FÜR NUTZER

Schließen

Meine Bibliothek
Meine Bibliothek

+ Zur Bibliothek hinzufügen

Suche
Suche

Support
Support 24/7 | Regeln zur Anfragenübermittlung

Schreiben Sie uns

Online-Formular

Telefon

+49 (0) 170 488 40 28

Forum

Ihre Anfragen

Neue Anfrage

Rufen Sie uns an

+7 (495) 789-45-86

Profil

DE

RU CN DE EN ES FR IT JP KZ UZ PL BY ID
Schließen
Services
Scanner
Dr.Web vxCube
Testversion
Virenbibliothek
Wissensdatenbank

Technologies

Begriffe

Schulung und Training

Mythen

News

Trojan.Siggen10.44833

Added to the Dr.Web virus database: 2020-11-03

Virus description added:

Technical Information

To ensure autorun and distribution
Modifies the following registry keys
  • [<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'KASHMNDS0452125478306675' = '"%ProgramFiles(x86)%\Kaseya\MNDS0452125478306675\KaUsrTsk.exe"'
Sets the following service settings
  • [<HKLM>\System\CurrentControlSet\Services\KAMNDS0452125478306675] 'Start' = '00000002'
  • [<HKLM>\System\CurrentControlSet\Services\KAMNDS0452125478306675] 'ImagePath' = '"%ProgramFiles(x86)%\Kaseya\MNDS0452125478306675\AgentMon.exe"'
  • [<HKLM>\System\CurrentControlSet\Services\KAENDMNDS0452125478306675] 'Start' = '00000002'
  • [<HKLM>\System\CurrentControlSet\Services\KAENDMNDS0452125478306675] 'ImagePath' = '"%ProgramFiles(x86)%\Kaseya\MNDS0452125478306675\Endpoint\KaseyaEndpoint.exe"'
  • [<HKLM>\System\CurrentControlSet\Services\KAPFA] 'ImagePath' = '<DRIVERS>\KAPFA.SYS'
Creates the following services
  • 'KAMNDS0452125478306675' "%ProgramFiles(x86)%\Kaseya\MNDS0452125478306675\AgentMon.exe"
  • 'KAMNDS0452125478306675' %ProgramFiles(x86)%\Kaseya\MNDS0452125478306675\AgentMon.exe
  • 'KAENDMNDS0452125478306675' "%ProgramFiles(x86)%\Kaseya\MNDS0452125478306675\Endpoint\KaseyaEndpoint.exe"
  • 'KAENDMNDS0452125478306675' %ProgramFiles(x86)%\Kaseya\MNDS0452125478306675\Endpoint\KaseyaEndpoint.exe
  • 'KAPFA' <DRIVERS>\KAPFA.SYS
Modifies file system
Creates the following files
  • %TEMP%\kcssetup.dat
  • %ProgramFiles(x86)%\kaseya\mnds0452125478306675\extensions\scripts\socket.lua
  • %ProgramFiles(x86)%\kaseya\mnds0452125478306675\extensions\scripts\ssl.lua
  • %ProgramFiles(x86)%\kaseya\mnds0452125478306675\extensions\scripts\totypes.lua
  • %ProgramFiles(x86)%\kaseya\mnds0452125478306675\extensions\scripts\utility.lua
  • %ProgramFiles(x86)%\kaseya\mnds0452125478306675\extensions\scripts\xmltolua.lua
  • %ProgramFiles(x86)%\kaseya\mnds0452125478306675\extensions\scripts\xpath.lua
  • %ProgramFiles(x86)%\kaseya\mnds0452125478306675\extensions\scripts\mime\core.dll
  • %ProgramFiles(x86)%\kaseya\mnds0452125478306675\extensions\scripts\socket\core.dll
  • %ProgramFiles(x86)%\kaseya\mnds0452125478306675\extensions\scripts\socket\ftp.lua
  • %ProgramFiles(x86)%\kaseya\mnds0452125478306675\extensions\scripts\socket\http.lua
  • %ProgramFiles(x86)%\kaseya\mnds0452125478306675\extensions\scripts\socket\smtp.lua
  • %ProgramFiles(x86)%\kaseya\mnds0452125478306675\extensions\scripts\socket\tp.lua
  • %ProgramFiles(x86)%\kaseya\mnds0452125478306675\extensions\lualib.dll
  • %ProgramFiles(x86)%\kaseya\mnds0452125478306675\extensions\scripts\socket\url.lua
  • %ProgramFiles(x86)%\kaseya\mnds0452125478306675\database\schedules.db
  • %ProgramFiles(x86)%\kaseya\mnds0452125478306675\database\procs.db
  • %ProgramFiles(x86)%\kaseya\mnds0452125478306675\drivers\demoforge\068\dfmirage.cat
  • %ProgramFiles(x86)%\kaseya\mnds0452125478306675\drivers\demoforge\068\dfmirage.dll
  • %ProgramFiles(x86)%\kaseya\mnds0452125478306675\drivers\demoforge\068\dfmirage.inf
  • %ProgramFiles(x86)%\kaseya\mnds0452125478306675\drivers\demoforge\068\dfmirage.sys
  • %ProgramFiles(x86)%\kaseya\mnds0452125478306675\drivers\demoforge\105\x64\dfmirage.dll
  • %ProgramFiles(x86)%\kaseya\mnds0452125478306675\drivers\demoforge\105\x64\dfmirage.sys
  • %ProgramFiles(x86)%\kaseya\mnds0452125478306675\drivers\demoforge\105\x86\dfmirage.dll
  • %ProgramFiles(x86)%\kaseya\mnds0452125478306675\drivers\demoforge\105\x86\dfmirage.sys
  • %ProgramFiles(x86)%\kaseya\mnds0452125478306675\drivers\demoforge\105\dfmirage.cat
  • %ProgramFiles(x86)%\kaseya\mnds0452125478306675\drivers\demoforge\105\dfmirage.inf
  • %ProgramFiles(x86)%\kaseya\mnds0452125478306675\extensions\scripts\scriptrunner.lua
  • %ProgramFiles(x86)%\kaseya\mnds0452125478306675\extensions\scripts\showmessage.lua
  • %ProgramFiles(x86)%\kaseya\mnds0452125478306675\extensions\scripts\sconvert.lua
  • %ProgramFiles(x86)%\kaseya\mnds0452125478306675\extensions\scripts\scheduler.lua
  • %ProgramFiles(x86)%\kaseya\mnds0452125478306675\extensions\scripts\mime.lua
  • %ProgramFiles(x86)%\kaseya\mnds0452125478306675\kaseyafw.ini
  • %ProgramFiles(x86)%\kaseya\mnds0452125478306675\custom\online.ico
  • %ProgramFiles(x86)%\kaseya\mnds0452125478306675\custom\blink.ico
  • %ProgramFiles(x86)%\kaseya\mnds0452125478306675\custom\noremote.ico
  • %ProgramFiles(x86)%\kaseya\mnds0452125478306675\custom\offline.ico
  • %ProgramFiles(x86)%\kaseya\mnds0452125478306675\curl.exe
  • %ProgramFiles(x86)%\kaseya\mnds0452125478306675\libeay32.dll
  • %ProgramFiles(x86)%\kaseya\mnds0452125478306675\ssleay32.dll
  • %ProgramFiles(x86)%\kaseya\mnds0452125478306675\redist\sas.dll
  • %ProgramFiles(x86)%\kaseya\mnds0452125478306675\extensions\klua.dll
  • %ProgramFiles(x86)%\kaseya\mnds0452125478306675\extensions\kluamessages.dll
  • %ProgramFiles(x86)%\kaseya\mnds0452125478306675\extensions\lsqlite3.dll
  • %ProgramFiles(x86)%\kaseya\mnds0452125478306675\drivers\demoforge\mirrinst32.exe
  • %ProgramFiles(x86)%\kaseya\mnds0452125478306675\extensions\scripts\ssl\https.lua
  • %ProgramFiles(x86)%\kaseya\mnds0452125478306675\extensions\lua.exe
  • %ProgramFiles(x86)%\kaseya\mnds0452125478306675\extensions\scripts\audit.lua
  • %ProgramFiles(x86)%\kaseya\mnds0452125478306675\extensions\scripts\database.lua
  • %ProgramFiles(x86)%\kaseya\mnds0452125478306675\extensions\scripts\debugger.lua
  • %ProgramFiles(x86)%\kaseya\mnds0452125478306675\extensions\scripts\debugintrospection.lua
  • %ProgramFiles(x86)%\kaseya\mnds0452125478306675\extensions\scripts\email.lua
  • %ProgramFiles(x86)%\kaseya\mnds0452125478306675\extensions\scripts\evaluateexpression.lua
  • %ProgramFiles(x86)%\kaseya\mnds0452125478306675\extensions\scripts\file.lua
  • %ProgramFiles(x86)%\kaseya\mnds0452125478306675\extensions\scripts\kxmpp.lua
  • %ProgramFiles(x86)%\kaseya\mnds0452125478306675\extensions\scripts\ltn12.lua
  • %ProgramFiles(x86)%\kaseya\mnds0452125478306675\extensions\scripts\lfs.dll
  • %ProgramFiles(x86)%\kaseya\mnds0452125478306675\extensions\scripts\luaxml.lua
  • %ProgramFiles(x86)%\kaseya\mnds0452125478306675\extensions\scripts\makedirmanifest.lua
  • %ProgramFiles(x86)%\kaseya\mnds0452125478306675\kaseyad.ini
  • %ProgramFiles(x86)%\kaseya\mnds0452125478306675\extensions\scripts\askuser.lua
  • %ALLUSERSPROFILE%\kaseya\data\endpoint\instance_mnds0452125478306675\kaseyaendpoint\endpointconfiguration.sqc
  • %ProgramFiles(x86)%\kaseya\mnds0452125478306675\kdllhost.log
  • %ProgramFiles(x86)%\kaseya\mnds0452125478306675\endpoint\kaseyacommandshellproxy.exe
  • %ALLUSERSPROFILE%\kaseya\data\endpoint\instance_mnds0452125478306675\kaseyaendpoint\fileupload.sqc
  • %ALLUSERSPROFILE%\kaseya\data\endpoint\instance_mnds0452125478306675\kaseyaendpoint\adhoctask.key
  • %ALLUSERSPROFILE%\kaseya\data\endpoint\instance_mnds0452125478306675\kaseyaendpoint\adhoctask.sqc-journal
  • %ALLUSERSPROFILE%\kaseya\data\endpoint\instance_mnds0452125478306675\kaseyaendpoint\adhoctask.sqc
  • %ALLUSERSPROFILE%\kaseya\data\endpoint\instance_mnds0452125478306675\kaseyaendpoint\updater.key
  • %ALLUSERSPROFILE%\kaseya\data\endpoint\instance_mnds0452125478306675\kaseyaendpoint\updater.sqc-journal
  • %ALLUSERSPROFILE%\kaseya\data\endpoint\instance_mnds0452125478306675\kaseyaendpoint\updater.sqc
  • %ALLUSERSPROFILE%\kaseya\data\endpoint\instance_mnds0452125478306675\kaseyaendpoint\fileflare\files.key
  • %ALLUSERSPROFILE%\kaseya\data\endpoint\instance_mnds0452125478306675\kaseyaendpoint\fileflare\files.sqc-journal
  • %ALLUSERSPROFILE%\kaseya\data\endpoint\instance_mnds0452125478306675\kaseyaendpoint\fileflare\files.sqc
  • %WINDIR%\temp\etilqs_qhalzwwtyugwewr
  • C:\kworking\k01\readme.txt
  • %ProgramFiles(x86)%\kaseya\mnds0452125478306675\drivers\demoforge\mirrinst64.exe
  • %ProgramFiles(x86)%\kaseya\mnds0452125478306675\extensions\scripts\temp\serverrolesaudit.lua
  • %ProgramFiles(x86)%\kaseya\mnds0452125478306675\database\schedules.db-journal
  • %ProgramFiles(x86)%\kaseya\mnds0452125478306675\database\procs.db-journal
  • %ProgramFiles(x86)%\kaseya\mnds0452125478306675\extensions\scripts\temp\db_script_serverrolesaudit.lua
  • %ProgramFiles(x86)%\kaseya\mnds0452125478306675\2604.log
  • %ProgramFiles(x86)%\kaseya\mnds0452125478306675\kmsgquploadcfg\serverrolesaudit.xml
  • %ProgramFiles(x86)%\kaseya\mnds0452125478306675\serverrolesaudit\server_roles_audit.xml
  • C:\kworking\dircontents.xml
  • C:\temp\kawmi.dll
  • %ALLUSERSPROFILE%\kaseya\log\kaseyaagent\instance_mnds0452125478306675\kaseya.agentendpoint\kaseya.agentendpoint-2020-11-02t16-57-25-08-00.log
  • %ALLUSERSPROFILE%\kaseya\data\kaseya.agentendpoint.exe\instance_mnds0452125478306675\fileflare\files.sqc-journal
  • %ALLUSERSPROFILE%\kaseya\data\kaseya.agentendpoint.exe\instance_mnds0452125478306675\fileflare\files.sqc
  • %WINDIR%\temp\kdh40e6.tmp
  • %ALLUSERSPROFILE%\kaseya\data\endpoint\instance_mnds0452125478306675\kaseyaendpoint\fileupload.key
  • %ALLUSERSPROFILE%\kaseya\data\endpoint\instance_mnds0452125478306675\kaseyaendpoint\fileupload.sqc-journal
  • %ALLUSERSPROFILE%\kaseya\data\endpoint\instance_mnds0452125478306675\kaseyaendpoint\mailbox.sqc
  • %ALLUSERSPROFILE%\kaseya\data\endpoint\instance_mnds0452125478306675\kaseyaendpoint\mailbox.sqc-journal
  • %ALLUSERSPROFILE%\kaseya\data\endpoint\instance_mnds0452125478306675\kaseyaendpoint\mailbox.key
  • %ProgramFiles(x86)%\kaseya\mnds0452125478306675\kaseya.agentendpoint.exe
  • %ProgramFiles(x86)%\kaseya\mnds0452125478306675\kaseyaremotecontrolhost.exe
  • %ProgramFiles(x86)%\kaseya\mnds0452125478306675\endpoint\kaseyataskrunnerx64.exe
  • %ProgramFiles(x86)%\kaseya\mnds0452125478306675\endpoint\kaseyataskrunnerx86.exe
  • %ProgramFiles(x86)%\kaseya\mnds0452125478306675\package.xml
  • <DRIVERS>\kapfa.sys
  • <DRIVERS>\knetmon.sys
  • %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\kaseya\kaseya agent.lnk
  • %ProgramFiles(x86)%\kaseya\mnds0452125478306675\endpoint\provisioning.xml
  • %ProgramFiles(x86)%\kaseya\mnds0452125478306675\agentmon.log
  • %ALLUSERSPROFILE%\kaseya\data\endpoint\instance_mnds0452125478306675\kaseyaendpoint\endpointconfiguration.key
  • %ALLUSERSPROFILE%\kaseya\log\endpoint\instance_mnds0452125478306675\kaseyaendpoint\kaseyaendpoint-2020-11-03t00-56-47z.log
  • %ProgramFiles(x86)%\kaseya\mnds0452125478306675\endpoint\kaseyaendpoint.exe
  • %ProgramFiles(x86)%\kaseya\mnds0452125478306675\dllrunner64.exe
  • %ALLUSERSPROFILE%\kaseya\data\endpoint\instance_mnds0452125478306675\kaseyaendpoint\endpointconfiguration.sqc-journal
  • %WINDIR%\temp\uddb7f9.tmp
  • %ProgramFiles(x86)%\kaseya\mnds0452125478306675\schedule.log
  • %ProgramFiles(x86)%\kaseya\mnds0452125478306675\database\hashes.db-journal
  • %ProgramFiles(x86)%\kaseya\mnds0452125478306675\database\hashes.db
  • %ProgramFiles(x86)%\kaseya\mnds0452125478306675\database\logs.db-journal
  • %ProgramFiles(x86)%\kaseya\mnds0452125478306675\database\logs.db
  • %ProgramFiles(x86)%\kaseya\mnds0452125478306675\database\reports.db-journal
  • %ProgramFiles(x86)%\kaseya\mnds0452125478306675\database\reports.db
  • %ProgramFiles(x86)%\kaseya\mnds0452125478306675\script.log
  • %ProgramFiles(x86)%\kaseya\mnds0452125478306675\lastchk.txt
  • %ProgramFiles(x86)%\kaseya\mnds0452125478306675\kaseyad.bak
  • %ALLUSERSPROFILE%\microsoft\crypto\keys\ee6bd37c74ae40274db67d72f755463e_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
  • %ProgramFiles(x86)%\kaseya\mnds0452125478306675\endpoint\kaseyaremotecontrolhost.exe
  • %ProgramFiles(x86)%\kaseya\mnds0452125478306675\kaserror.log
  • %ProgramFiles(x86)%\kaseya\mnds0452125478306675\extensions\lua.log
  • %ProgramFiles(x86)%\kaseya\mnds0452125478306675\dllrunner32.exe
  • %ProgramFiles(x86)%\kaseya\mnds0452125478306675\kgetelmg64.exe
  • %TEMP%\pft54a6.tmp\extensions\lualib.dll
  • %TEMP%\pft54a6.tmp\extensions\scripts\askuser.lua
  • %TEMP%\pft54a6.tmp\extensions\scripts\audit.lua
  • %TEMP%\pft54a6.tmp\extensions\scripts\cmddebugger.lua
  • %TEMP%\pft54a6.tmp\extensions\scripts\database.lua
  • %TEMP%\pft54a6.tmp\extensions\scripts\debugger.lua
  • %TEMP%\pft54a6.tmp\extensions\scripts\debugintrospection.lua
  • %TEMP%\pft54a6.tmp\extensions\scripts\dir.manifest
  • %TEMP%\pft54a6.tmp\extensions\scripts\dirmon.lua
  • %TEMP%\pft54a6.tmp\extensions\scripts\email.lua
  • %TEMP%\pft54a6.tmp\extensions\scripts\evaluateexpression.lua
  • %TEMP%\pft54a6.tmp\extensions\scripts\file.lua
  • %TEMP%\pft54a6.tmp\dllrunner32.exe
  • %TEMP%\pft54a6.tmp\extensions\scripts\filemanager.lua
  • %TEMP%\pft54a6.tmp\extensions\scripts\lfs.dll
  • %TEMP%\pft54a6.tmp\extensions\scripts\liveconnect.lua
  • %TEMP%\pft54a6.tmp\extensions\scripts\ltn12.lua
  • %TEMP%\pft54a6.tmp\extensions\scripts\luaxml.lua
  • %TEMP%\pft54a6.tmp\extensions\scripts\makedirmanifest.lua
  • %TEMP%\pft54a6.tmp\extensions\scripts\mime\core.dll
  • %TEMP%\pft54a6.tmp\extensions\scripts\mime.lua
  • %TEMP%\pft54a6.tmp\extensions\scripts\remotedebugger.lua
  • %TEMP%\pft54a6.tmp\extensions\scripts\scheduler.lua
  • %TEMP%\pft54a6.tmp\extensions\scripts\sconvert.lua
  • %TEMP%\pft54a6.tmp\extensions\scripts\scriptrunner.lua
  • %TEMP%\pft54a6.tmp\extensions\scripts\serverrolesaudit.lua
  • %TEMP%\pft54a6.tmp\extensions\lsqlite3.dll
  • %TEMP%\pft54a6.tmp\extensions\lua.exe
  • %TEMP%\pft54a6.tmp\extensions\kluamessages.dll
  • %TEMP%\pft54a6.tmp\extensions\klua.dll
  • %TEMP%\pft54a6.tmp\extdlls\driver.dll
  • %TEMP%\kagentsilent.exe
  • %TEMP%\kaseyad.ini
  • %TEMP%\ext5419.tmp
  • %TEMP%\plf5418.tmp
  • %TEMP%\pft54a6.tmp\pftw1.pkg
  • %TEMP%\pft54a6.tmp\agentmon.exe
  • %TEMP%\pft54a6.tmp\curl.exe
  • %TEMP%\pft54a6.tmp\custom\blink.ico
  • %TEMP%\pft54a6.tmp\custom\noremote.ico
  • %TEMP%\pft54a6.tmp\custom\offline.ico
  • %TEMP%\pft54a6.tmp\custom\online.ico
  • %TEMP%\pft54a6.tmp\database\procs.db
  • %TEMP%\pft54a6.tmp\extensions\scripts\showmessage.lua
  • %TEMP%\pft54a6.tmp\extensions\scripts\kxmpp.lua
  • %TEMP%\pft54a6.tmp\database\schedules.db
  • %TEMP%\pft54a6.tmp\drivers\demoforge\068\dfmirage.cat
  • %TEMP%\pft54a6.tmp\drivers\demoforge\068\dfmirage.dll
  • %TEMP%\pft54a6.tmp\drivers\demoforge\068\dfmirage.inf
  • %TEMP%\pft54a6.tmp\drivers\demoforge\068\dfmirage.sys
  • %TEMP%\pft54a6.tmp\drivers\demoforge\105\dfmirage.cat
  • %TEMP%\pft54a6.tmp\drivers\demoforge\105\dfmirage.inf
  • %TEMP%\pft54a6.tmp\drivers\demoforge\105\x64\dfmirage.dll
  • %TEMP%\pft54a6.tmp\drivers\demoforge\105\x64\dfmirage.sys
  • %TEMP%\pft54a6.tmp\drivers\demoforge\105\x86\dfmirage.dll
  • %TEMP%\pft54a6.tmp\drivers\demoforge\105\x86\dfmirage.sys
  • %TEMP%\pft54a6.tmp\drivers\demoforge\mirrinst32.exe
  • %TEMP%\pft54a6.tmp\drivers\demoforge\mirrinst64.exe
  • %TEMP%\kasetup.log
  • %TEMP%\pft54a6.tmp\dllrunner64.exe
  • %TEMP%\pft54a6.tmp\kasetup.exe
  • %ProgramFiles(x86)%\kaseya\mnds0452125478306675\drivers\knetmon64.sys
  • %TEMP%\pft54a6.tmp\extensions\scripts\socket\http.lua
  • %TEMP%\pft54a6.tmp\sporder.dll
  • %TEMP%\pft54a6.tmp\ssleay32.dll
  • %TEMP%\pft54a6.tmp\x64\kaseyacommandshellproxy.exe
  • %TEMP%\pft54a6.tmp\x64\kaseyaendpoint.exe
  • %TEMP%\pft54a6.tmp\x64\kaseyaremotecontrolhost.exe
  • %TEMP%\pft54a6.tmp\x64\kaseyataskrunnerx64.exe
  • %TEMP%\pft54a6.tmp\x86\kaseyacommandshellproxy.exe
  • %TEMP%\pft54a6.tmp\x86\kaseyaendpoint.exe
  • %TEMP%\pft54a6.tmp\x86\kaseyaremotecontrolhost.exe
  • %TEMP%\pft54a6.tmp\x86\kaseyataskrunnerx86.exe
  • %ProgramFiles(x86)%\kaseya\mnds0452125478306675\kasetup.exe
  • %ProgramFiles(x86)%\kaseya\mnds0452125478306675\agentmon.exe
  • %TEMP%\pft54a6.tmp\extensions\scripts\socket\core.dll
  • %ProgramFiles(x86)%\kaseya\mnds0452125478306675\kausrtsk.exe
  • %ProgramFiles(x86)%\kaseya\mnds0452125478306675\kprtpng.exe
  • %ProgramFiles(x86)%\kaseya\mnds0452125478306675\libkacm.dgst
  • %ProgramFiles(x86)%\kaseya\mnds0452125478306675\kdllhost.exe
  • %ProgramFiles(x86)%\kaseya\mnds0452125478306675\kagentext.dll
  • %ProgramFiles(x86)%\kaseya\mnds0452125478306675\keventlog.dll
  • %ProgramFiles(x86)%\kaseya\mnds0452125478306675\logparser.dll
  • %ProgramFiles(x86)%\kaseya\mnds0452125478306675\sporder.dll
  • %ProgramFiles(x86)%\kaseya\mnds0452125478306675\libkacm.dll
  • %ProgramFiles(x86)%\kaseya\mnds0452125478306675\drivers\kapfa.sys
  • %ProgramFiles(x86)%\kaseya\mnds0452125478306675\drivers\kapfa64.sys
  • %ProgramFiles(x86)%\kaseya\mnds0452125478306675\drivers\kaseyasp.dll
  • %ProgramFiles(x86)%\kaseya\mnds0452125478306675\drivers\knetmon.sys
  • %TEMP%\pft54a6.tmp\psapi.dll
  • %TEMP%\pft54a6.tmp\sas.dll
  • %TEMP%\pft54a6.tmp\logparser.dll
  • %TEMP%\pft54a6.tmp\libkacm.dll
  • %TEMP%\pft54a6.tmp\libkacm.dgst
  • %TEMP%\pft54a6.tmp\extensions\scripts\socket\tp.lua
  • %TEMP%\pft54a6.tmp\extensions\scripts\socket\url.lua
  • %TEMP%\pft54a6.tmp\extensions\scripts\socket.lua
  • %TEMP%\pft54a6.tmp\extensions\scripts\ssl\https.lua
  • %TEMP%\pft54a6.tmp\extensions\scripts\ssl.dll
  • %TEMP%\pft54a6.tmp\extensions\scripts\ssl.lua
  • %TEMP%\pft54a6.tmp\extensions\scripts\totypes.lua
  • %TEMP%\pft54a6.tmp\extensions\scripts\utility.lua
  • %TEMP%\pft54a6.tmp\extensions\scripts\xmltolua.lua
  • %TEMP%\pft54a6.tmp\extensions\scripts\xpath.lua
  • %TEMP%\pft54a6.tmp\kagentext.dll
  • %TEMP%\pft54a6.tmp\kapfa.sys
  • %TEMP%\pft54a6.tmp\extensions\scripts\socket\ftp.lua
  • %ProgramFiles(x86)%\kaseya\mnds0452125478306675\extdlls\driver.dll
  • %TEMP%\pft54a6.tmp\kapfa64.sys
  • %TEMP%\pft54a6.tmp\kaseyafw.ini
  • %TEMP%\pft54a6.tmp\kaseyasp.dll
  • %TEMP%\pft54a6.tmp\kausrtsk.exe
  • %TEMP%\pft54a6.tmp\kdllhost.exe
  • %TEMP%\pft54a6.tmp\keventlog.dll
  • %TEMP%\pft54a6.tmp\kgetelmg64.exe
  • %TEMP%\pft54a6.tmp\knetmon.sys
  • %TEMP%\pft54a6.tmp\knetmon64.sys
  • %TEMP%\pft54a6.tmp\kprtpng.exe
  • %TEMP%\pft54a6.tmp\legacy\kaseya.agentendpoint.exe
  • %TEMP%\pft54a6.tmp\legacy\kaseyaremotecontrolhost.exe
  • %TEMP%\pft54a6.tmp\libeay32.dll
  • %TEMP%\pft54a6.tmp\extensions\scripts\socket\smtp.lua
  • %TEMP%\pft54a6.tmp\kaseyad.ini
  • C:\temp\kasmbios.txt
Deletes the following files
  • %TEMP%\ext5419.tmp
  • %TEMP%\pft54a6.tmp\ssleay32.dll
  • %TEMP%\pft54a6.tmp\sporder.dll
  • %TEMP%\pft54a6.tmp\sas.dll
  • %TEMP%\pft54a6.tmp\psapi.dll
  • %TEMP%\pft54a6.tmp\logparser.dll
  • %TEMP%\pft54a6.tmp\libkacm.dll
  • %TEMP%\pft54a6.tmp\libkacm.dgst
  • %TEMP%\pft54a6.tmp\libeay32.dll
  • %TEMP%\pft54a6.tmp\legacy\kaseyaremotecontrolhost.exe
  • %TEMP%\pft54a6.tmp\legacy\kaseya.agentendpoint.exe
  • %TEMP%\pft54a6.tmp\kprtpng.exe
  • %TEMP%\pft54a6.tmp\knetmon64.sys
  • %TEMP%\pft54a6.tmp\knetmon.sys
  • %TEMP%\pft54a6.tmp\extensions\scripts\ssl.dll
  • %TEMP%\pft54a6.tmp\kgetelmg64.exe
  • %TEMP%\pft54a6.tmp\kdllhost.exe
  • %TEMP%\pft54a6.tmp\kausrtsk.exe
  • %TEMP%\pft54a6.tmp\kaseyasp.dll
  • %TEMP%\pft54a6.tmp\kaseyafw.ini
  • %TEMP%\pft54a6.tmp\kaseyad.ini
  • %TEMP%\pft54a6.tmp\kasetup.exe
  • %TEMP%\pft54a6.tmp\kapfa64.sys
  • %TEMP%\pft54a6.tmp\kapfa.sys
  • %TEMP%\pft54a6.tmp\kagentext.dll
  • %TEMP%\pft54a6.tmp\extensions\scripts\xpath.lua
  • %TEMP%\pft54a6.tmp\extensions\scripts\xmltolua.lua
  • %TEMP%\pft54a6.tmp\extensions\scripts\utility.lua
  • %TEMP%\pft54a6.tmp\extensions\scripts\totypes.lua
  • %TEMP%\pft54a6.tmp\keventlog.dll
  • %TEMP%\pft54a6.tmp\extensions\scripts\ssl.lua
  • %TEMP%\pft54a6.tmp\x64\kaseyacommandshellproxy.exe
  • %ALLUSERSPROFILE%\kaseya\data\endpoint\instance_mnds0452125478306675\kaseyaendpoint\endpointconfiguration.sqc
  • %WINDIR%\temp\kdh40e6.tmp
  • %ALLUSERSPROFILE%\kaseya\data\kaseya.agentendpoint.exe\instance_mnds0452125478306675\fileflare\files.sqc-journal
  • %TEMP%\kcssetup.dat
  • %ProgramFiles(x86)%\kaseya\mnds0452125478306675\extensions\scripts\temp\db_script_serverrolesaudit.lua
  • %ProgramFiles(x86)%\kaseya\mnds0452125478306675\database\procs.db-journal
  • %ProgramFiles(x86)%\kaseya\mnds0452125478306675\extensions\scripts\temp\serverrolesaudit.lua
  • %ProgramFiles(x86)%\kaseya\mnds0452125478306675\database\schedules.db-journal
  • C:\kworking\k01\readme.txt
  • %ALLUSERSPROFILE%\kaseya\data\endpoint\instance_mnds0452125478306675\kaseyaendpoint\fileflare\files.sqc-journal
  • %ALLUSERSPROFILE%\kaseya\data\endpoint\instance_mnds0452125478306675\kaseyaendpoint\updater.sqc-journal
  • %ALLUSERSPROFILE%\kaseya\data\endpoint\instance_mnds0452125478306675\kaseyaendpoint\adhoctask.sqc-journal
  • %ALLUSERSPROFILE%\kaseya\data\endpoint\instance_mnds0452125478306675\kaseyaendpoint\fileupload.sqc-journal
  • %ALLUSERSPROFILE%\kaseya\data\endpoint\instance_mnds0452125478306675\kaseyaendpoint\mailbox.sqc-journal
  • %TEMP%\pft54a6.tmp\x64\kaseyaremotecontrolhost.exe
  • %TEMP%\pft54a6.tmp\x64\kaseyaendpoint.exe
  • %ALLUSERSPROFILE%\kaseya\data\endpoint\instance_mnds0452125478306675\kaseyaendpoint\endpointconfiguration.key
  • %ProgramFiles(x86)%\kaseya\mnds0452125478306675\database\reports.db-journal
  • %ProgramFiles(x86)%\kaseya\mnds0452125478306675\database\logs.db-journal
  • %ProgramFiles(x86)%\kaseya\mnds0452125478306675\database\hashes.db-journal
  • %WINDIR%\temp\uddb7f9.tmp
  • %ALLUSERSPROFILE%\kaseya\data\endpoint\instance_mnds0452125478306675\kaseyaendpoint\endpointconfiguration.sqc-journal
  • %TEMP%\kagentsilent.exe
  • %TEMP%\kaseyad.ini
  • %TEMP%\pft54a6.tmp\x86\kaseyataskrunnerx86.exe
  • %TEMP%\pft54a6.tmp\x86\kaseyaremotecontrolhost.exe
  • %TEMP%\pft54a6.tmp\x86\kaseyaendpoint.exe
  • %TEMP%\pft54a6.tmp\x86\kaseyacommandshellproxy.exe
  • %TEMP%\pft54a6.tmp\x64\kaseyataskrunnerx64.exe
  • %ProgramFiles(x86)%\kaseya\mnds0452125478306675\endpoint\provisioning.xml
  • %TEMP%\pft54a6.tmp\extensions\scripts\ssl\https.lua
  • %TEMP%\pft54a6.tmp\extensions\scripts\socket.lua
  • %TEMP%\pft54a6.tmp\extensions\scripts\socket\url.lua
  • %TEMP%\pft54a6.tmp\extensions\kluamessages.dll
  • %TEMP%\pft54a6.tmp\extensions\klua.dll
  • %TEMP%\pft54a6.tmp\extdlls\driver.dll
  • %TEMP%\pft54a6.tmp\drivers\demoforge\mirrinst64.exe
  • %TEMP%\pft54a6.tmp\drivers\demoforge\mirrinst32.exe
  • %TEMP%\pft54a6.tmp\drivers\demoforge\105\x86\dfmirage.sys
  • %TEMP%\pft54a6.tmp\drivers\demoforge\105\x86\dfmirage.dll
  • %TEMP%\pft54a6.tmp\drivers\demoforge\105\x64\dfmirage.sys
  • %TEMP%\pft54a6.tmp\drivers\demoforge\105\x64\dfmirage.dll
  • %TEMP%\pft54a6.tmp\drivers\demoforge\105\dfmirage.inf
  • %TEMP%\pft54a6.tmp\drivers\demoforge\105\dfmirage.cat
  • %TEMP%\pft54a6.tmp\drivers\demoforge\068\dfmirage.sys
  • %TEMP%\pft54a6.tmp\extensions\lua.exe
  • %TEMP%\pft54a6.tmp\drivers\demoforge\068\dfmirage.inf
  • %TEMP%\pft54a6.tmp\drivers\demoforge\068\dfmirage.cat
  • %TEMP%\pft54a6.tmp\dllrunner64.exe
  • %TEMP%\pft54a6.tmp\dllrunner32.exe
  • %TEMP%\pft54a6.tmp\database\schedules.db
  • %TEMP%\pft54a6.tmp\database\procs.db
  • %TEMP%\pft54a6.tmp\custom\online.ico
  • %TEMP%\pft54a6.tmp\custom\offline.ico
  • %TEMP%\pft54a6.tmp\custom\noremote.ico
  • %TEMP%\pft54a6.tmp\custom\blink.ico
  • %TEMP%\pft54a6.tmp\curl.exe
  • %TEMP%\pft54a6.tmp\agentmon.exe
  • %TEMP%\plf5418.tmp
  • %TEMP%\pft54a6.tmp\pftw1.pkg
  • %TEMP%\pft54a6.tmp\drivers\demoforge\068\dfmirage.dll
  • %TEMP%\pft54a6.tmp\extensions\lualib.dll
  • %TEMP%\pft54a6.tmp\extensions\lsqlite3.dll
  • %TEMP%\pft54a6.tmp\extensions\scripts\askuser.lua
  • %TEMP%\pft54a6.tmp\extensions\scripts\socket\tp.lua
  • %TEMP%\pft54a6.tmp\extensions\scripts\luaxml.lua
  • %TEMP%\pft54a6.tmp\extensions\scripts\socket\smtp.lua
  • %TEMP%\pft54a6.tmp\extensions\scripts\socket\http.lua
  • %TEMP%\pft54a6.tmp\extensions\scripts\socket\ftp.lua
  • %TEMP%\pft54a6.tmp\extensions\scripts\socket\core.dll
  • %TEMP%\pft54a6.tmp\extensions\scripts\showmessage.lua
  • %TEMP%\pft54a6.tmp\extensions\scripts\serverrolesaudit.lua
  • %TEMP%\pft54a6.tmp\extensions\scripts\scriptrunner.lua
  • %TEMP%\pft54a6.tmp\extensions\scripts\sconvert.lua
  • %TEMP%\pft54a6.tmp\extensions\scripts\scheduler.lua
  • %TEMP%\pft54a6.tmp\extensions\scripts\remotedebugger.lua
  • %TEMP%\pft54a6.tmp\extensions\scripts\mime.lua
  • %TEMP%\pft54a6.tmp\extensions\scripts\mime\core.dll
  • %TEMP%\pft54a6.tmp\extensions\scripts\makedirmanifest.lua
  • %TEMP%\pft54a6.tmp\extensions\scripts\ltn12.lua
  • %TEMP%\pft54a6.tmp\extensions\scripts\audit.lua
  • %TEMP%\pft54a6.tmp\extensions\scripts\liveconnect.lua
  • %TEMP%\pft54a6.tmp\extensions\scripts\lfs.dll
  • %TEMP%\pft54a6.tmp\extensions\scripts\kxmpp.lua
  • %TEMP%\pft54a6.tmp\extensions\scripts\filemanager.lua
  • %TEMP%\pft54a6.tmp\extensions\scripts\file.lua
  • %TEMP%\pft54a6.tmp\extensions\scripts\evaluateexpression.lua
  • %TEMP%\pft54a6.tmp\extensions\scripts\email.lua
  • %TEMP%\pft54a6.tmp\extensions\scripts\dirmon.lua
  • %TEMP%\pft54a6.tmp\extensions\scripts\dir.manifest
  • %TEMP%\pft54a6.tmp\extensions\scripts\debugintrospection.lua
  • %TEMP%\pft54a6.tmp\extensions\scripts\debugger.lua
  • %TEMP%\pft54a6.tmp\extensions\scripts\database.lua
  • %TEMP%\pft54a6.tmp\extensions\scripts\cmddebugger.lua
  • C:\temp\kawmi.dll
  • C:\temp\kasmbios.txt
Substitutes the following files
  • %ALLUSERSPROFILE%\kaseya\data\endpoint\instance_mnds0452125478306675\kaseyaendpoint\endpointconfiguration.sqc-journal
  • %ALLUSERSPROFILE%\kaseya\data\endpoint\instance_mnds0452125478306675\kaseyaendpoint\endpointconfiguration.key
  • %ALLUSERSPROFILE%\kaseya\data\endpoint\instance_mnds0452125478306675\kaseyaendpoint\endpointconfiguration.sqc
  • %ALLUSERSPROFILE%\kaseya\data\endpoint\instance_mnds0452125478306675\kaseyaendpoint\fileflare\files.sqc-journal
  • %ALLUSERSPROFILE%\kaseya\data\endpoint\instance_mnds0452125478306675\kaseyaendpoint\mailbox.sqc-journal
  • %ProgramFiles(x86)%\kaseya\mnds0452125478306675\database\schedules.db-journal
  • %ProgramFiles(x86)%\kaseya\mnds0452125478306675\database\procs.db-journal
Network activity
TCP
  • 'k0#.##ndshift.com':5721
  • 'localhost':49177
  • 'localhost':49190
UDP
  • DNS ASK k0#.##ndshift.com
Miscellaneous
Creates and executes the following
  • '%TEMP%\kagentsilent.exe' /a /k /g MNDS0452125478306675 /l "%TEMP%\KASetup.log" /v "1"
  • '%TEMP%\pft54a6.tmp\kasetup.exe' /k /g MNDS0452125478306675 /l "%TEMP%\KASetup.log" /v "1" /s
  • '%ProgramFiles(x86)%\kaseya\mnds0452125478306675\kausrtsk.exe'
  • '%ProgramFiles(x86)%\kaseya\mnds0452125478306675\agentmon.exe'
  • '%ProgramFiles(x86)%\kaseya\mnds0452125478306675\endpoint\kaseyaendpoint.exe'
  • '%ProgramFiles(x86)%\kaseya\mnds0452125478306675\extensions\lua.exe' scripts\scriptRunner.lua
  • '%ProgramFiles(x86)%\kaseya\mnds0452125478306675\extensions\lua.exe' scripts\scheduler.lua
  • '%ProgramFiles(x86)%\kaseya\mnds0452125478306675\extensions\lua.exe' "%ProgramFiles(x86)%\Kaseya\MNDS0452125478306675\extensions\scripts\sconvert.lua" "recurrence-type=MINUTES;recurring-interval=60;start-time-from=2011-01-05T04:04:12Z;start-time-to=2030-01-05T04...
  • '%ProgramFiles(x86)%\kaseya\mnds0452125478306675\extensions\lua.exe' "%ProgramFiles(x86)%\Kaseya\MNDS0452125478306675\extensions\scripts\temp\db_script_serverRolesAudit.lua"
  • '%ProgramFiles(x86)%\kaseya\mnds0452125478306675\kaseya.agentendpoint.exe' MNDS0452125478306675 1 602276116072146
  • '%ProgramFiles(x86)%\kaseya\mnds0452125478306675\kdllhost.exe' "C:\temp\kawmi.dll" "%WINDIR%\TEMP\KDH40E6.tmp"
  • '%ProgramFiles(x86)%\kaseya\mnds0452125478306675\extensions\lua.exe' scripts\scriptRunner.lua' (with hidden window)
  • '%ProgramFiles(x86)%\kaseya\mnds0452125478306675\extensions\lua.exe' scripts\scheduler.lua' (with hidden window)
  • '%ProgramFiles(x86)%\kaseya\mnds0452125478306675\extensions\lua.exe' "%ProgramFiles(x86)%\Kaseya\MNDS0452125478306675\extensions\scripts\sconvert.lua" "recurrence-type=MINUTES;recurring-interval=60;start-time-from=2011-01-05T04:04:12Z;start-time-to=2030-01-05T04...' (with hidden window)
  • '%ProgramFiles(x86)%\kaseya\mnds0452125478306675\kaseya.agentendpoint.exe' MNDS0452125478306675 1 602276116072146' (with hidden window)
  • '%ProgramFiles(x86)%\kaseya\mnds0452125478306675\kdllhost.exe' "C:\temp\kawmi.dll" "%WINDIR%\TEMP\KDH40E6.tmp"' (with hidden window)
Executes the following
  • '%WINDIR%\syswow64\logman.exe'
  • '%WINDIR%\syswow64\net.exe' use

Curing recommendations

  1. If the operating system (OS) can be loaded (either normally or in safe mode), download Dr.Web Security Space and run a full scan of your computer and removable media you use. More about Dr.Web Security Space.
  2. If you cannot boot the OS, change the BIOS settings to boot your system from a CD or USB drive. Download the image of the emergency system repair disk Dr.Web® LiveDisk , mount it on a USB drive or burn it to a CD/DVD. After booting up with this media, run a full scan and cure all the detected threats.
Free trial

 

Download Dr.Web

Download by serial number

Use Dr.Web Anti-virus for macOS to run a full scan of your Mac.

Free trial

 

Download Dr.Web

Download by serial number

Download on App Store

After booting up, run a full scan of all disk partitions with Dr.Web Anti-virus for Linux.

Free trial

 

Download Dr.Web

Download by serial number

  1. If the mobile device is operating normally, download and install Dr.Web for Android. Run a full system scan and follow recommendations to neutralize the detected threats.
  2. If the mobile device has been locked by Android.Locker ransomware (the message on the screen tells you that you have broken some law or demands a set ransom amount; or you will see some other announcement that prevents you from using the handheld normally), do the following:
    • Load your smartphone or tablet in the safe mode (depending on the operating system version and specifications of the particular mobile device involved, this procedure can be performed in various ways; seek clarification from the user guide that was shipped with the device, or contact its manufacturer);
    • Once you have activated safe mode, install the Dr.Web for Android onto the infected handheld and run a full scan of the system; follow the steps recommended for neutralizing the threats that have been detected;
    • Switch off your device and turn it on as normal.

Find out more about Dr.Web for Android

Free trial

14 days

Download now
Get it on Google Play