#RADMIN V2.0 PDF#
#RADMIN V2.0 DRIVERS#
#RADMIN V2.0 FULL#
#RADMIN V2.0 FOR ANDROID#
#RADMIN V2.0 CODE#

#RADMIN V2.0 CODE#

The backdoor code is activated when specially crafted document is opened on target machine. This group is dedicated to recording keystrokes, grabbing text from password input fields and making screencaptures.Ĭurrent group contains installer and payload code to plant a plugin in popular applications such as MS Office or Adobe Reader. This group capable of recognition, restoration and copying already deleted files of MS Office document formats by using own FAT-based filesystem parser. It can copy files from predefined extension list, size and age. It monitors USB device events and starts every time new device is attached. This group is used to steal files from attached USB devices.

#RADMIN V2.0 FULL#

It’s capable of dumping full email bodies with headers, saving attachments with predefined file extensions. This group serves stealing emails from local MS Outlook storage or remote POP3/IMAP mail server. Capable of using low-level and direct disk access to copy protected files. This group of modules is designed to steal credentials from various applications and resources, from Agent (popupal free app from ) to MS Outlook credentials and Windows account hashes (including cached Windows Domain account hashes). Also, these modules collect initial easy-to-get type of information such as browser history, browser cached credentials and FTP client settings. Their main purpose is to collect general information about target system which helps locate and identify the infected machine, estimate potential value of current computer data and define which other modules should be pushed next. Modules of this group designed to be used during first stage of cyberattack right after initial infiltration.

Replicate via network using previously obtained administrative credentials.

Perform a network scan within a predefined range and replicate to vulnerable machines using the MS08-067 vulnerability.

Perform a network scan, dump configuration data from Cisco devices if available.

Write and/or execute arbitrary code provided within the task.

Download files from FTP servers that are reachable from the infected machine (including those that are connected to its local network) using previously obtained credentials.

Determine the external IP address of the infected machine.

Extract Windows account hashes, most likely for offline cracking.

Extract saved passwords for Web sites, FTP servers, mail and IM accounts.

Extract browsing history from Chrome, Firefox, Internet Explorer, Opera.

#RADMIN V2.0 DRIVERS#

Collect information about installed software, most notably Oracle DB, RAdmin, IM software including Mail.Ru agent, drivers and software for Windows Mobile, Nokia, SonyEricsson, HTC, Android phones, USB drives.Collect filesystem and network share information, build directory listings, search and retrieve files by mask provided by the C&C server.Collect general software and hardware environment information.Retrieve e-mail messages and attachments from Microsoft Outlook and from reachable mail servers using previously obtained credentials.Execute additional encrypted modules according to a pre-defined schedule.Record all the keystrokes, make screenshots.

#RADMIN V2.0 PDF#

Wait for a specially crafted Microsoft Office or PDF document and execute a malicious payload embedded in that document, implementing a one-way covert channel of communication that can be used to restore control of the infected machine.

Once connected, infect the phone with a mobile version of the Sputnik main component Wait for a Windows Mobile phone to be connected.Once connected, retrieve information about the phone, its phone book, contact list, call history, calendar, SMS messages, browsing history Wait for an iPhone or a Nokia phone to be connected.Deleted files are restored using a built in file system parser Once a USB drive is connected, search and extract files by mask/format, including deleted files.

These tasks are provided as PE EXE files and are installed to the infected machine. waiting for the iPhone or Nokia mobile to connect. Several tasks need to be constantly present, i.e. Most of the tasks are provided as one-time PE DLL libraries that are received from the server, executed in memory and then immediately discarded. The main component of Sputnik implements a framework for executing the “tasks” that are provided by its C&C servers. Modules, general overview Module framework

Kaspersky Advanced Cyber Incident Communicationsġ.

KasperskyEndpoint Detection and Response.

KasperskyPhysical, Virtual & Cloud Workloads Security.

KasperskyEndpoint Security for Business Advanced.

KasperskyEndpoint Security for Business Select.

#RADMIN V2.0 FOR ANDROID#

Kaspersky Internet Security for Android.

2022.09