BackDoor.Radmin.134

Техническая информация

Для обеспечения автозапуска и распространения:

Создает следующие сервисы:

[<HKLM>\SYSTEM\ControlSet001\services\raddrvv3] 'Start' = '00000001'
[<HKLM>\SYSTEM\ControlSet001\services\mirrorv3] 'Start' = '00000001'
[<HKLM>\SYSTEM\ControlSet001\services\RServer3] 'Start' = '00000002'

Вредоносные функции:

Создает и запускает на исполнение:

'<SYSTEM32>\rserver30\RServer3.exe' /service
'<SYSTEM32>\rserver30\FamItrfc.Exe'
'<SYSTEM32>\rserver30\rsetup.exe' /intsetup
'<SYSTEM32>\rserver30\rsetup.exe' /start

Запускает на исполнение:

'<SYSTEM32>\DrvInst.exe' "2" "211" "ROOT\DISPLAY\0000" "%WINDIR%\INF\oem4.inf" "mirrorv3.inf:Mirror.Mfg:mirrorv3:3.0.0.0:radmin_mirror_v3" "50bbf019f" "000004C4" "000005A8" "000005AC"
'<SYSTEM32>\DllHost.exe' /Processid:{E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E}
'<SYSTEM32>\rundll32.exe' dfdts.dll,DfdGetDefaultPolicyAndSMART
'<SYSTEM32>\DrvInst.exe' "4" "0" "%TEMP%\{234cb8a0-8cf3-1f32-8674-c22af591a201}\mirrorv3.inf" "0" "50bbf019f" "000004C4" "WinSta0\Default" "000003B0" "208" "<SYSTEM32>\rserver30"
'<SYSTEM32>\msiexec.exe' /i <SYSTEM32>\config\system.msi /quiet
'<SYSTEM32>\msiexec.exe' /V
'<SYSTEM32>\MsiExec.exe' -Embedding 81FC1CADBA85865F00DF5CC14312C7B7

Изменения в файловой системе:

Создает следующие файлы:

<DRIVERS>tore\Temp\{6a73caa8-caa8-6a73-6b93-8e6e9bba004d}\SETAC84.tmp
%TEMP%\{234cb8a0-8cf3-1f32-8674-c22af591a201}\SETAAB3.tmp
%TEMP%\{234cb8a0-8cf3-1f32-8674-c22af591a201}\SETAA83.tmp
<DRIVERS>tore\Temp\{6a73caa8-caa8-6a73-6b93-8e6e9bba004d}\SETAD13.tmp
<DRIVERS>tore\Temp\{6a73caa8-caa8-6a73-6b93-8e6e9bba004d}\SETACE3.tmp
<DRIVERS>tore\Temp\{6a73caa8-caa8-6a73-6b93-8e6e9bba004d}\SETACB3.tmp
<SYSTEM32>\rserver30\WinLpcDl2.dll
<SYSTEM32>\rserver30\WinLpcDl.dll
<SYSTEM32>\rserver30\rsl.exe
%TEMP%\{234cb8a0-8cf3-1f32-8674-c22af591a201}\SETAA43.tmp
%TEMP%\{234cb8a0-8cf3-1f32-8674-c22af591a201}\SETAA13.tmp
%WINDIR%\Installer\MSIA567.tmp
%WINDIR%\Installer\MSIC6BF.tmp
%WINDIR%\Installer\MSIC622.tmp
<SYSTEM32>\SETB4ED.tmp
<SYSTEM32>\rserver30\Radm_log.htm
%WINDIR%\Installer\MSIC7CB.tmp
%WINDIR%\Installer\MSIC6DF.tmp
<DRIVERS>tore\INFCACHE.0
<DRIVERS>tore\FileRepository\mirrorv3.inf_x86_neutral_7379a18db0b7058e\mirrorv3.PNF
%WINDIR%\inf\oem4.inf
<DRIVERS>\SETB3E3.tmp
%WINDIR%\inf\oem4.PNF
<SYSTEM32>\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\oem4.CAT
<SYSTEM32>\rserver30\rsetup.exe
C:\System Volume Information\Syscache.hve.LOG1
%BOOT_VOL%\Boot\BCD
%BOOT_VOL%\Boot\BCD.LOG
%WINDIR%\Installer\MSIA288.tmp
%WINDIR%\Installer\MSIA258.tmp
C:\System Volume Information\Syscache.hve
%WINDIR%\Installer\MSI9C9C.tmp
%WINDIR%\Installer\699ce.msi
C:\:services.exe
%WINDIR%\Installer\MSI9E42.tmp
%TEMP%\{3A8C4C87-D460-488A-A0AA-8993F6D355B1}\FirewallInstallHelper.dll
%TEMP%\{3A8C4C87-D460-488A-A0AA-8993F6D355B1}\rsetup.exe
<SYSTEM32>\rserver30\raddrvv3.sys
<SYSTEM32>\rserver30\R_sui.dll
<SYSTEM32>\rserver30\mirrorv3.inf
<SYSTEM32>\rserver30\rserver3.exe
<SYSTEM32>\rserver30\rminiv3.sys
<SYSTEM32>\rserver30\RCursor.dll
<SYSTEM32>\rserver30\FamItrfc.Exe
<SYSTEM32>\rserver30\FamItrf2.Exe
C:\Config.Msi\699d1.rbs
<SYSTEM32>\rserver30\mirrorv3.dll
<SYSTEM32>\rserver30\mirrorv3.cat
<SYSTEM32>\rserver30\FirewallInstallHelper.dll

Присваивает атрибут 'скрытый' для следующих файлов:

<SYSTEM32>\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\oem4.CAT

Удаляет следующие файлы:

%WINDIR%\Installer\MSIC6DF.tmp
%WINDIR%\Installer\MSIA288.tmp
%WINDIR%\Installer\MSIC6BF.tmp
%WINDIR%\Installer\MSIA567.tmp
%WINDIR%\Installer\MSIC622.tmp
%WINDIR%\Installer\MSIC7CB.tmp
%WINDIR%\Installer\699ce.msi
%TEMP%\{3A8C4C87-D460-488A-A0AA-8993F6D355B1}\rsetup.exe
C:\Config.Msi\699d1.rbs
%TEMP%\{3A8C4C87-D460-488A-A0AA-8993F6D355B1}\FirewallInstallHelper.dll
%TEMP%\{234cb8a0-8cf3-1f32-8674-c22af591a201}\rminiv3.sys
<DRIVERS>tore\Temp\{6a73caa8-caa8-6a73-6b93-8e6e9bba004d}\mirrorv3.cat
<DRIVERS>tore\Temp\{6a73caa8-caa8-6a73-6b93-8e6e9bba004d}\mirrorv3.dll
%WINDIR%\Installer\MSIA258.tmp
%WINDIR%\Installer\MSI9C9C.tmp
%WINDIR%\Installer\MSI9E42.tmp
%TEMP%\{234cb8a0-8cf3-1f32-8674-c22af591a201}\mirrorv3.dll
%TEMP%\{234cb8a0-8cf3-1f32-8674-c22af591a201}\mirrorv3.inf
%TEMP%\{234cb8a0-8cf3-1f32-8674-c22af591a201}\mirrorv3.cat
<DRIVERS>tore\Temp\{6a73caa8-caa8-6a73-6b93-8e6e9bba004d}\mirrorv3.inf
<DRIVERS>tore\Temp\{6a73caa8-caa8-6a73-6b93-8e6e9bba004d}\rminiv3.sys

Перемещает следующие файлы:

<DRIVERS>tore\Temp\{6a73caa8-caa8-6a73-6b93-8e6e9bba004d}\SETAD13.tmp в <DRIVERS>tore\Temp\{6a73caa8-caa8-6a73-6b93-8e6e9bba004d}\mirrorv3.inf
<DRIVERS>tore\Temp\{6a73caa8-caa8-6a73-6b93-8e6e9bba004d}\SETACE3.tmp в <DRIVERS>tore\Temp\{6a73caa8-caa8-6a73-6b93-8e6e9bba004d}\mirrorv3.dll
<DRIVERS>tore\INFCACHE.0 в <DRIVERS>tore\INFCACHE.1
<SYSTEM32>\SETB4ED.tmp в <SYSTEM32>\mirrorv3.dll
<DRIVERS>\SETB3E3.tmp в <DRIVERS>\rminiv3.sys
<DRIVERS>tore\Temp\{6a73caa8-caa8-6a73-6b93-8e6e9bba004d}\SETACB3.tmp в <DRIVERS>tore\Temp\{6a73caa8-caa8-6a73-6b93-8e6e9bba004d}\mirrorv3.cat
%TEMP%\{234cb8a0-8cf3-1f32-8674-c22af591a201}\SETAA43.tmp в %TEMP%\{234cb8a0-8cf3-1f32-8674-c22af591a201}\mirrorv3.cat
%TEMP%\{234cb8a0-8cf3-1f32-8674-c22af591a201}\SETAA13.tmp в %TEMP%\{234cb8a0-8cf3-1f32-8674-c22af591a201}\rminiv3.sys
%TEMP%\{234cb8a0-8cf3-1f32-8674-c22af591a201}\SETAA83.tmp в %TEMP%\{234cb8a0-8cf3-1f32-8674-c22af591a201}\mirrorv3.dll
<DRIVERS>tore\Temp\{6a73caa8-caa8-6a73-6b93-8e6e9bba004d}\SETAC84.tmp в <DRIVERS>tore\Temp\{6a73caa8-caa8-6a73-6b93-8e6e9bba004d}\rminiv3.sys
%TEMP%\{234cb8a0-8cf3-1f32-8674-c22af591a201}\SETAAB3.tmp в %TEMP%\{234cb8a0-8cf3-1f32-8674-c22af591a201}\mirrorv3.inf