Trojan.Siggen33.33410

Technical Information

Triggers a user-defined sigma rule:

02ee49e2-e294-4d0f-9278-f5b3212fc588
20f0ee37-5942-4e45-b7d5-c5b5db9df5cd
16a4c7b3-4681-49d0-8d58-3e9b796dcb43
d223b46b-5621-4037-88fe-fda32eead684
c8b00925-926c-47e3-beea-298fd563728e
85cce894-dd8b-4427-a958-5cc47a4dc9b9
1a31b18a-f00c-4061-9900-f735b96c99fc

To ensure autorun and distribution

Modifies the following registry keys

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'MsixHost' = '%TEMP%\MsixHost.exe'

Sets the following service settings

[HKLM\SYSTEM\CurrentControlSet\Services\RManService] 'Start' = '00000002'
[HKLM\SYSTEM\CurrentControlSet\Services\RManService] 'ImagePath' = '"%ProgramFiles(x86)%\Remote Utilities - Host\rutserv.exe" -service'

Creates the following services

'RManService' %ProgramFiles(x86)%\Remote Utilities - Host utserv.exe" -servic

Modifies file system

Creates the following files

%TEMP%\msixhost.exe
%WINDIR%\temp\msx_install.msi
%WINDIR%\installer\sourcehash{7909b304-45ed-452d-a7a6-3c67869864a1}
%WINDIR%\temp\~df3d6286016f34b5fa.tmp
%WINDIR%\temp\~dfa21d10708520e850.tmp
%WINDIR%\temp\~df9c95db932d82e355.tmp
%WINDIR%\temp\~df0605f470bc8ff1c9.tmp
%ProgramFiles(x86)%\remote utilities - host\rutserv.exe
%ProgramFiles(x86)%\remote utilities - host\rfusclient.exe
%ProgramFiles(x86)%\remote utilities - host\eventmsg.dll
%ProgramFiles(x86)%\remote utilities - host\vp8decoder.dll
%ProgramFiles(x86)%\remote utilities - host\eula.rtf
%ProgramFiles(x86)%\remote utilities - host\vp8encoder.dll
%ProgramFiles(x86)%\remote utilities - host\webmmux.dll
%ProgramFiles(x86)%\remote utilities - host\webmvorbisdecoder.dll
%ProgramFiles(x86)%\remote utilities - host\webmvorbisencoder.dll
%ProgramFiles(x86)%\remote utilities - host\licenses.txt
%ProgramFiles(x86)%\remote utilities - host\privacy_policy.rtf
%ProgramFiles(x86)%\remote utilities - host\libasset32.dll
%ProgramFiles(x86)%\remote utilities - host\libcodec32.dll
%ProgramFiles(x86)%\remote utilities - host\printer\x86\vccorlib120.dll
%ProgramFiles(x86)%\remote utilities - host\printer\x86\msvcr120.dll
%ProgramFiles(x86)%\remote utilities - host\printer\x86\msvcp120.dll
%ProgramFiles(x86)%\remote utilities - host\printer\x86\rupdpm.dll
%ProgramFiles(x86)%\remote utilities - host\printer\x86\ntprint.inf
%ProgramFiles(x86)%\remote utilities - host\printer\x86\rupd.ini
%ProgramFiles(x86)%\remote utilities - host\printer\x86\unidrv_rupd.hlp
%ProgramFiles(x86)%\remote utilities - host\printer\x86\unidrvui_rupd.dll
%ProgramFiles(x86)%\remote utilities - host\printer\x86\unires_vpd.dll
%ProgramFiles(x86)%\remote utilities - host\printer\x86\stdnames_vpd.gpd
%ProgramFiles(x86)%\remote utilities - host\printer\x86\unidrv_rupd.dll
%ProgramFiles(x86)%\remote utilities - host\printer\x86\rupd.gpd
%ProgramFiles(x86)%\remote utilities - host\printer\x86\printer.ico
%ProgramFiles(x86)%\remote utilities - host\printer\x86\rupd.lng
%ProgramFiles(x86)%\remote utilities - host\printer\x86\rupdui.dll
%ProgramFiles(x86)%\remote utilities - host\printer\x86\setupdrv.exe
%ProgramFiles(x86)%\remote utilities - host\printer\x64\vccorlib120.dll
%ProgramFiles(x86)%\remote utilities - host\printer\x64\printer.ico
%ProgramFiles(x86)%\remote utilities - host\printer\x64\msvcr120.dll
%ProgramFiles(x86)%\remote utilities - host\printer\x64\msvcp120.dll
%ProgramFiles(x86)%\remote utilities - host\printer\x64\rupdpm.dll
%ProgramFiles(x86)%\remote utilities - host\printer\x64\rupd.ini
%ProgramFiles(x86)%\remote utilities - host\printer\x64\rupd.gpd
%ProgramFiles(x86)%\remote utilities - host\printer\x64\rupd.lng
%ProgramFiles(x86)%\remote utilities - host\printer\x64\rupdui.dll
%ProgramFiles(x86)%\remote utilities - host\printer\x64\ntprint.inf
%ProgramFiles(x86)%\remote utilities - host\printer\x64\unidrv_rupd.hlp
%ProgramFiles(x86)%\remote utilities - host\printer\x64\unidrvui_rupd.dll
%ProgramFiles(x86)%\remote utilities - host\printer\x64\stdnames_vpd.gpd
%ProgramFiles(x86)%\remote utilities - host\printer\x64\unidrv_rupd.dll
%ProgramFiles(x86)%\remote utilities - host\printer\x64\unires_vpd.dll
%ProgramFiles(x86)%\remote utilities - host\printer\x64\setupdrv.exe
%ProgramFiles(x86)%\remote utilities - host\printer\common\fwproc.exe
%ProgramFiles(x86)%\remote utilities - host\printer\common\emf2pdf.dll
%ProgramFiles(x86)%\remote utilities - host\printer\common\pdfout.dll
%ProgramFiles(x86)%\remote utilities - host\printer\common\progressbar.exe
%ProgramFiles(x86)%\remote utilities - host\printer\common\printer.ico
%ProgramFiles(x86)%\remote utilities - host\printer\common\messagebox.exe
%ProgramFiles(x86)%\remote utilities - host\printer\common\vpdisp.exe
%ProgramFiles(x86)%\remote utilities - host\printer\common\vpdagent.exe
%ProgramFiles(x86)%\remote utilities - host\printer\common\vpd_sdk.dll
%ProgramFiles(x86)%\remote utilities - host\printer\common\srvinst.exe
%ProgramFiles(x86)%\remote utilities - host\printer\common\rupd.lng
%ProgramFiles(x86)%\remote utilities - host\printer\common\properties.exe
%WINDIR%\installer\{7909b304-45ed-452d-a7a6-3c67869864a1}\arpproducticon.exe
%WINDIR%\installer\{7909b304-45ed-452d-a7a6-3c67869864a1}\en_server_stop_b603677802d142c98e7a415b72132e14.exe
%WINDIR%\installer\{7909b304-45ed-452d-a7a6-3c67869864a1}\uninst_uninstall_r_3b1e3c8b7d0945898da82ceeed02f0c7.exe
%WINDIR%\installer\{7909b304-45ed-452d-a7a6-3c67869864a1}\en_server_settings_e3bfc76be38f4cf79d2ed7163b7decee.exe
%WINDIR%\installer\{7909b304-45ed-452d-a7a6-3c67869864a1}\en_server_start_85db64512c79429fa70ac6c0611579dd.exe
%ALLUSERSPROFILE%\remote utilities\msi\70840_{7909b304-45ed-452d-a7a6-3c67869864a1}\msx_install.msi
%ALLUSERSPROFILE%\remote utilities\install.log
%WINDIR%\temp\~dfc63579ab4741a1b0.tmp
%WINDIR%\temp\~dfec82c16444d1170d.tmp
%WINDIR%\temp\~dfc1f67c6ced306bf8.tmp
%WINDIR%\temp\~df997c159aac59ebd9.tmp
%WINDIR%\temp\~df33be12323b1c7cc6.tmp
%WINDIR%\temp\~df82fed4d0328ca859.tmp
%WINDIR%\temp\~dfac045b61e2180416.tmp
%WINDIR%\temp\~df5e6acf1b506db63f.tmp
%ALLUSERSPROFILE%\remote utilities\logs\rut_log_2026-08.html
%WINDIR%\syswow64\config\systemprofile\appdata\locallow\microsoft\cryptneturlcache\metadata\57c8edb95df3f0ad4ee2dc2b8cfd4157
%WINDIR%\syswow64\config\systemprofile\appdata\locallow\microsoft\cryptneturlcache\content\57c8edb95df3f0ad4ee2dc2b8cfd4157
%WINDIR%\syswow64\config\systemprofile\appdata\locallow\microsoft\cryptneturlcache\metadata\f59a01a8b782d93ea6991bc172ceffb1
%WINDIR%\syswow64\config\systemprofile\appdata\locallow\microsoft\cryptneturlcache\content\f59a01a8b782d93ea6991bc172ceffb1
%WINDIR%\syswow64\config\systemprofile\appdata\locallow\microsoft\cryptneturlcache\metadata\b039fea45cb4cc4bbacfc013c7c55604_50385f8eb1f713e33924a830d7a2a41c
%WINDIR%\syswow64\config\systemprofile\appdata\locallow\microsoft\cryptneturlcache\content\b039fea45cb4cc4bbacfc013c7c55604_50385f8eb1f713e33924a830d7a2a41c
%WINDIR%\syswow64\config\systemprofile\appdata\locallow\microsoft\cryptneturlcache\metadata\9cb4373a4252de8d2212929836304ec5_1ab74aa2e3a56e1b8ad8d3fec287554e
%WINDIR%\syswow64\config\systemprofile\appdata\locallow\microsoft\cryptneturlcache\content\9cb4373a4252de8d2212929836304ec5_1ab74aa2e3a56e1b8ad8d3fec287554e
%WINDIR%\syswow64\config\systemprofile\appdata\locallow\microsoft\cryptneturlcache\metadata\357f04ad41bcf5fe18fcb69f60c6680f_df8b1ccad690136970e760b4d18d549f
%WINDIR%\syswow64\config\systemprofile\appdata\locallow\microsoft\cryptneturlcache\content\357f04ad41bcf5fe18fcb69f60c6680f_df8b1ccad690136970e760b4d18d549f

Network activity

Connects to

'17#.#07.176.3':443
'17#.#07.176.239':80
'17#.#07.176.121':443
'17#.#07.176.31':443
'17#.#07.177.8':80
'17#.#07.178.6':80
'17#.#07.176.111':443
'17#.#07.177.52':80
'17#.#07.178.12':80
'17#.#07.176.66':80
'17#.#07.176.4':443
'17#.#07.176.89':443
'17#.#07.178.103':443
'17#.#07.177.47':443
'17#.#07.177.15':443
'17#.#07.176.170':80
'17#.#07.177.216':80
'17#.#07.178.38':443
'17#.#07.179.75':80
'17#.#07.176.66':443
'17#.#07.177.177':443
'17#.#07.178.36':443
'17#.#07.177.42':443
'17#.#07.178.89':80
'17#.#07.178.44':443
'17#.#07.178.58':443
'17#.#07.177.50':443
'17#.#07.177.131':80
'17#.#07.178.27':443
'17#.#07.177.6':80
'17#.#07.177.1':443
'17#.#07.176.2':80
'17#.#07.178.60':443
'17#.#07.179.25':80
'17#.#07.178.74':80
'17#.#07.186.17':443
'17#.#07.177.129':443
'17#.#07.176.145':80
'17#.#07.178.133':80
'17#.#07.178.116':443
'17#.#07.177.189':443
'17#.#07.177.8':443
'17#.#07.178.62':80
'17#.#07.178.68':443
'45.#.236.10':80
'17#.#07.178.6':443
'17#.#07.177.128':80
'17#.#07.178.24':443
'17#.#07.186.4':443
'17#.#07.180.73':80
'17#.#07.178.130':80
'17#.#07.177.10':80
'17#.#07.178.110':80
'17#.#07.180.37':80
'17#.#07.178.7':443
'17#.#07.179.33':443
'17#.#07.178.97':80
'17#.#07.178.114':80
'18#.#57.79.127':443
'17#.#07.179.105':80
'17#.#07.179.41':443
'17#.#07.179.216':80
'17#.#07.179.58':80
'13#.#8.39.219':443
'13#.#8.36.74':443
'17#.#07.177.170':443
'17#.#07.178.98':80
'17#.#07.179.133':80
'17#.#07.183.25':443
'17#.#07.179.164':80
'13#.28.36.5':443
'17#.#07.184.25':443
'17#.#07.179.2':443
'13#.#8.39.186':443
'17#.#07.190.34':443
'17#.#07.178.135':80
'18#.#9.122.234':80
'17#.#07.188.8':443
'17#.#07.183.67':443
'17#.#07.179.141':80
'91.##9.77.35':443
'17#.#07.179.44':443
'17#.#07.178.11':80
'13#.#8.36.110':443
'13#.28.37.1':443
'13#.#8.36.212':443
'17#.#07.178.127':80
'17#.#07.179.34':443
'17#.#07.178.177':443
'13#.#8.37.215':443
'17#.#07.179.8':80
'17#.#07.177.130':80
'17#.#07.179.22':80
'17#.#07.179.179':443
'17#.#07.182.32':443
'17#.#07.180.1':443
'17#.#07.180.10':80
'17#.#07.188.9':443
'17#.#07.178.81':80
'17#.#07.179.94':80
'17#.#07.190.231':443
'17#.#07.179.124':80
'18#.#57.77.50':443
'17#.#07.179.202':80
'17#.#07.182.7':443
'91.##9.77.43':443
'17#.#07.178.115':80
'18#.#57.78.130':443
'18#.#57.80.239':443
'17#.#07.179.67':80
'77.##.123.218':80
'17#.#07.188.24':443
'17#.#07.181.88':443
'18#.#57.77.45':443
'17#.#07.181.228':443
'45.#.236.2':80
'18#.#35.219.149':80
'13#.#8.36.254':443
'17#.#07.179.4':80
'13#.#8.38.21':443
'19#.22.98.0':443
'13#.#8.39.10':443
'91.##9.77.164':443
'13#.#8.36.22':443
'17#.#07.179.48':443
'91.##9.77.96':80
'13#.#8.38.137':443
'17#.#07.179.119':443
'18#.#57.77.8':443
'77.##.123.125':443
'17#.#07.188.48':443
'18#.#35.219.151':443
'17#.#07.180.63':443
'45.#.236.91':80
'18#.#37.207.100':80
'13#.#8.37.221':443
'13#.#8.38.199':443
'17#.#07.179.96':443
'91.#29.77.2':80
'17#.#07.181.33':443
'17#.#07.186.10':443
'17#.#07.182.33':443
'17#.#07.179.200':80
'19#.#2.99.98':443
'18#.#57.79.1':443
'77.##.123.37':80
'17#.#07.180.21':80
'18#.#74.172.139':443
'77.##.123.23':443
'13#.#8.37.141':443
'13#.#8.38.222':443
'19#.#2.99.75':443
'13#.28.37.2':443
'18#.#57.77.0':443
'13#.#8.37.50':443
'91.#29.77.2':443
'17#.#07.178.78':80
'91.##9.77.48':80
'17#.#07.191.2':443
'19#.#89.226.36':443
'18#.#9.122.226':443
'91.##9.77.121':80
'13#.#8.37.54':443
'77.##.123.221':443
'17#.#07.191.6':443
'77.#1.123.6':80
'13#.#8.36.218':443
'19#.#2.98.86':443
'77.##.123.117':443
'62.##.248.233':443
'45.#.237.245':80
'19#.#89.226.202':80
'13#.#8.36.233':443
'17#.#07.192.2':443
'13#.#8.37.235':443
'91.##9.77.205':443
'13#.#8.37.18':443
'18#.#57.77.54':443
'91.##9.77.45':80
'17#.#07.188.59':443
'13#.#8.39.39':443
'19#.#89.226.10':443
'77.##.123.38':443
'19#.#89.226.156':443
'13#.#8.37.245':443
'19#.#89.226.162':443
'13#.#8.39.133':443
'17#.#07.179.121':80
'77.##0.98.140':443
'19#.#89.226.4':443
'19#.#89.226.141':80
'13#.#8.37.118':443
'17#.#07.180.20':443
'19#.#89.226.194':443
'18#.#57.77.51':443
'13#.#8.37.212':443
'17#.#07.184.143':443
'13#.#8.37.111':443
'18#.#43.99.254':443
'18#.#57.80.12':443
'18#.#37.207.241':443
'91.##9.77.30':80
'13#.#8.37.254':443
'77.##.123.121':80
'77.#1.123.1':80
'13#.#8.39.120':443
'19#.#89.226.50':443
'80.##.241.20':443
'45.#.236.84':80
'13#.#8.38.68':443
'18#.#57.78.121':443
'82.##7.84.100':443
'77.##.123.21':443
'19#.#89.226.101':80
'91.##9.77.46':80
'79.##7.204.114':443
'13#.#8.38.45':443
'17#.#07.191.48':443
'91.##9.77.33':443
'13#.28.38.9':443
'17#.#07.191.10':80
'77.##.123.102':80
'79.##7.204.111':443
'19#.#89.226.77':443
'13#.#8.38.103':443
'17#.#07.180.253':443
'77.##.123.96':443
'13#.28.39.5':443
'17#.#07.181.32':443
'18#.#35.219.147':443
'19#.#89.226.234':443
'19#.#89.226.77':80
'45.#.237.35':80
'18#.#37.207.112':443
'77.##.123.150':443
'46.##6.163.119':443
'19#.#89.226.222':443
'80.##.241.48':443
'77.##.123.93':80
'18#.#43.99.222':80
'77.##.123.135':443
'91.##9.77.45':443
'45.#.236.3':80
'13#.28.38.2':443
'18#.#43.99.251':443
'18#.#43.99.235':443
'17#.#07.180.23':80
'62.#0.246.5':443
'18#.#43.99.220':80
'46.##6.166.30':443
'77.##.123.15':443
'77.##0.98.104':443
'18#.#57.80.2':443
'77.##.123.90':443
'77.##.123.100':443
'77.##.123.217':80
'91.##9.77.221':443
'77.##.123.119':443
'46.##6.162.209':443
'19#.#89.226.136':443
'18#.#37.207.108':80
'17#.#07.184.157':443
'19#.#89.226.60':443
'18#.#35.219.179':443
'82.##7.84.23':443
'82.##7.84.136':443
'19#.#89.226.96':443
'13#.#8.37.225':443
'18#.#57.77.29':443
'82.##7.84.93':443
'18#.#9.122.171':80
'19#.#89.226.138':443
'18#.#43.99.217':80
'91.##9.77.109':443
'18#.#35.219.207':443
'18#.#35.219.193':443
'19#.#2.98.99':443
'62.#0.246.4':443
'19#.#89.226.168':443
'18#.#37.207.104':443
'13#.#8.39.224':443
'17#.#07.178.15':443
'91.##9.77.34':80
'82.##7.84.111':443
'13#.28.36.3':443
'62.##.246.253':443
'18#.#35.219.11':443
'79.##7.204.248':443
'18#.#9.122.165':443
'17#.#07.178.21':443
'17#.#07.181.163':443
'13#.#8.36.10':443
'46.##6.162.217':443
'45.#.237.35':443
'18#.#37.207.44':443
'77.##.123.109':443
'18#.#35.219.130':443
'18#.#74.172.117':80
'62.##.248.135':443
'45.#.237.244':80
'89.##8.106.245':443
'18#.#35.219.107':80
'18#.#37.207.107':80
'80.##.241.245':5651
'18#.#35.219.115':443
'18#.#35.219.230':443
'19#.#89.226.160':80
'80.##.241.155':443
'46.##6.163.40':443
'62.##.246.10':443
'46.##6.166.2':443
'18#.#37.207.234':443
'45.#.237.32':80
'13#.#8.39.75':443
'17#.#07.188.10':443
'77.##0.98.243':443
'45.#.237.2':80
'79.##7.204.200':443
'18#.#74.172.13':443
'62.##.248.17':443
'46.##6.162.212':443
'80.#5.241.5':443
'18#.#35.219.238':443
'18#.#9.122.101':443
'46.##6.163.46':443
'79.##7.204.190':443
'18#.#74.172.35':80
'82.##7.84.99':443
'80.##.241.228':443
'18#.#37.207.245':80
'62.##.246.230':443
'79.##7.204.180':443
'18#.#37.207.251':443
'80.##.241.219':443
'91.#29.77.3':80
'18#.#9.122.188':80
'18#.#57.77.48':443
'62.##.246.25':443
'82.##7.84.86':443
'62.##.246.12':443
'79.##7.204.210':443
'79.##7.204.231':443
'46.##6.162.243':443
'89.##8.106.151':443
'62.##.248.119':443
'62.#0.248.9':443
'62.#0.246.1':443
'77.##0.98.105':443
'62.##.246.251':443
'80.##.241.117':443
'62.#0.248.3':443
'80.##.241.221':443
'46.##6.163.2':443
'89.##8.106.198':443
'89.##8.106.113':443
'62.##.246.16':443
'13#.#8.37.156':443
'19#.#89.226.217':443
'18#.#74.172.4':443
'18#.#35.219.221':443
'13#.#8.36.213':443
'77.##.123.24':443
'18#.#9.122.223':443
'18#.#35.219.153':443
'46.##6.166.21':443
'19#.#89.226.65':443
'18#.#35.219.110':443
'91.##9.77.26':80
'45.#.236.197':80
'13#.#8.39.222':443
'77.##.123.41':443
'17#.#07.182.162':443
'89.##8.106.161':443
'77.##.123.227':443
'18#.#74.172.2':80
'46.##6.162.155':443
'82.##7.84.130':443
'80.##.241.214':443
'19#.#89.226.32':443
'89.##8.106.125':443
'18#.#37.207.101':443
'46.##6.166.13':443
'77.##0.98.190':443
'82.##7.84.65':443
'77.##0.98.223':443
'62.##.246.24':80
'46.##6.163.100':443
'18#.#43.99.253':443
'18#.#74.172.30':443
'82.##7.84.32':443
'77.##.123.106':443
'18#.#9.122.250':443
'82.##7.84.58':443
'62.##.246.207':443
'80.##.241.163':443
'46.##6.166.150':443
'89.##8.106.215':443
'79.##7.204.253':443
'46.##6.163.41':443
'79.##7.204.100':443
'62.##.248.11':443
'62.##.246.244':443
'18#.#37.207.105':443
'46.##6.162.170':443
'79.##7.204.160':443
'18#.#35.219.148':443
'77.##.123.19':443
'13#.#8.39.73':80
'46.##6.162.247':443
'18#.#9.122.139':443
'46.##6.163.85':443
'79.##7.204.221':443
'13#.#8.37.205':443
'80.##.241.215':443
'13#.#8.37.217':443
'79.##7.204.233':443
'46.##6.162.180':443
'46.##6.162.144':443
'62.#0.248.2':443
'18#.#57.77.44':443
'46.##6.163.22':443
'19#.#89.226.43':443
'19#.#89.226.35':80
'46.##6.163.9':443
'46.##6.162.161':443
'19#.#89.226.27':443
'18#.#74.172.150':443
'82.##7.84.171':443
'80.##.241.178':443
'18#.#37.207.250':443
'18#.#74.172.135':80
'62.#0.248.6':443
'46.##6.163.90':443
'77.##0.98.100':443
'62.##.248.48':443
'18#.#35.219.152':443
'82.##7.84.190':443
'79.##7.204.170':443
'80.##.241.253':443
'18#.#37.207.111':443
'46.##6.166.104':443
'89.##8.106.110':443
'82.##7.84.200':443
'46.##6.166.141':443
'18#.#43.99.227':443
'62.##.248.77':443
'80.##.241.224':443
'46.##6.166.110':443
'18#.#74.172.137':443
'82.#17.84.9':443
'77.##0.98.222':443
'79.##7.204.137':443
'46.##6.166.9':443
'89.##8.106.238':443
'62.##.246.233':443
'80.##.241.36':443
'46.##6.166.42':443
'62.##.246.201':443
'77.##.123.108':443
'46.##6.166.125':443
'17#.#07.178.18':443
'77.##0.98.252':443
'89.##8.106.201':443
'46.##6.166.6':443
'18#.#37.207.248':443
'82.##7.84.70':443
'79.##7.204.151':443
'13#.#8.36.69':443
'62.##.248.142':443
'by##t.com':443
'xv###ken.com':443
'ob##nka.ua':443
'be###hange.ua':443
'me##.com':443
'na###gaz.com':443
'ku#a.io':443
'cr##to.com':443
'kr##en.com':443
'ok#.com':443
'bi###amp.net':443
'ob###off.com':443
'an###es.com.ua':443
'ne##x24.net':443
'bi##nce.com':443
'ne###coin.club':80
'in###oin.com':443
'ku##in.com':443
'ku##.expert':443
'ga#e.io':443
'me##c.ua':443
'un###o.com.ua':443
'81#1.uk':443
'81#1.uk':80
'ro####ash.com.ua':443
'ex##ange.ua':443
'dt#.net.ua':443
'pf#.gov.ua':443
'al##.com.ua':443
'ex####ge24.com.ua':443

TCP

HTTP GET requests

http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?87##############

Other

'17#.#07.176.3':443
'17#.#07.176.239':80
'17#.#07.176.121':443
'17#.#07.176.31':443
'17#.#07.177.8':80
'17#.#07.178.6':80
'17#.#07.177.52':80
'17#.#07.178.12':80
'17#.#07.176.66':80
'17#.#07.176.4':443
'17#.#07.176.89':443
'17#.#07.178.103':443
'17#.#07.177.47':443
'17#.#07.177.15':443
'17#.#07.176.170':80
'17#.#07.177.216':80
'17#.#07.179.75':80
'17#.#07.176.66':443
'17#.#07.177.177':443
'17#.#07.178.36':443
'17#.#07.178.89':80
'17#.#07.178.58':443
'17#.#07.177.50':443
'17#.#07.178.27':443
'17#.#07.177.6':80
'17#.#07.176.2':80
'17#.#07.179.25':80
'17#.#07.178.60':443
'17#.#07.186.17':443
'17#.#07.177.129':443
'17#.#07.178.74':80
'17#.#07.176.145':80
'17#.#07.178.133':80
'17#.#07.177.189':443
'17#.#07.177.8':443
'17#.#07.178.62':80
'45.#.236.10':80
'17#.#07.177.128':80
'17#.#07.178.24':443
'17#.#07.180.73':80
'17#.#07.177.10':80
'17#.#07.178.110':80
'17#.#07.180.37':80
'17#.#07.179.33':443
'17#.#07.178.97':80
'17#.#07.178.7':443
'17#.#07.186.4':443
'17#.#07.178.130':80
'17#.#07.179.105':80
'17#.#07.179.216':80
'18#.#57.79.127':443
'17#.#07.179.41':443
'17#.#07.178.114':80
'17#.#07.177.170':443
'13#.#8.36.74':443
'17#.#07.178.98':80
'17#.#07.179.58':80
'17#.#07.179.133':80
'17#.#07.183.25':443
'17#.#07.179.164':80
'13#.28.36.5':443
'17#.#07.184.25':443
'17#.#07.179.2':443
'17#.#07.190.34':443
'17#.#07.178.135':80
'17#.#07.188.8':443
'18#.#9.122.234':80
'17#.#07.179.141':80
'91.##9.77.35':443
'17#.#07.178.11':80
'13#.#8.36.110':443
'17#.#07.179.34':443
'17#.#07.178.127':80
'17#.#07.182.32':443
'17#.#07.177.130':80
'17#.#07.179.22':80
'17#.#07.180.10':80
'17#.#07.188.9':443
'17#.#07.179.94':80
'17#.#07.179.124':80
'18#.#57.77.50':443
'17#.#07.179.8':80
'13#.#8.37.215':443
'17#.#07.190.231':443
'17#.#07.178.81':80
'17#.#07.179.202':80
'18#.#57.80.239':443
'17#.#07.182.7':443
'17#.#07.178.115':80
'18#.#57.78.130':443
'17#.#07.179.67':80
'91.##9.77.43':443
'17#.#07.188.24':443
'77.##.123.218':80
'17#.#07.181.88':443
'18#.#57.77.45':443
'13#.#8.36.254':443
'17#.#07.179.4':80
'18#.#35.219.149':80
'17#.#07.181.228':443
'13#.#8.38.21':443
'45.#.236.2':80
'13#.#8.39.10':443
'91.##9.77.164':443
'17#.#07.179.48':443
'91.##9.77.96':80
'13#.#8.38.137':443
'45.#.236.91':80
'77.##.123.125':443
'18#.#57.77.8':443
'18#.#35.219.151':443
'17#.#07.180.63':443
'17#.#07.188.48':443
'18#.#37.207.100':80
'13#.#8.38.199':443
'91.#29.77.2':80
'17#.#07.186.10':443
'13#.#8.37.221':443
'17#.#07.181.33':443
'17#.#07.182.33':443
'17#.#07.179.200':80
'17#.#07.180.21':80
'77.##.123.23':443
'13#.#8.37.141':443
'19#.#2.99.75':443
'13#.28.37.2':443
'13#.#8.37.50':443
'91.#29.77.2':443
'17#.#07.178.78':80
'17#.#07.191.6':443
'91.##9.77.121':80
'13#.#8.36.218':443
'13#.#8.37.54':443
'19#.#2.98.86':443
'18#.#9.122.226':443
'19#.#89.226.36':443
'45.#.237.245':80
'13#.#8.36.233':443
'77.#1.123.6':80
'19#.#89.226.202':80
'17#.#07.192.2':443
'13#.#8.37.235':443
'91.##9.77.205':443
'18#.#57.77.54':443
'17#.#07.188.59':443
'13#.#8.37.245':443
'13#.#8.39.39':443
'17#.#07.179.121':80
'19#.#89.226.10':443
'19#.#89.226.162':443
'19#.#89.226.4':443
'77.##.123.38':443
'19#.#89.226.141':80
'13#.#8.37.118':443
'17#.#07.180.20':443
'18#.#57.80.12':443
'13#.#8.37.111':443
'18#.#57.77.51':443
'17#.#07.184.143':443
'91.##9.77.30':80
'18#.#37.207.241':443
'13#.#8.37.254':443
'19#.#89.226.50':443
'19#.#89.226.194':443
'77.##.123.121':80
'18#.#43.99.254':443
'13#.#8.38.68':443
'77.##.123.21':443
'13#.#8.38.45':443
'17#.#07.191.48':443
'91.##9.77.33':443
'13#.28.38.9':443
'17#.#07.191.10':80
'17#.#07.180.253':443
'19#.#89.226.101':80
'79.##7.204.111':443
'77.##.123.96':443
'77.##.123.102':80
'13#.28.39.5':443
'17#.#07.181.32':443
'13#.#8.38.103':443
'18#.#35.219.147':443
'19#.#89.226.234':443
'19#.#89.226.77':80
'45.#.237.35':80
'18#.#37.207.112':443
'80.##.241.48':443
'77.##.123.93':80
'77.##.123.135':443
'62.#0.246.5':443
'19#.#89.226.222':443
'13#.28.38.2':443
'17#.#07.180.23':80
'77.##.123.15':443
'77.##0.98.104':443
'18#.#57.80.2':443
'77.##.123.100':443
'91.##9.77.221':443
'77.##.123.217':80
'77.##.123.119':443
'17#.#07.184.157':443
'18#.#57.77.29':443
'18#.#37.207.108':80
'82.##7.84.23':443
'19#.#89.226.136':443
'18#.#35.219.179':443
'19#.#89.226.96':443
'13#.#8.37.225':443
'19#.#2.98.99':443
'18#.#9.122.171':80
'62.#0.246.4':443
'19#.#89.226.138':443
'91.##9.77.109':443
'18#.#35.219.207':443
'18#.#35.219.193':443
'18#.#37.207.104':443
'91.##9.77.34':80
'13#.28.36.3':443
'19#.#89.226.168':443
'79.##7.204.248':443
'45.#.237.35':443
'18#.#74.172.117':80
'18#.#37.207.44':443
'18#.#35.219.130':443
'45.#.237.244':80
'18#.#37.207.107':80
'89.##8.106.245':443
'46.##6.163.40':443
'18#.#35.219.107':80
'17#.#07.181.163':443
'18#.#35.219.230':443
'77.##0.98.243':443
'17#.#07.188.10':443
'45.#.237.32':80
'46.##6.166.2':443
'80.#5.241.5':443
'18#.#74.172.13':443
'79.##7.204.200':443
'18#.#37.207.234':443
'46.##6.162.212':443
'82.##7.84.99':443
'18#.#35.219.238':443
'80.##.241.228':443
'18#.#9.122.101':443
'79.##7.204.190':443
'18#.#57.77.48':443
'80.##.241.221':443
'13#.#8.36.10':443
'46.##6.162.243':443
'91.#29.77.3':80
'62.##.246.251':443
'62.#0.248.3':443
'89.##8.106.151':443
'89.##8.106.113':443
'79.##7.204.210':443
'18#.#35.219.115':443
'13#.#8.36.213':443
'19#.#89.226.217':443
'18#.#74.172.4':443
'45.#.236.197':80
'17#.#07.182.162':443
'77.##.123.227':443
'18#.#74.172.2':80
'46.##6.162.155':443
'18#.#35.219.110':443
'19#.#89.226.65':443
'18#.#37.207.101':443
'82.##7.84.130':443
'77.##.123.24':443
'18#.#35.219.153':443
'19#.#89.226.32':443
'82.##7.84.65':443
'77.##0.98.223':443
'77.##.123.106':443
'62.##.246.244':443
'18#.#37.207.105':443
'18#.#74.172.30':443
'79.##7.204.253':443
'80.##.241.163':443
'13#.#8.37.205':443
'79.##7.204.221':443
'46.##6.162.170':443
'13#.#8.37.217':443
'46.##6.163.100':443
'46.##6.162.247':443
'82.##7.84.171':443
'62.#0.248.2':443
'80.##.241.178':443
'18#.#57.77.44':443
'46.##6.163.9':443
'18#.#37.207.250':443
'19#.#89.226.35':80
'19#.#89.226.43':443
'79.##7.204.233':443
'80.##.241.215':443
'46.##6.163.85':443
'46.##6.163.22':443
'79.##7.204.100':443
'79.##7.204.160':443
'77.##0.98.100':443
'18#.#37.207.111':443
'18#.#74.172.135':80
'80.##.241.20':443
'19#.#89.226.27':443
'46.##6.162.180':443
'82.##7.84.58':443
'62.##.248.48':443
'79.##7.204.170':443
'82.##7.84.190':443
'82.##7.84.200':443
'89.##8.106.110':443
'80.##.241.224':443
'80.##.241.253':443
'80.##.241.36':443
'46.##6.166.141':443
'18#.#74.172.137':443
'79.##7.204.137':443
'77.##0.98.222':443
'89.##8.106.238':443
'46.##6.166.42':443
'46.##6.166.125':443
'62.##.246.201':443
'18#.#37.207.248':443
'77.##0.98.252':443
'46.##6.166.6':443
'89.##8.106.201':443
'79.##7.204.151':443
'by##t.com':443
'ob##nka.ua':443
'xv###ken.com':443
'ba##.gov.ua':443
'me##.com':443
'89.##8.106.125':443
'cr##to.com':443
'kr##en.com':443
'ku#a.io':443
'ne##x24.net':443
'an###es.com.ua':443
'ku##in.com':443
'in###oin.com':443
'me##c.ua':443
'un###o.com.ua':443
'81#1.uk':443
'ro####ash.com.ua':443
'dt#.net.ua':443
'bi##nce.com':443
'ok#.com':443
'bi###amp.net':443
'ex####ge24.com.ua':443
'ga#e.io':443
'18#.#43.99.253':443
'80.##.241.117':443
'ex##ange.ua':443
'ne###coin.club':80
'81#1.uk':80

UDP

DNS ASK by##t.com
DNS ASK xv###ken.com
DNS ASK ob##nka.ua
DNS ASK be###hange.ua
DNS ASK co#n.ua
DNS ASK me##.com
DNS ASK wi###wsupd.to
DNS ASK ku#a.io
DNS ASK cr####-exchange.ua
DNS ASK al##.com.ua
DNS ASK en####atom.com.ua
DNS ASK ds##.gov.ua
DNS ASK an###es.com.ua
DNS ASK ku##.com.ua
DNS ASK bi###amp.net
DNS ASK cr##to.com
DNS ASK kr##en.com
DNS ASK ba##.gov.ua
DNS ASK Ne###Coin.club
DNS ASK bi##oin.ua
DNS ASK ok#.com
DNS ASK ne##x24.net
DNS ASK ob###off.com
DNS ASK ua##btc.ua
DNS ASK bi##nce.com
DNS ASK co###ase.com
DNS ASK ku##in.com
DNS ASK in###oin.com
DNS ASK ez###.org.in
DNS ASK ex##ange.ua
DNS ASK na###gaz.com
DNS ASK ex####ge24.com.ua
DNS ASK pf#.gov.ua
DNS ASK ga#e.io
DNS ASK ro####ash.com.ua
DNS ASK dt#.net.ua
DNS ASK 81#1.uk
DNS ASK ku##.expert
DNS ASK un###o.com.ua
DNS ASK 10###net.com
DNS ASK me##c.ua

Miscellaneous

Creates and executes the following

'%TEMP%\msixhost.exe'
'%ProgramFiles(x86)%\remote utilities - host\rfusclient.exe' -msi_copy "%WINDIR%\Temp\msx_install.msi"
'%ProgramFiles(x86)%\remote utilities - host\rutserv.exe' /silentinstall
'%ProgramFiles(x86)%\remote utilities - host\rutserv.exe' -firewall
'%ProgramFiles(x86)%\remote utilities - host\rutserv.exe' /start
'%ProgramFiles(x86)%\remote utilities - host\rutserv.exe' -service
'%ProgramFiles(x86)%\remote utilities - host\rfusclient.exe'
'%ProgramFiles(x86)%\remote utilities - host\rfusclient.exe' /tray

Executes the following

'<SYSTEM32>\msiexec.exe' /i "%WINDIR%\Temp\msx_install.msi" /qn /norestart
'<SYSTEM32>\msiexec.exe' /i "%WINDIR%\Temp\msx_install.msi" /qn /norestart' (with hidden window)

技术

术语

教育培训

误区

Technical Information

Curing recommendations

Free trial