HackTool.Win32.Radmin.GQ

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Detalles de entrada

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Instalación

Infiltra los archivos siguientes:

• %ProgramData%\Immunity\wet.vbs (executes exe.cmd)
• %ProgramData%\Immunity\exe.cmd (executes and establishes persistence for rutserv.exe)
• %ProgramData%\Immunity\libeay32.dll
• %ProgramData%\Immunity\res.reg
• %ProgramData%\Immunity\rutserv.exe
• %ProgramData%\Immunity\settings.dat
• %ProgramData%\Immunity\ssleay32.dll
• %ProgramData%\Immunity\rfusclient.exe
• %ProgramData%\Remote Manipulator System\install.log
• %Application Data%\RMS Agent\Logs\rms_log_{Date}.html (displays connection logs)

(Nota: %Application Data% es la carpeta Application Data del usuario activo, que en el caso de Windows 98 y ME suele estar ubicada en C:\Windows\Profiles\{nombre de usuario}\Application Data, en el caso de Windows NT en C:\WINNT\Profiles\{nombre de usuario}\Application Data, en el caso de Windows 2000(32-bit), XP y Server 2003(32-bit) en C:\Documents and Settings\{nombre de usuario}\Local Settings\Application Data y en el caso de Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) y 10(64-bit) en C:\Users\{nombre de usuario}\AppData\Roaming.).

Técnica de inicio automático

Agrega las siguientes entradas de registro para permitir su ejecución automática cada vez que se inicia el sistema:

HKEY_CURRENT_USER\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
not = %ProgramData%\Immunity\rutserv.exe

Otras modificaciones del sistema

Agrega las siguientes entradas de registro:

HKEY_LOCAL_MACHINE\SYSTEM\RMS Host Installer
Security = {Binary data}

HKEY_LOCAL_MACHINE\SYSTEM\RMS Host Installer
General = {Binary data}

HKEY_LOCAL_MACHINE\SYSTEM\RMS Host Installer
CallbackSettings = {Binary data}

HKEY_LOCAL_MACHINE\SYSTEM\{Control set}\
services\RManService
ObjectName = LocalSystem

HKEY_LOCAL_MACHINE\SYSTEM\{Control set}\
services\RManService
WOW64 = 1

HKEY_LOCAL_MACHINE\SYSTEM\{Control set}\
services\RManService
DependOnService = {Binary data}

HKEY_LOCAL_MACHINE\SYSTEM\{Control set}\
services\RManService
DisplayName = TektonIT - RMS Host

HKEY_LOCAL_MACHINE\SYSTEM\{Control set}\
services\RManService
ImagePath = %ProgramData%\Immunity\rutserv.exe

HKEY_LOCAL_MACHINE\SYSTEM\{Control set}\
services\RManService
ErrorControl = 1

HKEY_LOCAL_MACHINE\SYSTEM\{Control set}\
services\RManService
Start = 2

HKEY_LOCAL_MACHINE\SYSTEM\{Control set}\
services\RManService
Type = 16

HKEY_LOCAL_MACHINE\SYSTEM\{Control set}\
services\RManService
Description = Allows windows driver machine.

HKEY_LOCAL_MACHINE\SYSTEM\{Control set}\
services\RManService
Group =

HKEY_LOCAL_MACHINE\SYSTEM\{Control set}\
services\RManService
FailureActions = {Binary data}

HKEY_CURRENT_USER\TektonIT\Remote Manipulator System\
Host\Parameters
notification = {Binary data}

Otros detalles

Agrega las siguientes entradas de registro como parte de la rutina de instalación:

HKEY_LOCAL_MACHINE\SYSTEM\RMS Host Installer

HKEY_LOCAL_MACHINE\SYSTEM\{Control set}\
services\RManService

Hace lo siguiente:

• It executes the following commands from a remote user:
  • Whitelist and blacklist IP addresses
  • Capture screenshots or screen recordings
  • See opened processes via task manager
  • Remote control
  • Remote execute
  • Remote printing
  • Send messages
  • Manage files
  • Manage registries
  • Shutdown machine
• The sample is a self-extracting archive containing the hacktool and its components.