Program.RemoteAdmin.888

Добавлен в вирусную базу Dr.Web: 2019-08-16

Описание добавлено: 2019-08-18

Technical Information

To ensure autorun and distribution

Creates the following services

[<HKLM>\System\CurrentControlSet\Services\RManService] 'Start' = '00000002'
[<HKLM>\System\CurrentControlSet\Services\RManService] 'ImagePath' = '"%ProgramFiles%\Remote Utilities - Host\rutserv.exe"'

Modifies file system

Creates the following files

%TEMP%\7zipsfx.000\host.msi
%ProgramFiles%\remote utilities - host\printer\x64\setupdrv.exe
%ProgramFiles%\remote utilities - host\printer\x64\rupui2.exe
%ProgramFiles%\remote utilities - host\printer\x64\progress.exe
%ProgramFiles%\remote utilities - host\printer\x64\fwproc_x64.exe
%ProgramFiles%\remote utilities - host\printer\x64\rup.ini
%ProgramFiles%\remote utilities - host\printer\x86\unidrv_rup.hlp
%ProgramFiles%\remote utilities - host\printer\x86\rup_s.lng
%ProgramFiles%\remote utilities - host\printer\x86\rup.lng
%ProgramFiles%\remote utilities - host\printer\x64\vpdagent_x64.exe
%ProgramFiles%\remote utilities - host\printer\x64\srvinst_x64.exe
%ProgramFiles%\remote utilities - host\printer\x86\uninstall.cmd
%ProgramFiles%\remote utilities - host\printer\x86\install.cmd
%ProgramFiles%\remote utilities - host\printer\x86\ntprint.inf
%ProgramFiles%\remote utilities - host\printer\x86\unires_vpd.dll
%ProgramFiles%\remote utilities - host\printer\x86\unidrvui_rup.dll
%ProgramFiles%\remote utilities - host\printer\x86\unidrv_rup.dll
%ProgramFiles%\remote utilities - host\printer\x86\rupui.dll
%ProgramFiles%\remote utilities - host\printer\x86\ruppm.dll
%ProgramFiles%\remote utilities - host\printer\x86\stdnames_vpd.gpd
%ProgramFiles%\remote utilities - host\french.lg
%ProgramFiles%\remote utilities - host\printer\x64\ruppm.dll
%TEMP%\killself.bat
%ProgramFiles%\remote utilities - host\logs\rms_log_2019-08.html
%PROGRAMDATA%\remote utilities\msi\68001_{e945283b-758c-4a40-b851-1066d0e49ea8}\host.msi
%WINDIR%\installer\{e945283b-758c-4a40-b851-1066d0e49ea8}\en_server_start_85db64512c79429fa70ac6c0611579dd.exe
%WINDIR%\installer\{e945283b-758c-4a40-b851-1066d0e49ea8}\en_server_settings_e3bfc76be38f4cf79d2ed7163b7decee.exe
%WINDIR%\installer\{e945283b-758c-4a40-b851-1066d0e49ea8}\uninst_uninstall_r_3b1e3c8b7d0945898da82ceeed02f0c7.exe
%WINDIR%\installer\{e945283b-758c-4a40-b851-1066d0e49ea8}\en_server_stop_b603677802d142c98e7a415b72132e14.exe
%WINDIR%\installer\{e945283b-758c-4a40-b851-1066d0e49ea8}\arpproducticon.exe
%ProgramFiles%\remote utilities - host\printer\x64\unidrv_rup.hlp
%ProgramFiles%\remote utilities - host\printer\x64\rup_s.lng
%ProgramFiles%\remote utilities - host\printer\x64\rup.lng
%ProgramFiles%\remote utilities - host\printer\x64\stdnames_vpd.gpd
%ProgramFiles%\remote utilities - host\printer\x64\rup.gpd
%ProgramFiles%\remote utilities - host\printer\x64\uninstall.cmd
%ProgramFiles%\remote utilities - host\printer\x64\install.cmd
%ProgramFiles%\remote utilities - host\printer\x64\ntprint.inf
%ProgramFiles%\remote utilities - host\printer\x64\unires_vpd.dll
%ProgramFiles%\remote utilities - host\printer\x64\unidrvui_rup.dll
%ProgramFiles%\remote utilities - host\printer\x64\unidrv_rup.dll
%ProgramFiles%\remote utilities - host\printer\x86\vpdagent.exe
%ProgramFiles%\remote utilities - host\printer\x86\rup.gpd
%ProgramFiles%\remote utilities - host\printer\x86\srvinst.exe
%ProgramFiles%\remote utilities - host\printer\x86\setupdrv.exe
%ProgramFiles%\remote utilities - host\printer\x86\rupui2.exe
%ProgramFiles%\remote utilities - host\rutserv.exe
%ProgramFiles%\remote utilities - host\hebrew.lg
%ProgramFiles%\remote utilities - host\spanish.lg
%ProgramFiles%\remote utilities - host\eula.rtf
%ProgramFiles%\remote utilities - host\ripcserver.dll
%ProgramFiles%\remote utilities - host\rwln.dll
%ProgramFiles%\remote utilities - host\english.lg
%ProgramFiles%\remote utilities - host\vp8decoder.dll
%ProgramFiles%\remote utilities - host\rfusclient.exe
%ProgramFiles%\remote utilities - host\monitor\x64\drvinstaller64.exe
%ProgramFiles%\remote utilities - host\polish.lg
%ProgramFiles%\remote utilities - host\monitor\x64\lockscr.cat
%ProgramFiles%\remote utilities - host\monitor\x64\lockscr.inf
%ProgramFiles%\remote utilities - host\monitor\x64\lockscr.sys
%ProgramFiles%\remote utilities - host\monitor\x86\drvinstaller32.exe
%ProgramFiles%\remote utilities - host\monitor\x86\lockscr.cat
%ProgramFiles%\remote utilities - host\monitor\x86\lockscr.inf
%ProgramFiles%\remote utilities - host\monitor\x86\lockscr.sys
%TEMP%\7zipsfx.000\installer.exe
%WINDIR%\temp\cab7f38.tmp
%ProgramFiles%\remote utilities - host\printer\x64\rupui.dll
%ProgramFiles%\remote utilities - host\japanese.lg
%ProgramFiles%\remote utilities - host\arabic.lg
%ProgramFiles%\remote utilities - host\turkish.lg
%ProgramFiles%\remote utilities - host\printer\x86\progress.exe
%ProgramFiles%\remote utilities - host\printer\x86\fwproc.exe
%ProgramFiles%\remote utilities - host\printer\x86\rup.ini
%ProgramFiles%\remote utilities - host\portuguese.lg
%ProgramFiles%\remote utilities - host\webmvorbisencoder.dll
%ProgramFiles%\remote utilities - host\webmvorbisdecoder.dll
%ProgramFiles%\remote utilities - host\webmmux.dll
%ProgramFiles%\remote utilities - host\vp8encoder.dll
%ProgramFiles%\remote utilities - host\chinese simplified.lg
%ProgramFiles%\remote utilities - host\danish.lg
%ProgramFiles%\remote utilities - host\swedish.lg
%ProgramFiles%\remote utilities - host\norwegian.lg
%ProgramFiles%\remote utilities - host\korean.lg
%ProgramFiles%\remote utilities - host\italian.lg
%ProgramFiles%\remote utilities - host\dutch.lg
%ProgramFiles%\remote utilities - host\czech.lg
%ProgramFiles%\remote utilities - host\chinese traditional.lg
%ProgramFiles%\remote utilities - host\portuguese, brazilian.lg
%ProgramFiles%\remote utilities - host\german.lg
%WINDIR%\temp\tar7f39.tmp

Deletes the following files

%TEMP%\7zipsfx.000\installer.exe
%TEMP%\7zipsfx.000\host.msi
%WINDIR%\temp\cab7f38.tmp
%WINDIR%\temp\tar7f39.tmp

Network activity

TCP

HTTP GET requests

http://se####.#emoteutilities.com/utils/inet_id_notify.php?te####

UDP

DNS ASK se####.#emoteutilities.com
DNS ASK id.####teutilities.com

Miscellaneous

Creates and executes the following

'%TEMP%\7zipsfx.000\installer.exe' /rsetup
'%ProgramFiles%\remote utilities - host\rfusclient.exe' -msi_copy "%TEMP%\7ZipSfx.000\host.msi"
'%ProgramFiles%\remote utilities - host\rutserv.exe' /silentinstall
'%ProgramFiles%\remote utilities - host\rutserv.exe' /firewall
'%ProgramFiles%\remote utilities - host\rutserv.exe' /start
'%ProgramFiles%\remote utilities - host\rutserv.exe'
'%ProgramFiles%\remote utilities - host\rfusclient.exe' /tray
'%ProgramFiles%\remote utilities - host\rfusclient.exe'
'%TEMP%\7zipsfx.000\installer.exe' /rsetup' (with hidden window)

Executes the following

'<SYSTEM32>\msiexec.exe' /i "%TEMP%\7ZipSfx.000\host.msi" /qn
'<SYSTEM32>\cmd.exe' /c %TEMP%\killself.bat

Технологии

Термины

Обучение и просвещение

Мифы

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней