Техническая информация
Для обеспечения автозапуска и распространения:
Модифицирует следующие ключи реестра:
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\RWLN] 'Startup' = 'WLEventStartup'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\RWLN] 'Logon' = 'WLEventLogon'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\RWLN] 'DllName' = 'RWLN.dll'
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\RManService] 'Start' = '00000002'
Вредоносные функции:
Создает и запускает на исполнение:
- '%HOMEPATH%\systema.exe' /start
- '%HOMEPATH%\systema.exe'
- '%HOMEPATH%\explolerte.exe' /tray
- '%HOMEPATH%\systema.exe' /firewall
- '%HOMEPATH%\systema.exe' /stop
- '%HOMEPATH%\systema.exe' /silentuninstall
- '%HOMEPATH%\systema.exe' /silentinstall
Запускает на исполнение:
- '<SYSTEM32>\reg.exe' ADD "HKLM\SYSTEM\CurrentControlSet\Services\RManService" /f /v "DisplayName" /t REG_SZ /d "systema"
- '<SYSTEM32>\reg.exe' ADD "HKLM\SYSTEM\CurrentControlSet\Services\RManService" /f /v "ObjectName" /t REG_SZ /d "LocalSystem"
- '<SYSTEM32>\reg.exe' ADD "HKLM\SYSTEM\CurrentControlSet\Services\RManService" /f /v "ErrorControl" /t REG_DWORD /d 1
- '<SYSTEM32>\reg.exe' ADD "HKLM\SYSTEM\CurrentControlSet\Services\RManService" /f /v "ImagePath" /t REG_EXPAND_SZ /d ""%HOMEPATH%\systema.exe""
- '<SYSTEM32>\reg.exe' ADD "HKLM\SYSTEM\CurrentControlSet\Services\RManService" /f /v "FailureActions" /t REG_BINARY /d 00000000000000000000000001000000140000000100000088130000
- '<SYSTEM32>\reg.exe' ADD "HKLM\SYSTEM\CurrentControlSet\Services\RManService\Enum" /f /v "Count" /t REG_DWORD /d 1
- '<SYSTEM32>\reg.exe' ADD "HKLM\SYSTEM\CurrentControlSet\Services\RManService\Enum" /f /v "NextInstance" /t REG_DWORD /d 1
- '<SYSTEM32>\reg.exe' ADD "HKLM\SYSTEM\CurrentControlSet\Services\RManService\Security" /f /v "Security" /t REG_BINARY /d 01001480900000009c000000140000003000000002001c000100000002801400ff010f00010100000000000100000000020060000400000000001400fd01020001010000000000051200000000001800ff010f0001020000000000052000000020020000000014008d01020001010000000000050b00000000001800fd01020001020000000000052000000023020000010100000000000512000000010100000000000512000000
- '<SYSTEM32>\reg.exe' ADD "HKLM\SYSTEM\CurrentControlSet\Services\RManService\Enum" /f /v "0" /t REG_SZ /d "Root\LEGACY_RMANSERVICE\0000"
- '<SYSTEM32>\reg.exe' ADD "HKLM\SYSTEM\CurrentControlSet\Services\RManService" /f /v "Start" /t REG_DWORD /d 2
- '<SYSTEM32>\taskkill.exe' /f /im explolerte.exe
- '<SYSTEM32>\reg.exe' ADD "HKLM\SOFTWARE\Microsoft\systema" /f /v "notification" /t REG_BINARY /d fffe3c003f0078006d006c002000760065007200730069006f006e003d00220031002e0030002200200065006e0063006f00640069006e0067003d0022005500540046002d003100360022003f003e000d000a003c0072006d0073005f0069006e00650074005f00690064005f006e006f00740069006600690063006100740069006f006e002000760065007200730069006f006e003d0022003500350030003000320022003e003c007500730065003e0074007200750065003c002f007500730065003e003c0065006d00610069006c003e0073006500720067006f007200400069006e0062006f0078002e00720075003c002f0065006d00610069006c003e003c00690064003e007b00430046003400300043003700390043002d0043003200380041002d0034004300340038002d0041003800350038002d004200390041004100340035003200410039003000420034007d003c002f00690064003e003c00670065006e00650072006100740065005f006e00650077005f00700061007300730077006f00720064003e0074007200750065003c002f00670065006e00650072006100740065005f006e00650077005f00700061007300730077006f00720064003e003c00610073006b005f006900640065006e00740069006600690063006100740069006f006e003e00660061006c00730065003c002f00610073006b005f006900640065006e00740069006600690063006100740069006f006e003e003c00730065006e0074003e00660061006c00730065003c002f00730065006e0074003e003c00760065007200730069006f006e003e00350035003000300032003c002f00760065007200730069006f006e003e003c007000750062006c00690063005f006b00650079005f006d003e003c002f007000750062006c00690063005f006b00650079005f006d003e003c007000750062006c00690063005f006b00650079005f0065003e003c002f007000750062006c00690063005f006b00650079005f0065003e003c00700061007300730077006f00720064003e003c002f00700061007300730077006f00720064003e003c0069006e007400650072006e00650074005f00690064003e003c002f0069006e007400650072006e00650074005f00690064003e003c0064006900730063006c00610069006d00650072003e003c002f0064006900730063006c00610069006d00650072003e003c002f0072006d0073005f0069006e00650074005f00690064005f006e006f00740069006600690063006100740069006f006e003e000d000a00
- '<SYSTEM32>\cmd.exe' /c ""%HOMEPATH%/microsof.cmd" "
- '<SYSTEM32>\taskkill.exe' /f /im systema.exe
- '<SYSTEM32>\reg.exe' ADD "HKLM\SOFTWARE\Microsoft\systema" /f /v "InternetId" /t REG_BINARY /d fffe3c003f0078006d006c002000760065007200730069006f006e003d00220031002e0030002200200065006e0063006f00640069006e0067003d0022005500540046002d003100360022003f003e000d000a003c0072006d0073005f0069006e007400650072006e00650074005f00690064005f00730065007400740069006e00670073002000760065007200730069006f006e003d0022003500350030003000320022003e003c0069006e007400650072006e00650074005f00690064003e003c002f0069006e007400650072006e00650074005f00690064003e003c007500730065005f0069006e00650074005f0063006f006e006e0065006300740069006f006e003e00660061006c00730065003c002f007500730065005f0069006e00650074005f0063006f006e006e0065006300740069006f006e003e003c0069006e00650074005f007300650072007600650072003e003c002f0069006e00650074005f007300650072007600650072003e003c007500730065005f0063007500730074006f006d005f0069006e00650074005f007300650072007600650072003e00660061006c00730065003c002f007500730065005f0063007500730074006f006d005f0069006e00650074005f007300650072007600650072003e003c0069006e00650074005f00690064005f0070006f00720074003e0035003600350035003c002f0069006e00650074005f00690064005f0070006f00720074003e003c007500730065005f0069006e00650074005f00690064005f0069007000760036003e00660061006c00730065003c002f007500730065005f0069006e00650074005f00690064005f0069007000760036003e003c002f0072006d0073005f0069006e007400650072006e00650074005f00690064005f00730065007400740069006e00670073003e000d000a00
- '<SYSTEM32>\reg.exe' ADD "HKLM\SOFTWARE\Microsoft\systema" /f /v "CalendarRecordSettings" /t REG_BINARY /d fffe3c003f0078006d006c002000760065007200730069006f006e003d00220031002e0030002200200065006e0063006f00640069006e0067003d0022005500540046002d003100360022003f003e000d000a003c0073007200650065006e005f007200650063006f00720064005f006f007000740069006f006e002000760065007200730069006f006e003d0022003500350030003000320022003e003c006d00610069006e005f006f007000740069006f006e0073003e003c006100630074006900760065003e00660061006c00730065003c002f006100630074006900760065003e003c0069006e00740065007200760061006c005f00730068006f0074003e00360030003c002f0069006e00740065007200760061006c005f00730068006f0074003e003c00700072006f0074006500630074005f007200650063006f00720064003e00660061006c00730065003c002f00700072006f0074006500630074005f007200650063006f00720064003e003c0063006f006d007000720065007300730069006f006e005f007100750061006c006900740079003e00390030003c002f0063006f006d007000720065007300730069006f006e005f007100750061006c006900740079003e003c007300630061006c0065005f007100750061006c006900740079003e003100300030003c002f007300630061006c0065005f007100750061006c006900740079003e003c0063006f006d007000720065007300730069006f006e005f0074007900700065003e0030003c002f0063006f006d007000720065007300730069006f006e005f0074007900700065003e003c006d00610078005f00660069006c0065005f00730069007a0065003e003100300030003c002f006d00610078005f00660069006c0065005f00730069007a0065003e003c006100750074006f005f0063006c006500610072003e00660061006c00730065003c002f006100750074006f005f0063006c006500610072003e003c006100750074006f005f0063006c006500610072005f0064006100790073003e0030003c002f006100750074006f005f0063006c006500610072005f0064006100790073003e003c0075007300650064005f00660069006c0065005f006c0069006d00690074003e0074007200750065003c002f0075007300650064005f00660069006c0065005f006c0069006d00690074003e003c0061006c006c005f00660069006c00650073005f006c0069006d00690074005f006d0062003e0031003000300030003c002f0061006c006c005f00660069006c00650073005f006c0069006d00690074005f006d0062003e003c0064007200610077005f006400610074006100740069006d0065005f006f006e005f0069006d006100670065003e0074007200750065003c002f0064007200610077005f006400610074006100740069006d0065005f006f006e005f0069006d006100670065003e003c002f006d00610069006e005f006f007000740069006f006e0073003e003c007300630068006500640075006c00650073002f003e003c002f0073007200650065006e005f007200650063006f00720064005f006f007000740069006f006e003e000d000a00
- '<SYSTEM32>\reg.exe' ADD "HKLM\SYSTEM\CurrentControlSet\Services\RManService" /f /v "Type" /t REG_DWORD /d 272
- '<SYSTEM32>\reg.exe' ADD "HKLM\SOFTWARE\Microsoft\systema" /f /v "Options" /t REG_BINARY /d 545046301154524f4d5365727665724f7074696f6e7300095573654e5441757468080d53656375726974794c6576656c020304506f727403121614456e61626c654f7665726c617943617074757265080c53686f775472617949636f6e080642696e644950060d416e7920696e746572666163651343616c6c6261636b4175746f436f6e6e656374091743616c6c6261636b436f6e6e656374496e74657276616c021e084869646553746f70090c497046696c7465725479706502021750726f7465637443616c6c6261636b53657474696e6773081550726f74656374496e6574496453657474696e6773080f446f4e6f7443617074757265524450080755736549507636091141736b557365725065726d697373696f6e0816557365725065726d697373696f6e496e74657276616c031027134175746f416c6c6f775065726d697373696f6e08134e656564417574686f72697479536572766572081f41736b5065726d697373696f6e4f6e6c794966557365724c6f676765644f6e0811557365496e6574436f6e6e656374696f6e0813557365437573746f6d496e6574536572766572080a496e65744964506f727402000d557365496e6574496449507636081444697361626c6552656d6f7465436f6e74726f6c081344697361626c6552656d6f746553637265656e081344697361626c6546696c655472616e73666572080f44697361626c655265646972656374080d44697361626c6554656c6e6574081444697361626c6552656d6f746545786563757465081244697361626c655461736b4d616e61676572080e44697361626c654f7665726c6179080f44697361626c6553687574646f776e081444697361626c6552656d6f746555706772616465081544697361626c655072657669657743617074757265081444697361626c654465766963654d616e61676572080b44697361626c6543686174081344697361626c6553637265656e5265636f7264081044697361626c65415643617074757265081244697361626c6553656e644d657373616765080f44697361626c655265676973747279080d44697361626c65415643686174081544697361626c6552656d6f746553657474696e6773081544697361626c6552656d6f74655072696e74696e67080a44697361626c65526470080f4e6f7469667953686f7750616e656c08144e6f746966794368616e67655472617949636f6e08104e6f7469667942616c6c6f6e48696e74080f4e6f74696679506c6179536f756e6408064c6f6755736508055369644964061034313435382e31383637353836333433084c6963656e73657306b2524d532d462d66343537313742646237636245373032356543323230426161383830373738366269593253326459586c52664477776e4932314258554e585855494e4879636a6251355552513555516c5256626d492f5267594e5756594f425156676647414b4242355a5667344e56435a7a59774556415163664167454259524a6a4167494442776743415178394b53634d42464a655267344244483075505559474452395a565568764f794d315851593d0d50726f787953657474696e67731426010000efbbbf3c3f786d6c2076657273696f6e3d22312e302220656e636f64696e673d225554462d3136223f3e0d0a3c70726f78795f73657474696e67732076657273696f6e3d223535303032223e3c7573655f70726f78793e66616c73653c2f7573655f70726f78793e3c70726f78795f747970653e303c2f70726f78795f747970653e3c686f73743e3c2f686f73743e3c706f72743e383038303c2f706f72743e3c6e6565645f617574683e66616c73653c2f6e6565645f617574683e3c6e746d6c5f617574683e66616c73653c2f6e746d6c5f617574683e3c757365726e616d653e3c2f757365726e616d653e3c70617373776f72643e3c2f70617373776f72643e3c646f6d61696e3e3c2f646f6d61696e3e3c2f70726f78795f73657474696e67733e0d0a1144697361626c65496e7465726e65744964080b536166654d6f6465536574080000
- '<SYSTEM32>\reg.exe' ADD "HKLM\SOFTWARE\Microsoft\systema" /f /v "FUSClientPath" /t REG_SZ /d ""
Изменения в файловой системе:
Создает следующие файлы:
- %HOMEPATH%\vp8encoder.dll
- %HOMEPATH%\vp8decoder.dll
- %HOMEPATH%\microsof.cmd
- <SYSTEM32>\RWLN.dll
- %TEMP%\nse2.tmp\ExecDos.dll
- %HOMEPATH%\systema.exe
- %TEMP%\nse2.tmp\System.dll
- %HOMEPATH%\explolerte.exe
- %HOMEPATH%\RWLN.dll
- %HOMEPATH%\RIPCServer.dll
Удаляет следующие файлы:
- %TEMP%\nse2.tmp\System.dll
- %TEMP%\nse2.tmp\ExecDos.dll
Сетевая активность:
Подключается к:
- 'rm#####ver.tektonit.ru':563
- 'rm#####ver.tektonit.ru':5655
- 'rm##sys.ru':80
TCP:
Запросы HTTP GET:
- rm##sys.ru/utils/inet_id_notify.php?te####
Запросы HTTP POST:
- rm##sys.ru/utils/inet_id_notify.php
UDP:
- DNS ASK rm#####ver.tektonit.ru
- DNS ASK rm##sys.ru
Другое:
Ищет следующие окна:
- ClassName: '(null)' WindowName: '(null)'
