Trojan.MulDrop5.168

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKLM>\SOFTWARE\Classes\InnoSetupScriptFile\shell\open\command] '' = '"%PROGRAM_FILES%\Inno Setup 5\Compil32.exe" "%1"'

Вредоносные функции:

Создает и запускает на исполнение:

'%PROGRAM_FILES%\Inno Setup 5\Compil32.exe' /ASSOC
'%APPDATA%\doctor.exe'
'%APPDATA%\isetup-5.4.0.exe' /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-
'%TEMP%\is-FUR9U.tmp\isetup-5.4.0.tmp' /SL5="$1013E,1275472,54272,%APPDATA%\isetup-5.4.0.exe" /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-

Запускает на исполнение:

'<SYSTEM32>\cmd.exe' /c ""%APPDATA%\x.cmd" "

Изменения в файловой системе:

Создает следующие файлы:

%PROGRAM_FILES%\Inno Setup 5\Examples\is-7VONE.tmp
%PROGRAM_FILES%\Inno Setup 5\Examples\is-12E1M.tmp
%PROGRAM_FILES%\Inno Setup 5\Examples\is-KV4ME.tmp
%PROGRAM_FILES%\Inno Setup 5\Examples\is-T07GC.tmp
%PROGRAM_FILES%\Inno Setup 5\Examples\is-TEGDG.tmp
%PROGRAM_FILES%\Inno Setup 5\Examples\is-9TM8N.tmp
%PROGRAM_FILES%\Inno Setup 5\Examples\is-2OBD8.tmp
%PROGRAM_FILES%\Inno Setup 5\Examples\is-VFR5R.tmp
%PROGRAM_FILES%\Inno Setup 5\Examples\is-AQMF4.tmp
%PROGRAM_FILES%\Inno Setup 5\Examples\is-LCTLH.tmp
%PROGRAM_FILES%\Inno Setup 5\Examples\is-OHVA6.tmp
%PROGRAM_FILES%\Inno Setup 5\is-5TONQ.tmp
%PROGRAM_FILES%\Inno Setup 5\is-25FCQ.tmp
%PROGRAM_FILES%\Inno Setup 5\is-HN682.tmp
%PROGRAM_FILES%\Inno Setup 5\is-GAKU8.tmp
%PROGRAM_FILES%\Inno Setup 5\is-0HU56.tmp
%PROGRAM_FILES%\Inno Setup 5\Examples\is-AU7AL.tmp
%PROGRAM_FILES%\Inno Setup 5\Examples\is-2S516.tmp
%PROGRAM_FILES%\Inno Setup 5\Examples\is-31N20.tmp
%PROGRAM_FILES%\Inno Setup 5\is-7SBL1.tmp
%PROGRAM_FILES%\Inno Setup 5\Examples\is-T7NQA.tmp
%PROGRAM_FILES%\Inno Setup 5\Examples\is-U71J6.tmp
%ALLUSERSPROFILE%\Start Menu\Programs\Inno Setup 5\Inno Setup Compiler.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\Inno Setup 5\Inno Setup Documentation.lnk
%PROGRAM_FILES%\Inno Setup 5\Examples\is-AFAGR.tmp
%PROGRAM_FILES%\Inno Setup 5\Examples\MyDll\Delphi\is-F48V4.tmp
%PROGRAM_FILES%\Inno Setup 5\Examples\is-UNJ1S.tmp
%PROGRAM_FILES%\Inno Setup 5\unins000.msg
%PROGRAM_FILES%\Inno Setup 5\unins000.dat
%ALLUSERSPROFILE%\Start Menu\Programs\Inno Setup 5\Inno Setup Revision History.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\Inno Setup 5\Inno Setup Example Scripts.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\Inno Setup 5\Inno Setup FAQ.lnk
%PROGRAM_FILES%\Inno Setup 5\Examples\MyDll\C\is-JMOO8.tmp
%PROGRAM_FILES%\Inno Setup 5\Examples\is-6U6O6.tmp
%PROGRAM_FILES%\Inno Setup 5\Examples\is-58J93.tmp
%PROGRAM_FILES%\Inno Setup 5\Examples\is-95L9L.tmp
%PROGRAM_FILES%\Inno Setup 5\Examples\is-JMMT5.tmp
%PROGRAM_FILES%\Inno Setup 5\Examples\is-IO9C6.tmp
%PROGRAM_FILES%\Inno Setup 5\Examples\MyDll\C\is-LSCPD.tmp
%PROGRAM_FILES%\Inno Setup 5\Examples\MyDll\C\is-C0D7G.tmp
%PROGRAM_FILES%\Inno Setup 5\Examples\is-KCE18.tmp
%PROGRAM_FILES%\Inno Setup 5\Examples\is-DR46S.tmp
%PROGRAM_FILES%\Inno Setup 5\Examples\is-T1SA2.tmp
%PROGRAM_FILES%\Inno Setup 5\is-5TRRQ.tmp
%PROGRAM_FILES%\Inno Setup 5\is-8T68M.tmp
%PROGRAM_FILES%\Inno Setup 5\is-TRN79.tmp
%PROGRAM_FILES%\Inno Setup 5\is-6DM58.tmp
%PROGRAM_FILES%\Inno Setup 5\is-7CCG7.tmp
%PROGRAM_FILES%\Inno Setup 5\Languages\is-56ATD.tmp
%PROGRAM_FILES%\Inno Setup 5\Languages\is-8JN70.tmp
%PROGRAM_FILES%\Inno Setup 5\Languages\is-NC0NB.tmp
%PROGRAM_FILES%\Inno Setup 5\Languages\is-QF28E.tmp
%PROGRAM_FILES%\Inno Setup 5\Languages\is-QPU3C.tmp
%PROGRAM_FILES%\Inno Setup 5\is-CCEJN.tmp
%TEMP%\is-FUR9U.tmp\isetup-5.4.0.tmp
%TEMP%\is-JK4IV.tmp\_isetup\_RegDLL.tmp
%APPDATA%\isetup-5.4.0.exe
%APPDATA%\x.cmd
%APPDATA%\doctor.exe
%PROGRAM_FILES%\Inno Setup 5\is-NMB5I.tmp
%PROGRAM_FILES%\Inno Setup 5\is-D4OV2.tmp
%PROGRAM_FILES%\Inno Setup 5\is-V2A1A.tmp
%TEMP%\is-JK4IV.tmp\_isetup\_shfoldr.dll
%PROGRAM_FILES%\Inno Setup 5\is-F378A.tmp
%PROGRAM_FILES%\Inno Setup 5\Languages\is-9QRF4.tmp
%PROGRAM_FILES%\Inno Setup 5\is-LOKBF.tmp
%PROGRAM_FILES%\Inno Setup 5\is-4T8HH.tmp
%PROGRAM_FILES%\Inno Setup 5\Languages\is-VEEBT.tmp
%PROGRAM_FILES%\Inno Setup 5\Languages\is-1TU1N.tmp
%PROGRAM_FILES%\Inno Setup 5\Languages\is-EN7B1.tmp
%PROGRAM_FILES%\Inno Setup 5\is-33BNO.tmp
%PROGRAM_FILES%\Inno Setup 5\is-GFQ74.tmp
%PROGRAM_FILES%\Inno Setup 5\is-ODKOT.tmp
%PROGRAM_FILES%\Inno Setup 5\is-GT4P3.tmp
%PROGRAM_FILES%\Inno Setup 5\is-2PED6.tmp
%PROGRAM_FILES%\Inno Setup 5\Languages\is-4J8C3.tmp
%PROGRAM_FILES%\Inno Setup 5\Languages\is-0BAA9.tmp
%PROGRAM_FILES%\Inno Setup 5\Languages\is-CD87P.tmp
%PROGRAM_FILES%\Inno Setup 5\Languages\is-R8OOK.tmp
%PROGRAM_FILES%\Inno Setup 5\Languages\is-3JQH3.tmp
%PROGRAM_FILES%\Inno Setup 5\Languages\is-TSEP4.tmp
%PROGRAM_FILES%\Inno Setup 5\Languages\is-UB0E6.tmp
%PROGRAM_FILES%\Inno Setup 5\Languages\is-G3LGK.tmp
%PROGRAM_FILES%\Inno Setup 5\Languages\is-P9GOI.tmp
%PROGRAM_FILES%\Inno Setup 5\Languages\is-5E4LK.tmp
%PROGRAM_FILES%\Inno Setup 5\Languages\is-N8SU2.tmp

Удаляет следующие файлы:

%APPDATA%\isetup-5.4.0.exe
%APPDATA%\doctor.exe
%APPDATA%\x.cmd
%TEMP%\is-JK4IV.tmp\_isetup\_RegDLL.tmp
%TEMP%\is-JK4IV.tmp\_isetup\_shfoldr.dll
%TEMP%\is-FUR9U.tmp\isetup-5.4.0.tmp

Перемещает следующие файлы:

%PROGRAM_FILES%\Inno Setup 5\Examples\is-T07GC.tmp в %PROGRAM_FILES%\Inno Setup 5\Examples\64BitTwoArch.iss
%PROGRAM_FILES%\Inno Setup 5\Examples\is-TEGDG.tmp в %PROGRAM_FILES%\Inno Setup 5\Examples\Components.iss
%PROGRAM_FILES%\Inno Setup 5\Examples\is-2S516.tmp в %PROGRAM_FILES%\Inno Setup 5\Examples\64Bit.iss
%PROGRAM_FILES%\Inno Setup 5\Examples\is-OHVA6.tmp в %PROGRAM_FILES%\Inno Setup 5\Examples\64BitThreeArch.iss
%PROGRAM_FILES%\Inno Setup 5\Examples\is-KV4ME.tmp в %PROGRAM_FILES%\Inno Setup 5\Examples\Languages.iss
%PROGRAM_FILES%\Inno Setup 5\Examples\is-AQMF4.tmp в %PROGRAM_FILES%\Inno Setup 5\Examples\MyProg-IA64.exe
%PROGRAM_FILES%\Inno Setup 5\Examples\is-LCTLH.tmp в %PROGRAM_FILES%\Inno Setup 5\Examples\MyProg.chm
%PROGRAM_FILES%\Inno Setup 5\Examples\is-7VONE.tmp в %PROGRAM_FILES%\Inno Setup 5\Examples\MyProg.exe
%PROGRAM_FILES%\Inno Setup 5\Examples\is-12E1M.tmp в %PROGRAM_FILES%\Inno Setup 5\Examples\MyProg-x64.exe
%PROGRAM_FILES%\Inno Setup 5\is-HN682.tmp в %PROGRAM_FILES%\Inno Setup 5\islzma32.exe
%PROGRAM_FILES%\Inno Setup 5\is-5TONQ.tmp в %PROGRAM_FILES%\Inno Setup 5\islzma64.exe
%PROGRAM_FILES%\Inno Setup 5\is-GAKU8.tmp в %PROGRAM_FILES%\Inno Setup 5\isbunzip.dll
%PROGRAM_FILES%\Inno Setup 5\is-0HU56.tmp в %PROGRAM_FILES%\Inno Setup 5\islzma.dll
%PROGRAM_FILES%\Inno Setup 5\is-25FCQ.tmp в %PROGRAM_FILES%\Inno Setup 5\whatsnew.htm
%PROGRAM_FILES%\Inno Setup 5\Examples\is-31N20.tmp в %PROGRAM_FILES%\Inno Setup 5\Examples\Example2.iss
%PROGRAM_FILES%\Inno Setup 5\Examples\is-AU7AL.tmp в %PROGRAM_FILES%\Inno Setup 5\Examples\Example3.iss
%PROGRAM_FILES%\Inno Setup 5\is-7SBL1.tmp в %PROGRAM_FILES%\Inno Setup 5\isfaq.htm
%PROGRAM_FILES%\Inno Setup 5\Examples\is-T7NQA.tmp в %PROGRAM_FILES%\Inno Setup 5\Examples\Example1.iss
%PROGRAM_FILES%\Inno Setup 5\Examples\is-KCE18.tmp в %PROGRAM_FILES%\Inno Setup 5\Examples\MyDll.dll
%PROGRAM_FILES%\Inno Setup 5\Examples\MyDll\C\is-LSCPD.tmp в %PROGRAM_FILES%\Inno Setup 5\Examples\MyDll\C\MyDll.c
%PROGRAM_FILES%\Inno Setup 5\Examples\is-DR46S.tmp в %PROGRAM_FILES%\Inno Setup 5\Examples\CodePrepareToInstall.iss
%PROGRAM_FILES%\Inno Setup 5\Examples\is-T1SA2.tmp в %PROGRAM_FILES%\Inno Setup 5\Examples\UninstallCodeExample1.iss
%PROGRAM_FILES%\Inno Setup 5\Examples\MyDll\C\is-C0D7G.tmp в %PROGRAM_FILES%\Inno Setup 5\Examples\MyDll\C\MyDll.def
%PROGRAM_FILES%\Inno Setup 5\Examples\is-UNJ1S.tmp в %PROGRAM_FILES%\Inno Setup 5\Examples\ISPPExample1.iss
%PROGRAM_FILES%\Inno Setup 5\Examples\is-AFAGR.tmp в %PROGRAM_FILES%\Inno Setup 5\Examples\ISPPExample1License.txt
%PROGRAM_FILES%\Inno Setup 5\Examples\MyDll\C\is-JMOO8.tmp в %PROGRAM_FILES%\Inno Setup 5\Examples\MyDll\C\MyDll.dsp
%PROGRAM_FILES%\Inno Setup 5\Examples\MyDll\Delphi\is-F48V4.tmp в %PROGRAM_FILES%\Inno Setup 5\Examples\MyDll\Delphi\MyDll.dpr
%PROGRAM_FILES%\Inno Setup 5\Examples\is-2OBD8.tmp в %PROGRAM_FILES%\Inno Setup 5\Examples\Readme-German.txt
%PROGRAM_FILES%\Inno Setup 5\Examples\is-U71J6.tmp в %PROGRAM_FILES%\Inno Setup 5\Examples\CodeExample1.iss
%PROGRAM_FILES%\Inno Setup 5\Examples\is-VFR5R.tmp в %PROGRAM_FILES%\Inno Setup 5\Examples\Readme.txt
%PROGRAM_FILES%\Inno Setup 5\Examples\is-9TM8N.tmp в %PROGRAM_FILES%\Inno Setup 5\Examples\Readme-Dutch.txt
%PROGRAM_FILES%\Inno Setup 5\Examples\is-JMMT5.tmp в %PROGRAM_FILES%\Inno Setup 5\Examples\CodeDlg.iss
%PROGRAM_FILES%\Inno Setup 5\Examples\is-6U6O6.tmp в %PROGRAM_FILES%\Inno Setup 5\Examples\CodeAutomation.iss
%PROGRAM_FILES%\Inno Setup 5\Examples\is-58J93.tmp в %PROGRAM_FILES%\Inno Setup 5\Examples\CodeAutomation2.iss
%PROGRAM_FILES%\Inno Setup 5\Examples\is-IO9C6.tmp в %PROGRAM_FILES%\Inno Setup 5\Examples\CodeClasses.iss
%PROGRAM_FILES%\Inno Setup 5\Examples\is-95L9L.tmp в %PROGRAM_FILES%\Inno Setup 5\Examples\CodeDll.iss
%PROGRAM_FILES%\Inno Setup 5\is-GFQ74.tmp в %PROGRAM_FILES%\Inno Setup 5\isbzip.dll
%PROGRAM_FILES%\Inno Setup 5\Languages\is-QPU3C.tmp в %PROGRAM_FILES%\Inno Setup 5\Languages\BrazilianPortuguese.isl
%PROGRAM_FILES%\Inno Setup 5\Languages\is-NC0NB.tmp в %PROGRAM_FILES%\Inno Setup 5\Languages\Catalan.isl
%PROGRAM_FILES%\Inno Setup 5\is-8T68M.tmp в %PROGRAM_FILES%\Inno Setup 5\Default.isl
%PROGRAM_FILES%\Inno Setup 5\Languages\is-QF28E.tmp в %PROGRAM_FILES%\Inno Setup 5\Languages\Basque.isl
%PROGRAM_FILES%\Inno Setup 5\Languages\is-56ATD.tmp в %PROGRAM_FILES%\Inno Setup 5\Languages\Czech.isl
%PROGRAM_FILES%\Inno Setup 5\Languages\is-3JQH3.tmp в %PROGRAM_FILES%\Inno Setup 5\Languages\French.isl
%PROGRAM_FILES%\Inno Setup 5\Languages\is-TSEP4.tmp в %PROGRAM_FILES%\Inno Setup 5\Languages\Finnish.isl
%PROGRAM_FILES%\Inno Setup 5\Languages\is-8JN70.tmp в %PROGRAM_FILES%\Inno Setup 5\Languages\Danish.isl
%PROGRAM_FILES%\Inno Setup 5\Languages\is-9QRF4.tmp в %PROGRAM_FILES%\Inno Setup 5\Languages\Dutch.isl
%PROGRAM_FILES%\Inno Setup 5\is-NMB5I.tmp в %PROGRAM_FILES%\Inno Setup 5\ISetup.chm
%PROGRAM_FILES%\Inno Setup 5\is-D4OV2.tmp в %PROGRAM_FILES%\Inno Setup 5\Compil32.exe
%PROGRAM_FILES%\Inno Setup 5\is-F378A.tmp в %PROGRAM_FILES%\Inno Setup 5\unins000.exe
%PROGRAM_FILES%\Inno Setup 5\is-V2A1A.tmp в %PROGRAM_FILES%\Inno Setup 5\license.txt
%PROGRAM_FILES%\Inno Setup 5\is-CCEJN.tmp в %PROGRAM_FILES%\Inno Setup 5\isscint.dll
%PROGRAM_FILES%\Inno Setup 5\is-TRN79.tmp в %PROGRAM_FILES%\Inno Setup 5\Setup.e32
%PROGRAM_FILES%\Inno Setup 5\is-5TRRQ.tmp в %PROGRAM_FILES%\Inno Setup 5\SetupLdr.e32
%PROGRAM_FILES%\Inno Setup 5\is-6DM58.tmp в %PROGRAM_FILES%\Inno Setup 5\ISCC.exe
%PROGRAM_FILES%\Inno Setup 5\is-7CCG7.tmp в %PROGRAM_FILES%\Inno Setup 5\ISCmplr.dll
%PROGRAM_FILES%\Inno Setup 5\Languages\is-VEEBT.tmp в %PROGRAM_FILES%\Inno Setup 5\Languages\Spanish.isl
%PROGRAM_FILES%\Inno Setup 5\is-LOKBF.tmp в %PROGRAM_FILES%\Inno Setup 5\WizModernImage.bmp
%PROGRAM_FILES%\Inno Setup 5\Languages\is-1TU1N.tmp в %PROGRAM_FILES%\Inno Setup 5\Languages\Slovak.isl
%PROGRAM_FILES%\Inno Setup 5\Languages\is-EN7B1.tmp в %PROGRAM_FILES%\Inno Setup 5\Languages\Slovenian.isl
%PROGRAM_FILES%\Inno Setup 5\is-4T8HH.tmp в %PROGRAM_FILES%\Inno Setup 5\WizModernImage-IS.bmp
%PROGRAM_FILES%\Inno Setup 5\is-ODKOT.tmp в %PROGRAM_FILES%\Inno Setup 5\iszlib.dll
%PROGRAM_FILES%\Inno Setup 5\is-33BNO.tmp в %PROGRAM_FILES%\Inno Setup 5\isunzlib.dll
%PROGRAM_FILES%\Inno Setup 5\is-GT4P3.tmp в %PROGRAM_FILES%\Inno Setup 5\WizModernSmallImage.bmp
%PROGRAM_FILES%\Inno Setup 5\is-2PED6.tmp в %PROGRAM_FILES%\Inno Setup 5\WizModernSmallImage-IS.bmp
%PROGRAM_FILES%\Inno Setup 5\Languages\is-CD87P.tmp в %PROGRAM_FILES%\Inno Setup 5\Languages\Hungarian.isl
%PROGRAM_FILES%\Inno Setup 5\Languages\is-5E4LK.tmp в %PROGRAM_FILES%\Inno Setup 5\Languages\Italian.isl
%PROGRAM_FILES%\Inno Setup 5\Languages\is-R8OOK.tmp в %PROGRAM_FILES%\Inno Setup 5\Languages\German.isl
%PROGRAM_FILES%\Inno Setup 5\Languages\is-0BAA9.tmp в %PROGRAM_FILES%\Inno Setup 5\Languages\Hebrew.isl
%PROGRAM_FILES%\Inno Setup 5\Languages\is-N8SU2.tmp в %PROGRAM_FILES%\Inno Setup 5\Languages\Japanese.isl
%PROGRAM_FILES%\Inno Setup 5\Languages\is-G3LGK.tmp в %PROGRAM_FILES%\Inno Setup 5\Languages\Portuguese.isl
%PROGRAM_FILES%\Inno Setup 5\Languages\is-4J8C3.tmp в %PROGRAM_FILES%\Inno Setup 5\Languages\Russian.isl
%PROGRAM_FILES%\Inno Setup 5\Languages\is-P9GOI.tmp в %PROGRAM_FILES%\Inno Setup 5\Languages\Norwegian.isl
%PROGRAM_FILES%\Inno Setup 5\Languages\is-UB0E6.tmp в %PROGRAM_FILES%\Inno Setup 5\Languages\Polish.isl

Другое:

Ищет следующие окна:

ClassName: 'Shell_TrayWnd' WindowName: '(null)'

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней