Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\RWLN] 'Startup' = 'WLEventStartup'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\RWLN] 'Logon' = 'WLEventLogon'
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\RWLN] 'DllName' = 'RWLN.dll'
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\RManService] 'Start' = '00000002'
Malicious functions:
Creates and executes the following:
- '%PROGRAM_FILES%\Remote Manipulator System - Server\rutserv.exe' /start
- '%PROGRAM_FILES%\Remote Manipulator System - Server\rfusclient.exe' /server /start
- '%PROGRAM_FILES%\Remote Manipulator System - Server\rfusclient.exe' /tray
- '%PROGRAM_FILES%\Remote Manipulator System - Server\rutserv.exe'
- '%PROGRAM_FILES%\Remote Manipulator System - Server\rutserv.exe' /firewall
- '%PROGRAM_FILES%\Remote Manipulator System - Server\rfusclient.exe' /server /silentinstall
- '%TEMP%\installers.exe'
- '%PROGRAM_FILES%\Remote Manipulator System - Server\rfusclient.exe' /server /firewall
- '%PROGRAM_FILES%\Remote Manipulator System - Server\rutserv.exe' /silentinstall
Executes the following:
- '<SYSTEM32>\msiexec.exe' -Embedding D085E9A7D0F55CFC4E562481D4776881
- '<SYSTEM32>\msiexec.exe' /I "installers.msi" /qn
- '<SYSTEM32>\msiexec.exe' /x {11A90858-40BB-4858-A2DA-CA6495B5E907} /qn REBOOT=ReallySuppress
- '<SYSTEM32>\attrib.exe' +S +H "\Remote Manipulator System - Server"
- '<SYSTEM32>\attrib.exe' +S +H "%PROGRAM_FILES%\Remote Manipulator System - Server"
- '<SYSTEM32>\msiexec.exe' -Embedding 57B103A7C7B63CDCA10AD8B738C0F4D7 M Global\MSI0000
- '<SYSTEM32>\taskkill.exe' /f /im rutserv.exe
- '<SYSTEM32>\taskkill.exe' /f /im rfusclient.exe
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\1.tmp\installers.bat" "
- '<SYSTEM32>\msiexec.exe' /V
- '<SYSTEM32>\msiexec.exe' /x {61FFA475-24D5-44FB-A51F-39B699E3D82C} /qn REBOOT=ReallySuppress
- '<SYSTEM32>\chcp.com' 1251
Modifies file system :
Creates the following files:
- %PROGRAM_FILES%\Remote Manipulator System - Server\msvcp90.dll
- %PROGRAM_FILES%\Remote Manipulator System - Server\RIPCServer.dll
- %PROGRAM_FILES%\Remote Manipulator System - Server\help.chm
- %PROGRAM_FILES%\Remote Manipulator System - Server\dsfVorbisDecoder.dll
- %PROGRAM_FILES%\Remote Manipulator System - Server\EULA.rtf
- %PROGRAM_FILES%\Remote Manipulator System - Server\English.lg
- %PROGRAM_FILES%\Remote Manipulator System - Server\HookDrv.dll
- %PROGRAM_FILES%\Remote Manipulator System - Server\rfusclient.exe
- %WINDIR%\Installer\{11A90858-40BB-4858-A2DA-CA6495B5E907}\config_server_066CADD456D84808BDCEE928E4286C5B.exe
- %WINDIR%\Installer\{11A90858-40BB-4858-A2DA-CA6495B5E907}\stop_server_F11ADA9A6E8F4FE79139D84A6B091D47.exe
- %WINDIR%\Installer\MSI9.tmp
- <SYSTEM32>\RWLN.dll
- %WINDIR%\Installer\{11A90858-40BB-4858-A2DA-CA6495B5E907}\ARPPRODUCTICON.exe
- %WINDIR%\Installer\MSI7.tmp
- %WINDIR%\Installer\{11A90858-40BB-4858-A2DA-CA6495B5E907}\ROMServer.exe_84521F20C7744F7FAAC4E478858A721D.exe
- %WINDIR%\Installer\{11A90858-40BB-4858-A2DA-CA6495B5E907}\UNINST_Uninstall_R_3B1E3C8B7D0945898DA82CEEED02F0C7.exe
- %PROGRAM_FILES%\Remote Manipulator System - Server\rutserv.exe
- %TEMP%\~4.tmp
- %WINDIR%\Installer\MSI3.tmp
- C:\Config.Msi\30786.rbs
- %WINDIR%\Installer\MSI2.tmp
- %TEMP%\installers.msi
- %TEMP%\installers.exe
- %WINDIR%\Installer\30783.msi
- %TEMP%\1.tmp\installers.bat
- %PROGRAM_FILES%\Remote Manipulator System - Server\vp8encoder.dll
- %PROGRAM_FILES%\Remote Manipulator System - Server\Russian.lg
- %PROGRAM_FILES%\Remote Manipulator System - Server\msvcr90.dll
- %PROGRAM_FILES%\Remote Manipulator System - Server\vp8decoder.dll
- %PROGRAM_FILES%\Remote Manipulator System - Server\RWLN.dll
- %WINDIR%\Installer\MSI6.tmp
- %PROGRAM_FILES%\Remote Manipulator System - Server\dsfVorbisEncoder.dll
- %PROGRAM_FILES%\Remote Manipulator System - Server\Microsoft.VC90.CRT.manifest
Deletes the following files:
- %WINDIR%\Installer\30783.msi
- %WINDIR%\Installer\MSI9.tmp
- %TEMP%\installers.msi
- %TEMP%\1.tmp\installers.bat
- %TEMP%\installers.exe
- %TEMP%\~4.tmp
- %WINDIR%\Installer\MSI6.tmp
- %WINDIR%\Installer\MSI3.tmp
- %WINDIR%\Installer\MSI7.tmp
- C:\Config.Msi\30786.rbs
- %WINDIR%\Installer\MSI2.tmp
Network activity:
Connects to:
- 'rm#####ver.tektonit.ru':5655
- 'rm##sys.ru':80
TCP:
HTTP GET requests:
- rm##sys.ru/utils/inet_id_notify.php?te####
HTTP POST requests:
- rm##sys.ru/utils/inet_id_notify.php
UDP:
- DNS ASK rm#####ver.tektonit.ru
- DNS ASK rm##sys.ru
Miscellaneous:
Searches for the following windows:
- ClassName: '(null)' WindowName: '(null)'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'EDIT' WindowName: '(null)'
