Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Classes\VncViewer.Config\shell\open\command] '' = '"%PROGRAM_FILES%\UltraVNC\vncviewer.exe" -config "%1"'
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\vnccom] 'Start' = '00000002'
- [<HKLM>\SYSTEM\ControlSet001\Services\vncdrv] 'Start' = '00000001'
Malicious functions:
Creates and executes the following:
- '%TEMP%\is-KT9B4.tmp\winvnc.exe' -kill
- '%PROGRAM_FILES%\UltraVNC\driver\setupdrv.exe' installs
- 'C:\Archivos de programa\UltraVNC\SetupVnc.exe' /NORESTART /VERYSILENT /loadinf=C:\Archivos de programa\UltraVNC\inst_vnc.inf
- '%TEMP%\is-T1FCV.tmp\is-IL8M7.tmp' /SL4 $60036 "C:\Archivos de programa\ULTRAVNC\SETUPVNC.EXE" 1455639 71680 /NORESTART /VERYSILENT /loadinf=C:\Archivos de programa\UltraVNC\inst_vnc.inf
Executes the following:
- '<SYSTEM32>\runonce.exe' -r
- '<SYSTEM32>\net1.exe' stop winvnc
- '<SYSTEM32>\net.exe' stop winvnc
Modifies file system :
Creates the following files:
- %ALLUSERSPROFILE%\Start Menu\Programs\UltraVNC\UltraVNC Viewer.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\UltraVNC\UltraVNC Server.lnk
- %HOMEPATH%\Desktop\UltraVNC Viewer.lnk
- %PROGRAM_FILES%\UltraVNC\translation\is-LO2E7.tmp
- %HOMEPATH%\Desktop\UltraVNC Server.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\UltraVNC\UltraVNC Server\Install WinVNC Service silent.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\UltraVNC\UltraVNC Server\Remove WinVNC Service.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\UltraVNC\UltraVNC Server\Install WinVNC Service.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\UltraVNC\UltraVNC Viewer\Run UltraVNC Viewer (Listen Mode).lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\UltraVNC\UltraVNC Viewer\Show UltraVNC Viewer Help.lnk
- %PROGRAM_FILES%\UltraVNC\driver\is-10UJJ.tmp
- %PROGRAM_FILES%\UltraVNC\driver\is-2PGEF.tmp
- %PROGRAM_FILES%\UltraVNC\driver\is-96C2F.tmp
- %PROGRAM_FILES%\UltraVNC\driver\is-BC2TL.tmp
- %PROGRAM_FILES%\UltraVNC\driver\is-2G2FT.tmp
- %PROGRAM_FILES%\UltraVNC\translation\is-JU5T0.tmp
- %PROGRAM_FILES%\UltraVNC\translation\is-T82IL.tmp
- %PROGRAM_FILES%\UltraVNC\is-9LQ3G.tmp
- %PROGRAM_FILES%\UltraVNC\driver\is-F3RF1.tmp
- %PROGRAM_FILES%\UltraVNC\driver\is-E7JL2.tmp
- %WINDIR%\inf\oem3.inf
- %WINDIR%\inf\oem3.PNF
- %PROGRAM_FILES%\UltraVNC\unins000.dat
- %ALLUSERSPROFILE%\Start Menu\Programs\UltraVNC\UltraVNC Driver\Install Driver.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\UltraVNC\UltraVNC Driver\Remove Driver.lnk
- <DRIVERS>\vnccom.SYS
- <SYSTEM32>\'
- <SYSTEM32>\SET5.tmp
- <DRIVERS>\SET3.tmp
- <SYSTEM32>\SET4.tmp
- %ALLUSERSPROFILE%\Start Menu\Programs\UltraVNC\UltraVNC Server\Show Default Settings.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\UltraVNC\UltraVNC Server\Show User Settings.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\UltraVNC\UltraVNC Server\Show WinVNC Server Help.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\UltraVNC\UltraVNC Server\Reinstall WinVNC Service (Silent).lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\UltraVNC\UltraVNC Server\Run Service Helper.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\UltraVNC\Doc\Whatsnew.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\UltraVNC\Doc\Licence.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\UltraVNC\Doc\Readme.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\UltraVNC\UltraVNC Server\Show About Box.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\UltraVNC\UltraVNC Server\Install Default Registry Settings.lnk
- C:\Archivos de programa\UltraVNC\Mantenimiento.lnk
- %TEMP%\is-T1FCV.tmp\is-IL8M7.tmp
- %ALLUSERSPROFILE%\Escritorio\Mantenimiento.lnk
- C:\Archivos de programa\UltraVNC\IP.ini
- %WINDIR%\Escritorio\Mantenimiento.lnk
- %PROGRAM_FILES%\UltraVNC\is-403SS.tmp
- %PROGRAM_FILES%\UltraVNC\is-CI9IQ.tmp
- %TEMP%\is-KT9B4.tmp\_isetup\_isdecmp.dll
- %TEMP%\is-KT9B4.tmp\_isetup\_RegDLL.tmp
- %TEMP%\is-KT9B4.tmp\_isetup\_shfoldr.dll
- C:\Archivos de programa\UltraVNC\inst_vnc.inf
- C:\Archivos de programa\UltraVNC\instala.bat
- C:\Archivos de programa\UltraVNC\mto.ico
- C:\Archivos de programa\UltraVNC\Mto.lnk
- C:\Archivos de programa\UltraVNC\vnc.bat
- C:\Archivos de programa\UltraVNC\AMto.lnk
- C:\Archivos de programa\UltraVNC\Mantenimiento.exe
- C:\Archivos de programa\UltraVNC\Acceso Mantenimiento.lnk
- C:\Archivos de programa\UltraVNC\SetupVnc.exe
- C:\Archivos de programa\UltraVNC\Acceso Mto.lnk
- %PROGRAM_FILES%\UltraVNC\is-DH9C7.tmp
- %PROGRAM_FILES%\UltraVNC\is-GJQI2.tmp
- %PROGRAM_FILES%\UltraVNC\is-M08U3.tmp
- %PROGRAM_FILES%\UltraVNC\is-N9B6N.tmp
- %PROGRAM_FILES%\UltraVNC\is-AEOFN.tmp
- %PROGRAM_FILES%\UltraVNC\driver\is-MDU1N.tmp
- %PROGRAM_FILES%\UltraVNC\driver\is-SCDCR.tmp
- %PROGRAM_FILES%\UltraVNC\driver\is-IFPNI.tmp
- %PROGRAM_FILES%\UltraVNC\driver\is-5B3BF.tmp
- %PROGRAM_FILES%\UltraVNC\driver\is-QOLNP.tmp
- %PROGRAM_FILES%\UltraVNC\is-NVJU6.tmp
- %PROGRAM_FILES%\UltraVNC\is-IQIOC.tmp
- %TEMP%\is-KT9B4.tmp\winvnc.exe
- %PROGRAM_FILES%\UltraVNC\is-R6IIQ.tmp
- %PROGRAM_FILES%\UltraVNC\is-Q56E0.tmp
- %PROGRAM_FILES%\UltraVNC\is-LQE5T.tmp
- %PROGRAM_FILES%\UltraVNC\is-A7HO5.tmp
- %PROGRAM_FILES%\UltraVNC\is-U01TT.tmp
- %PROGRAM_FILES%\UltraVNC\is-E4T9J.tmp
- %PROGRAM_FILES%\UltraVNC\is-30C6U.tmp
Deletes the following files:
- %TEMP%\is-KT9B4.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-T1FCV.tmp\is-IL8M7.tmp
- %TEMP%\is-KT9B4.tmp\_isetup\_RegDLL.tmp
- %TEMP%\is-KT9B4.tmp\winvnc.exe
- %TEMP%\is-KT9B4.tmp\_isetup\_isdecmp.dll
Moves the following files:
- from %PROGRAM_FILES%\UltraVNC\driver\is-96C2F.tmp to %PROGRAM_FILES%\UltraVNC\driver\vnccom.sys
- from %PROGRAM_FILES%\UltraVNC\driver\is-2G2FT.tmp to %PROGRAM_FILES%\UltraVNC\driver\uninstall_silent.bat
- from %PROGRAM_FILES%\UltraVNC\driver\is-2PGEF.tmp to %PROGRAM_FILES%\UltraVNC\driver\vncdrv.inf
- from %PROGRAM_FILES%\UltraVNC\driver\is-10UJJ.tmp to %PROGRAM_FILES%\UltraVNC\driver\vncdrv.dll
- from %PROGRAM_FILES%\UltraVNC\driver\is-MDU1N.tmp to %PROGRAM_FILES%\UltraVNC\driver\license.txt
- from %PROGRAM_FILES%\UltraVNC\driver\is-IFPNI.tmp to %PROGRAM_FILES%\UltraVNC\driver\install_silent.bat
- from %PROGRAM_FILES%\UltraVNC\driver\is-BC2TL.tmp to %PROGRAM_FILES%\UltraVNC\driver\uninstall.bat
- from %PROGRAM_FILES%\UltraVNC\driver\is-SCDCR.tmp to %PROGRAM_FILES%\UltraVNC\driver\setupdrv.exe
- from %PROGRAM_FILES%\UltraVNC\driver\is-F3RF1.tmp to %PROGRAM_FILES%\UltraVNC\driver\vncdrv.sys
- from <DRIVERS>\SET3.tmp to <DRIVERS>\vncdrv.sys
- from %PROGRAM_FILES%\UltraVNC\translation\is-LO2E7.tmp to %PROGRAM_FILES%\UltraVNC\translation\readme.txt
- from <SYSTEM32>\SET5.tmp to <SYSTEM32>\vnchelp.dll
- from <SYSTEM32>\SET4.tmp to <SYSTEM32>\vncdrv.dll
- from %PROGRAM_FILES%\UltraVNC\is-9LQ3G.tmp to %PROGRAM_FILES%\UltraVNC\vncviewer.exe
- from %PROGRAM_FILES%\UltraVNC\driver\is-E7JL2.tmp to %PROGRAM_FILES%\UltraVNC\driver\vnchelp.dll
- from %PROGRAM_FILES%\UltraVNC\translation\is-T82IL.tmp to %PROGRAM_FILES%\UltraVNC\translation\german.dll
- from %PROGRAM_FILES%\UltraVNC\translation\is-JU5T0.tmp to %PROGRAM_FILES%\UltraVNC\translation\french.dll
- from %PROGRAM_FILES%\UltraVNC\driver\is-QOLNP.tmp to %PROGRAM_FILES%\UltraVNC\driver\install.bat
- from %PROGRAM_FILES%\UltraVNC\is-IQIOC.tmp to %PROGRAM_FILES%\UltraVNC\vnchooks.dll
- from %PROGRAM_FILES%\UltraVNC\is-NVJU6.tmp to %PROGRAM_FILES%\UltraVNC\winvnc.exe
- from %PROGRAM_FILES%\UltraVNC\is-30C6U.tmp to %PROGRAM_FILES%\UltraVNC\logmessages.dll
- from %PROGRAM_FILES%\UltraVNC\is-E4T9J.tmp to %PROGRAM_FILES%\UltraVNC\VNCHooks_Settings.reg
- from %PROGRAM_FILES%\UltraVNC\is-CI9IQ.tmp to %PROGRAM_FILES%\UltraVNC\Licence.txt
- from %PROGRAM_FILES%\UltraVNC\is-403SS.tmp to %PROGRAM_FILES%\UltraVNC\unins000.exe
- from %PROGRAM_FILES%\UltraVNC\is-Q56E0.tmp to %PROGRAM_FILES%\UltraVNC\Readme.txt
- from %PROGRAM_FILES%\UltraVNC\is-R6IIQ.tmp to %PROGRAM_FILES%\UltraVNC\Whatsnew.txt
- from %PROGRAM_FILES%\UltraVNC\is-U01TT.tmp to %PROGRAM_FILES%\UltraVNC\UnZip32.dll
- from %PROGRAM_FILES%\UltraVNC\is-DH9C7.tmp to %PROGRAM_FILES%\UltraVNC\authSSP.dll
- from %PROGRAM_FILES%\UltraVNC\is-M08U3.tmp to %PROGRAM_FILES%\UltraVNC\ldapauth.dll
- from %PROGRAM_FILES%\UltraVNC\driver\is-5B3BF.tmp to %PROGRAM_FILES%\UltraVNC\driver\before.txt
- from %PROGRAM_FILES%\UltraVNC\is-GJQI2.tmp to %PROGRAM_FILES%\UltraVNC\MSLogonACL.exe
- from %PROGRAM_FILES%\UltraVNC\is-A7HO5.tmp to %PROGRAM_FILES%\UltraVNC\logging.dll
- from %PROGRAM_FILES%\UltraVNC\is-LQE5T.tmp to %PROGRAM_FILES%\UltraVNC\Zip32.dll
- from %PROGRAM_FILES%\UltraVNC\is-AEOFN.tmp to %PROGRAM_FILES%\UltraVNC\workgrpdomnt4.dll
- from %PROGRAM_FILES%\UltraVNC\is-N9B6N.tmp to %PROGRAM_FILES%\UltraVNC\authadmin.dll
Miscellaneous:
Searches for the following windows:
- ClassName: '(null)' WindowName: 'Hardware Installation'
- ClassName: '(null)' WindowName: 'Software Installation'
- ClassName: 'WinVNC Tray Icon' WindowName: '(null)'
- ClassName: 'EDIT' WindowName: '(null)'
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'