BackDoor.Radmin.142

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ROMwlnotify] 'Startup' = 'WLEventStartup'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ROMwlnotify] 'Logon' = 'WLEventLogon'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ROMwlnotify] 'DllName' = 'ROMwln.dll'

Создает следующие сервисы:

[<HKLM>\SYSTEM\ControlSet001\Services\ROMService] 'Start' = '00000002'

Вредоносные функции:

Создает и запускает на исполнение:

'%PROGRAM_FILES%\LiteManager Pro - Server\ROMServer.exe' /start
'%PROGRAM_FILES%\LiteManager Pro - Server\ROMFUSClient.exe' /server /start
'%PROGRAM_FILES%\LiteManager Pro - Server\ROMFUSClient.exe' /tray
'%PROGRAM_FILES%\LiteManager Pro - Server\ROMServer.exe'
'%PROGRAM_FILES%\LiteManager Pro - Server\ROMServer.exe' /silentinstall
'%PROGRAM_FILES%\LiteManager Pro - Server\ROMFUSClient.exe' /server /silentinstall
'%PROGRAM_FILES%\LiteManager Pro - Server\ROMServer.exe' /firewall
'%PROGRAM_FILES%\LiteManager Pro - Server\ROMFUSClient.exe' /server /firewall

Запускает на исполнение:

'<SYSTEM32>\attrib.exe' +h +s +r "%PROGRAM_FILES%\LiteManager Pro - Server"
'%WINDIR%\regedit.exe' /s 128.reg
'<SYSTEM32>\attrib.exe' +h +s +r "\LiteManager Pro - Server"
'<SYSTEM32>\attrib.exe' +h +s +r /d /s "\LiteManager Pro - Server\*.*"
'<SYSTEM32>\attrib.exe' +h +s +r /d /s "%PROGRAM_FILES%\LiteManager Pro - Server\*.*"
'<SYSTEM32>\msiexec.exe' /x {71FFA475-24D5-44FB-A51F-39B699E3D82C} /qn REBOOT=ReallySuppress
'<SYSTEM32>\cmd.exe' /c ""%TEMP%\7ZipSfx.000\install.cmd" "
'<SYSTEM32>\msiexec.exe' /V
'<SYSTEM32>\msiexec.exe' /I "LiteManager Pro - Server.msi" /qn
'<SYSTEM32>\ping.exe' 127.0.0.1

Изменения в файловой системе:

Создает следующие файлы:

%ALLUSERSPROFILE%\Start Menu\Programs\LiteManager Pro - Server\Start LM-Server.lnk
%PROGRAM_FILES%\LiteManager Pro - Server\files\ROMViewer.exe
%ALLUSERSPROFILE%\Start Menu\Programs\LiteManager Pro - Server\Stop LM-Server.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\LiteManager Pro - Server\Uninstall LiteManager - Server.lnk
%PROGRAM_FILES%\LiteManager Pro - Server\Russian.lg
%PROGRAM_FILES%\LiteManager Pro - Server\HookDrv.dll
%PROGRAM_FILES%\LiteManager Pro - Server\files\ROMServer.exe
%PROGRAM_FILES%\LiteManager Pro - Server\AledensoftIpcServer.dll
%WINDIR%\Installer\{71FFA475-24D5-44FB-A51F-39B699E3D82C}\config_server_B6BD2967C67B44649764F06ADFFD6458.exe
%WINDIR%\Installer\{71FFA475-24D5-44FB-A51F-39B699E3D82C}\stop_server_51B516B87C64408FA3C56354EA2277C2.exe
%TEMP%\7ZipSfx.000\RunaS
<SYSTEM32>\ROMwln.dll
%WINDIR%\Installer\{71FFA475-24D5-44FB-A51F-39B699E3D82C}\ARPPRODUCTICON.exe
%ALLUSERSPROFILE%\Start Menu\Programs\LiteManager Pro - Server\Settings for LM-Server.lnk
%WINDIR%\Installer\{71FFA475-24D5-44FB-A51F-39B699E3D82C}\ROMServer.exe_9D09B2BC25A2414CBD848E2B75898676.exe
%WINDIR%\Installer\{71FFA475-24D5-44FB-A51F-39B699E3D82C}\UNINST_Uninstall_L_9923DAF7F5B64E8493CF13B0BEF69CF5.exe
%PROGRAM_FILES%\LiteManager Pro - Server\Config.xml
%WINDIR%\25122050.txt
%WINDIR%\Installer\24711.msi
%TEMP%\7ZipSfx.000\Config.xml
%TEMP%\7ZipSfx.000\128.reg
%TEMP%\7ZipSfx.000\install.cmd
%TEMP%\7ZipSfx.000\LiteManager Pro - Server.msi
%PROGRAM_FILES%\LiteManager Pro - Server\ROMServer.exe
%PROGRAM_FILES%\LiteManager Pro - Server\ROMwln.dll
%PROGRAM_FILES%\LiteManager Pro - Server\EULA.rtf
%PROGRAM_FILES%\LiteManager Pro - Server\English.lg
C:\Config.Msi\24714.rbs
%WINDIR%\Installer\MSI1.tmp
%PROGRAM_FILES%\LiteManager Pro - Server\ROMFUSClient.exe
%PROGRAM_FILES%\LiteManager Pro - Server\ROMServer.map