Riskware/ReBrandPkgWinVNCKaseyaRemoteContClient Riskware/ReBrandPkgWinVNCKaseyaRemoteContClient is a generic detection for an unwanted application. Since this is a generic detection, Grayware samples that are detected as such may have varying behaviour. Below are some of its observed characteristics/behaviours: This detection is intended for a WinVNC like application named packaged/delivered as Kaseya Remote Control Client..
The application/installer/package has been observed to drop the following files: %Temp%\kvncviewer.exe
%Temp%\vncviewer.exe The application will run using the following parameters:
%Temp%\kvncviewer.exe AutoSelect=0 LowColourLevel=1 FullColour=1 FullScreen=0 SendKeyEvents=1 SendPointerEvents=1 -listen Below are some illustration of this application/package: Figure 1: File Properties page for the package/application. Figure 2: Windows Warning message for firewall to allow to pass thru. Figure 3: Error/Warning message on none configured run of the application. Figure 4: Help page of the application. Figure 4: Another GUI of this application/package. Following are some of the near/exact IOCs/file hash associated with this detection: Md5: 064CA69A99379B0BF57B2C39671B6BB2 Sha256: 88130eb1ed8dd25d6c46bc7ab66ada538da43c20a06cc678cff537a39c54724a Md5: 1EE72B3155A9934F9666CBCE72845865 Sha256: 144f452be1498a6580864ffd5e97d34b7fbb701f8f21eec80dc92b5a6d76297d Md5: 268F9D879D4193C6E9F53E7F6935554B Sha256: b7e25d0f9852f196f28281a75c98f0f4c1d578157d11415292646aae041cac18 Md5: 2D61DAA32293B5713012B01A3D57DEDB Sha256: 0fa0e9944a2b26fe692c9fb368734b81f0e905ce6282b1e1e185861ebf2bdfa8 Md5: 302516F1DF7F5011F1064EF7FCC71390 Sha256: 8531a6e623b351bcfe2fb7c47488f32c04c39f59a090c65b9b97898e0bf731a8 Md5: 398DA6305E0A85CDB7B2DADBFCF9A420 Sha256: 2d9e792a395379c371010bbd7ccc9af29fb8cfbb882156d47cfd7103396190ad Md5: 6317F0AB6E7588C7F2D7571934057CD7 Sha256: 97efe1359e990b73ad6a8d14ab67099bab0758f858215351111738687ab6ed69 Md5: 70F5B4D38C7208A5E8B798BD2A606B01 Sha256: d803eb5a946418413c5790a0c0749a3aea9da36718156d2b140e4a94cab4e940 Md5: 77FD862A7B4BC9F90226DDB2A79C45EB Sha256: 10d5bd9168123537cce268c1e98fd1b4584fb1a0397d9048b632a58f36bda91f Md5: 833DC1A74A12172278C6B6E50AB97F0C Sha256: 8ce6af1c96eb43add8a770ac2a707b1e6d8678fd96358beed302c2b619431e3d Md5: B28728CF2F51DA8BF6E6D00159EF8C53 Sha256: 1990b251ff8732472bdcdcd8dadd8b7fcd6d011965a65441f1987cd493aa4bd7 Md5: B998C58A35E49B4979DDDC6A9A7A2B43 Sha256: 9a57b82962b33e81ea58a0a242201ffa7327cbb73dfcf2286110253dc82e7d4b Md5: C5D620789BDB4CD25C14E360AC42B1C3 Sha256: 15c09af2d3a76eda1ebb2336e34e2df0ffe2754f03381f273c7ee4e188d4a4d0 Md5: CB04FF077F0A7D7178376050603DE756 Sha256: bb32ecc9b650ebc2c838d8efbf6e1bf68040e056e471bc2af5b0d430d2235a30 Md5: E4A23DE6A5AC1E0F3D8A5AEA73FF9E23 Sha256: d47a48496cf913fe278abe4697df0184ff2deb4ac8242c5b281bfa7456305488
Make sure that your FortiGate/FortiClient system is using the latest AV database.
Quarantine/delete files that are detected and replace infected files with clean backup copies.
