Техническая информация
Для обеспечения автозапуска и распространения:
Создает или изменяет следующие файлы:
- %HOMEPATH%\Start Menu\Programs\Startup\UVNC.lnk
Вредоносные функции:
Для обхода брандмауэра удаляет или модифицирует следующие ключи реестра:
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] 'C:\cmi_tmp\UVNC\winvnc.exe' = 'C:\cmi_tmp\UVNC\winvnc.exe:*:Enabled:WI...
Для затруднения выявления своего присутствия в системе
блокирует:
- Средство контроля пользовательских учетных записей (UAC)
Запускает на исполнение:
- '<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="WINVNC" dir=out action=allow program="C:\cmi_tmp\UVNC\winvnc.exe"
- '%WINDIR%\regedit.exe' /s "C:\cmi_tmp\UVNC\DisableUAC.reg
- 'C:\cmi_tmp\UVNC\taskkill.exe' /im winvnc.exe /f /t
- '<SYSTEM32>\cmd.exe' /c ""C:\cmi_tmp\UVNC\connect_vnc.bat" "
- '<SYSTEM32>\netsh.exe' firewall add allowedprogram "C:\cmi_tmp\UVNC\winvnc.exe" WINVNC ENABLE
- '<SYSTEM32>\netsh.exe' advfirewall firewall add rule name="WINVNC" dir=in action=allow program="C:\cmi_tmp\UVNC\winvnc.exe"
Изменения в файловой системе:
Создает следующие файлы:
- C:\cmi_tmp\UVNC\unins000.exe
- C:\cmi_tmp\UVNC\unins000.dat
- C:\cmi_tmp\UVNC\testauth.exe
- C:\cmi_tmp\UVNC\unins000.msg
- C:\cmi_tmp\UVNC\ldapauth9x.dll
- C:\cmi_tmp\UVNC\Whatsnew.rtf
- C:\cmi_tmp\UVNC\vncviewer.exe
- C:\cmi_tmp\UVNC\logmessages.dll
- C:\cmi_tmp\UVNC\logging.dll
- C:\cmi_tmp\UVNC\Licence.txt
- C:\cmi_tmp\UVNC\runonce.reg
- C:\cmi_tmp\UVNC\setpasswd.exe
- C:\cmi_tmp\UVNC\setcad.exe
- C:\cmi_tmp\UVNC\uninstall.bat
- C:\cmi_tmp\UVNC\ldapauthnt4.dll
- C:\cmi_tmp\UVNC\unins001.msg
- C:\cmi_tmp\UVNC\unins001.exe
- C:\cmi_tmp\UVNC\unins001.dat
- C:\cmi_tmp\UVNC\uvnc\uvnclaunch.ini
- %HOMEPATH%\Desktop\UVNC.lnk
- %HOMEPATH%\Desktop\Remove UVNC.lnk
- C:\cmi_tmp\UVNC\UVNC_Launch.exe
- C:\cmi_tmp\UVNC\DisableUAC.reg
- C:\cmi_tmp\UVNC\update.bat
- C:\cmi_tmp\UVNC\Licence.rtf
- C:\cmi_tmp\UVNC\EnableUAC.reg
- C:\cmi_tmp\UVNC\repeater.exe
- C:\cmi_tmp\UVNC\options.vnc
- C:\cmi_tmp\UVNC\nircmd.exe
- C:\cmi_tmp\UVNC\taskkill.bat
- C:\cmi_tmp\UVNC\SecureVNCPluginARC4.dsm
- C:\cmi_tmp\UVNC\SecureVNCPlugin.dsm
- C:\cmi_tmp\UVNC\taskkill.exe
- C:\cmi_tmp\UVNC\vnchooks.dll
- C:\cmi_tmp\UVNC\uvnc_settings.exe
- C:\cmi_tmp\UVNC\ultravnc.ini
- C:\cmi_tmp\UVNC\MSRC4Plugin.dsm
- C:\cmi_tmp\UVNC\MSLogonACL.exe
- C:\cmi_tmp\UVNC\mslogon.log
- C:\cmi_tmp\UVNC\Readme.txt
- C:\cmi_tmp\UVNC\SCHook.dll
- C:\cmi_tmp\UVNC\remove.bat
- C:\cmi_tmp\UVNC\Readme_dsm.txt
- C:\cmi_tmp\UVNC\Whatsnew.txt
- C:\cmi_tmp\UVNC\install.bat
- C:\cmi_tmp\UVNC\connect_vnc_2.bat
- C:\cmi_tmp\UVNC\connect_vnc.bat
- C:\cmi_tmp\UVNC\Install.iip
- C:\cmi_tmp\UVNC\ldapauth.dll
- C:\cmi_tmp\UVNC\launchvnc.bat
- C:\cmi_tmp\UVNC\Install.iit
- C:\cmi_tmp\UVNC\@startvnc.bat
- C:\cmi_tmp\UVNC\workgrpdomnt4.dll
- C:\cmi_tmp\UVNC\winvnc.exe
- C:\cmi_tmp\UVNC\authadmin.dll
- C:\cmi_tmp\UVNC\check_install.exe
- C:\cmi_tmp\UVNC\cad.exe
- C:\cmi_tmp\UVNC\authSSP.dll
Другое:
Ищет следующие окна:
- ClassName: 'RegEdit_RegEdit' WindowName: ''
- ClassName: '' WindowName: ''
- ClassName: 'EDIT' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''
