Trojan.DownLoader4.26302

Technical Information

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Kaseya Agent Service Helper' = '"%PROGRAM_FILES%\Kaseya\Agent\KaUsrTsk.exe"'

Creates the following services:

[<HKLM>\SYSTEM\ControlSet001\Services\KaseyaAgent] 'Start' = '00000002'
[<HKLM>\SYSTEM\ControlSet001\Services\KaseyaAgent] 'ImagePath' = '"%PROGRAM_FILES%\Kaseya\Agent\AgentMon.exe"'

Malicious functions:

Creates and executes the following:

%PROGRAM_FILES%\Kaseya\Agent\AgentMon.exe -s
%PROGRAM_FILES%\Kaseya\Agent\KaUsrTsk.exe
%CommonProgramFiles%\InstallShield\Engine\6\Intel 32\IKernel.exe /REGSERVER -Embedding -RegServer

Modifies file system :

Creates the following files:

%ALLUSERSPROFILE%\Start Menu\Programs\Kaseya\Kaseya Agent.lnk
%PROGRAM_FILES%\InstallShield Installation Information\{48C76121-4F90-11D5-9884-0050BA85A903}\Setup.ini
%PROGRAM_FILES%\InstallShield Installation Information\{48C76121-4F90-11D5-9884-0050BA85A903}\setu10bf.rra
%PROGRAM_FILES%\Kaseya\Agent\KPrt137e.rra
%PROGRAM_FILES%\Kaseya\Agent\kGet142a.rra
%PROGRAM_FILES%\Kaseya\Agent\Agen13cc.rra
%PROGRAM_FILES%\Kaseya\Agent\KaUs139d.rra
%PROGRAM_FILES%\InstallShield Installation Information\{48C76121-4F90-11D5-9884-0050BA85A903}\layo1023.rra
%TEMP%\pft3.tmp\setup.log
%TEMP%\{48c76121-4f90-11d5-9884-0050ba85a903}\_IsR739.rra
%PROGRAM_FILES%\InstallShield Installation Information\{48C76121-4F90-11D5-9884-0050BA85A903}\data1042.rra
%PROGRAM_FILES%\InstallShield Installation Information\{48C76121-4F90-11D5-9884-0050BA85A903}\Setu10af.rra
%PROGRAM_FILES%\InstallShield Installation Information\{48C76121-4F90-11D5-9884-0050BA85A903}\Setu1090.rra
%PROGRAM_FILES%\InstallShield Installation Information\{48C76121-4F90-11D5-9884-0050BA85A903}\data1052.rra
%PROGRAM_FILES%\Kaseya\Agent\spor1478.rra
<DRIVERS>\kapf16ba.rra
<DRIVERS>\Kase16ab.rra
<DRIVERS>\KaPF168b.rra
<DRIVERS>\kase16d9.rra
%PROGRAM_FILES%\Kaseya\Agent\AgentMon.log
%PROGRAM_FILES%\Kaseya\Agent\KasError.log
%PROGRAM_FILES%\Kaseya\Agent\KaseyaD.ini
%PROGRAM_FILES%\Kaseya\Agent\LogP14d6.rra
%PROGRAM_FILES%\Kaseya\Agent\KEve14a7.rra
%PROGRAM_FILES%\Kaseya\Agent\Psap1488.rra
%PROGRAM_FILES%\Kaseya\Agent\KAge14f5.rra
%PROGRAM_FILES%\Kaseya\Agent\Kase15ff.rra
%PROGRAM_FILES%\Kaseya\Agent\Kase15ef.rra
<SYSTEM32>\kase1543.rra
%TEMP%\pft3.tmp\Setup.exe
%TEMP%\pft3.tmp\Setup.bmp
%TEMP%\pft3.tmp\data1.hdr
%TEMP%\pft3.tmp\setup.iss
%TEMP%\pft3.tmp\Setup.ini
%TEMP%\pft3.tmp\layout.bin
%TEMP%\pft3.tmp\data2.cab
%TEMP%\KaseyaD.ini
%TEMP%\KAgentSilent.exe
%TEMP%\KASetup.log
%TEMP%\ext2.tmp
%TEMP%\pft3.tmp\data1.cab
%TEMP%\pft3.tmp\pftw1.pkg
%TEMP%\plf1.tmp
%TEMP%\pft3.tmp\setup.inx
%TEMP%\{48c76121-4f90-11d5-9884-0050ba85a903}\KSet574.rra
%TEMP%\{48c76121-4f90-11d5-9884-0050ba85a903}\setu4e8.rra
%CommonProgramFiles%\InstallShield\IScript\iscrf7c8.rra
%TEMP%\{48c76121-4f90-11d5-9884-0050ba85a903}\Psap5a3.rra
%TEMP%\{48c76121-4f90-11d5-9884-0050ba85a903}\defa6bc.rra
%TEMP%\{48c76121-4f90-11d5-9884-0050ba85a903}\isrt65f.rra
%TEMP%\{48c76121-4f90-11d5-9884-0050ba85a903}\valu601.rra
%CommonProgramFiles%\InstallShield\Engine\6\Intel 32\temp.000
%TEMP%\IEC4.tmp
%TEMP%\pft3.tmp\ikernel.ex_
%CommonProgramFiles%\InstallShield\Engine\6\Intel 32\coref2f6.rra
%CommonProgramFiles%\InstallShield\Engine\6\Intel 32\iusef538.rra
%CommonProgramFiles%\InstallShield\Engine\6\Intel 32\objef4ea.rra
%CommonProgramFiles%\InstallShield\Engine\6\Intel 32\ctorf344.rra