Remacc.Radmin

Remacc.Radmin is often installed from a legitimate package to a configurable location. By default, that location is C:\Program Files\radmin. However, its component can be placed on a computer without any installation procedure.

Upon execution, Remacc.Radmin can be configured to run in stealth mode, allowing the remote attacker to control the compromised computer. The ports used are configurable.

When Remacc.Radmin is installed, it does the following:

1. Creates the following registry subkey:
   
   HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\r_server
   
   so that a service is created.
   
   
2. Creates a service with the following characteristics:
   
   Service Name: r_server
   Display Name: Remote Administrator Service
   
   
3. Creates the following subkeys:
   
   HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Remote Administrator v2.2
   HKEY_LOCAL_MACHINE\System\RAdmin
   
   
4. May modify the hosts file.

Summary