64\driver\mv2.dll
- from %ProgramFiles%\imPcRemote\uvnc\driver\xp64\driver\is-565PQ.tmp to %ProgramFiles%\imPcRemote\uvnc\driver\xp64\driver\mv2.sys
- from %ProgramFiles%\imPcRemote\uvnc\driver\xp64\driver\is-QMOAK.tmp to %ProgramFiles%\imPcRemote\uvnc\driver\xp64\driver\mv2.inf
- from %ProgramFiles%\imPcRemote\uvnc\is-PD08O.tmp to %ProgramFiles%\imPcRemote\uvnc\setcad64.exe
- from %ProgramFiles%\imPcRemote\is-S356N.tmp to %ProgramFiles%\imPcRemote\Readme.txt
- from %ProgramFiles%\imPcRemote\is-O1MPV.tmp to %ProgramFiles%\imPcRemote\imPcRemote.exe
- from %ProgramFiles%\imPcRemote\is-8PU2Q.tmp to %ProgramFiles%\imPcRemote\imPcRemoteTray.exe
- from <SYSTEM32>\SETA.tmp to <SYSTEM32>\mv2.dll
- from <DRIVERS>\SET9.tmp to <DRIVERS>\mv2.sys
- from %ProgramFiles%\imPcRemote\uvnc\is-OAR7K.tmp to %ProgramFiles%\imPcRemote\uvnc\SecureVNCPlugin.dsm
- from %ProgramFiles%\imPcRemote\uvnc\is-LPHC6.tmp to %ProgramFiles%\imPcRemote\uvnc\vnchooks.dll
- from %ProgramFiles%\imPcRemote\uvnc\is-EGQ44.tmp to %ProgramFiles%\imPcRemote\uvnc\ultravnc.ini
- from %ProgramFiles%\imPcRemote\is-784TL.tmp to %ProgramFiles%\imPcRemote\ssleay32.dll
- from %ProgramFiles%\imPcRemote\is-1N0IR.tmp to %ProgramFiles%\imPcRemote\libeay32.dll
- from %ProgramFiles%\imPcRemote\uvnc\driver\vista64\is-3GKK5.tmp to %ProgramFiles%\imPcRemote\uvnc\driver\vista64\setupdrv.exe
- from %ProgramFiles%\imPcRemote\uvnc\driver\vista\driver\is-CEC7R.tmp to %ProgramFiles%\imPcRemote\uvnc\driver\vista\driver\mv2.sys
- from %ProgramFiles%\imPcRemote\uvnc\driver\vista64\driver\is-1C0DT.tmp to %ProgramFiles%\imPcRemote\uvnc\driver\vista64\driver\mv2.cat
- from %ProgramFiles%\imPcRemote\uvnc\driver\vista64\driver\is-COA4A.tmp to %ProgramFiles%\imPcRemote\uvnc\driver\vista64\driver\mv2.inf
- from %ProgramFiles%\imPcRemote\uvnc\driver\vista64\driver\is-D9CRU.tmp to %ProgramFiles%\imPcRemote\uvnc\driver\vista64\driver\mv2.dll
- from %ProgramFiles%\imPcRemote\uvnc\driver\vista\is-NRC0L.tmp to %ProgramFiles%\imPcRemote\uvnc\driver\vista\setupdrv.exe
- from %ProgramFiles%\imPcRemote\is-6MS2P.tmp to %ProgramFiles%\imPcRemote\unins000.exe
- from %ProgramFiles%\imPcRemote\uvnc\driver\vista\driver\is-60M95.tmp to %ProgramFiles%\imPcRemote\uvnc\driver\vista\driver\mv2.cat
- from %ProgramFiles%\imPcRemote\uvnc\driver\vista\driver\is-M41BK.tmp to %ProgramFiles%\imPcRemote\uvnc\driver\vista\driver\mv2.inf
- from %ProgramFiles%\imPcRemote\uvnc\driver\vista\driver\is-90MK1.tmp to %ProgramFiles%\imPcRemote\uvnc\driver\vista\driver\mv2.dll
- from %ProgramFiles%\imPcRemote\uvnc\driver\vista64\driver\is-2OVPE.tmp to %ProgramFiles%\imPcRemote\uvnc\driver\vista64\driver\mv2.sys
- from %ProgramFiles%\imPcRemote\uvnc\driver\xp\driver\is-6Q9O1.tmp to %ProgramFiles%\imPcRemote\uvnc\driver\xp\driver\mv2.cat
- from %ProgramFiles%\imPcRemote\uvnc\driver\xp\is-U55HS.tmp to %ProgramFiles%\imPcRemote\uvnc\driver\xp\setupdrv.exe
- from %ProgramFiles%\imPcRemote\uvnc\driver\xp\driver\is-BSIQ1.tmp to %ProgramFiles%\imPcRemote\uvnc\driver\xp\driver\mv2.dll
- from %ProgramFiles%\imPcRemote\uvnc\driver\xp\driver\is-AVK91.tmp to %ProgramFiles%\imPcRemote\uvnc\driver\xp\driver\mv2.sys
- from %ProgramFiles%\imPcRemote\uvnc\driver\xp\driver\is-HECKA.tmp to %ProgramFiles%\imPcRemote\uvnc\driver\xp\driver\mv2.inf
- from %ProgramFiles%\imPcRemote\uvnc\driver\w2k\driver\is-N11UD.tmp to %ProgramFiles%\imPcRemote\uvnc\driver\w2k\driver\mv2.cat
- from %ProgramFiles%\imPcRemote\uvnc\driver\w2k\is-EU4RD.tmp to %ProgramFiles%\imPcRemote\uvnc\driver\w2k\setupdrv.exe
- from %ProgramFiles%\imPcRemote\uvnc\driver\w2k\driver\is-8UEBP.tmp to %ProgramFiles%\imPcRemote\uvnc\driver\w2k\driver\mv2.dll
- from %ProgramFiles%\imPcRemote\uvnc\driver\w2k\driver\is-64CS9.tmp to %ProgramFiles%\imPcRemote\uvnc\driver\w2k\driver\mv2.sys
- from %ProgramFiles%\imPcRemote\uvnc\driver\w2k\driver\is-F1R5Q.tmp to %ProgramFiles%\imPcRemote\uvnc\driver\w2k\driver\mv2.inf
Network activity:
Connects to:
- 'im####0.dtdns.net':5555
- 'www.download.windowsupdate.com':80
- 's0#.##pcremote.com':5555
- 'wp#d':80
TCP:
HTTP GET requests:
- http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
- http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt
- http://11#.#11.111.3/wpad.dat via wp#d
UDP:
- DNS ASK wp#d
- DNS ASK www.download.windowsupdate.com
- DNS ASK s0#.##pcremote.com
- DNS ASK im####0.dtdns.net
Miscellaneous:
Searches for the following windows:
- ClassName: '' WindowName: 'Software Installation'
- ClassName: '' WindowName: 'Hardware Installation'
- ClassName: 'EDIT' WindowName: ''
