Trojan.MulDrop5.36233

Техническая информация

Для обеспечения автозапуска и распространения:

Создает или изменяет следующие файлы:

%HOMEPATH%\Start Menu\Programs\Startup\IntelAgent.lnk

Вредоносные функции:

Для обхода брандмауэра удаляет или модифицирует следующие ключи реестра:

[<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] 'C:\Intel\IntelUpdate.exe' = 'C:\Intel\IntelUpdate.exe:*:Enabled:Intel Updater'
[<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List] 'C:\Intel\IntelUpdate.exe' = 'C:\Intel\IntelUpdate.exe:*:Enabled:Intel Updater'

Запускает на исполнение:

'<SYSTEM32>\netsh.exe' firewall add allowedprogram program="C:\Intel\IntelUpdate.exe" name="Intel Updater" mode=ENABLE profile=ALL
'<SYSTEM32>\findstr.exe' /i "6\.2\."
'<SYSTEM32>\reg.exe' QUERY "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" /v startup
'<SYSTEM32>\schtasks.exe' /create /sc minute /mo 10 /sd 03/01/2011 /tn "Intel Task" /tr "wscript.exe c:\intel\i.vbs C:\Intel\itask.bat"
'<SYSTEM32>\ping.exe' -n 1 -w 0 spd.zapto.org
'<SYSTEM32>\findstr.exe' /i "6\.1\."
'<SYSTEM32>\cmd.exe' /c ""c:\Intel\Install.bat" "
'<SYSTEM32>\wscript.exe' c:\intel\i.vbs c:\Intel\Install.bat
'<SYSTEM32>\findstr.exe' /i "5\.1\."
'<SYSTEM32>\findstr.exe' /i "6\.0\."
'<SYSTEM32>\findstr.exe' /i "5\.2\."

Изменения в файловой системе:

Создает следующие файлы:

C:\Intel\Dictionary\Unfiltered-teclado3C.dic
C:\Intel\Dictionary\Unfiltered-sobrenomes_todos_SA.dic
C:\Intel\Dictionary\Unfiltered-teclado4C.dic
C:\Intel\tacc\algorithms\taccAlg_Office2007_9_1_0120.dll
C:\Intel\Dictionary\Unfiltered-TUDOQEXISTE.dic
C:\Intel\Dictionary\Unfiltered-Portugues_palavras incompletas.dic
C:\Intel\Dictionary\Unfiltered-NomesBR_nomes incompletos.dic
C:\Intel\Dictionary\Unfiltered-Nomes BR pacotao (sem acentos).dic
C:\Intel\Dictionary\Unfiltered-Num_Duplic.dic
C:\Intel\Dictionary\Unfiltered-Portugues original_sem verbos e sem acentos.dic
C:\Intel\Dictionary\Unfiltered-Portugues original sem verb sem ace PRONUNCIA.dic
C:\Intel\tacc\algorithms\taccAlg_PBKDF2-SHA1_10_1_0100.dll
C:\Intel\install.bat
C:\Intel\i.vbs
C:\Intel\null
C:\Intel\ip1.txt
%APPDATA%\Passware\SearchAgent\Settings.ini
C:\Intel\tacc\taccapi.dll
C:\Intel\tacc\algorithms\taccAlg_PGP_Message_5_1_0090.dll
C:\Intel\tacc\algorithms\taccAlg_PGP_Disk_v6_7_1_0090.dll
C:\Intel\tacc\algorithms\taccAlg_PGP_SDA_8_1_0090.dll
C:\Intel\tacc\algorithms\taccAlg_WinZip9_3_1_0080.dll
C:\Intel\tacc\algorithms\taccAlg_WinRAR_4_1_0090.dll
C:\Intel\Dictionary\Unfiltered-mes_numerico.dic
C:\Intel\Dictionary\Unfiltered-2min+num_repetidos2-4-6-8.dic
C:\Intel\Dictionary\Portuguese.dic
C:\Intel\Dictionary\Unfiltered-2Xe3X_3minSR_.dic
C:\Intel\Dictionary\Unfiltered-3min_SR.dic
C:\Intel\Dictionary\Unfiltered-2x_Nomes BR_duplic (3 a 6 letras)txt.dic
C:\Intel\Dictionary\English.dic
C:\Intel\IntelAgent.lnk
C:\Intel\IntelAgent.bat
C:\Intel\IntelUpdate.ex
C:\Intel\Settings.ini
C:\Intel\itask.bat
C:\Intel\Dictionary\Unfiltered-4min_SR.dic
C:\Intel\Dictionary\Unfiltered-dias_numericos.dic
C:\Intel\Dictionary\Unfiltered-declara_amor.dic
C:\Intel\Dictionary\Unfiltered-finais.dic
C:\Intel\Dictionary\Unfiltered-Letras repetidas.dic
C:\Intel\Dictionary\Unfiltered-finais_inho(a)_zinho(a).dic
C:\Intel\Dictionary\Unfiltered-Da_do_das_dos_de.dic
C:\Intel\Dictionary\Unfiltered-Ano_1990a2020.dic
C:\Intel\Dictionary\Unfiltered-Ano_1940a2020.dic
C:\Intel\Dictionary\Unfiltered-Ano_dezenas.dic
C:\Intel\Dictionary\Unfiltered-Caracteres_repetidos_1ate4.dic
C:\Intel\Dictionary\Unfiltered-Apelidos_SA.dic