Trojan.MulDrop2.46952

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32] 'msacm.ac3filter' = 'ac3filter.acm'

Вредоносные функции:

Запускает на исполнение:

%WINDIR%\regedit.exe /s "%PROGRAM_FILES%\AC3Filter\Reset to defaults.reg"
<SYSTEM32>\cscript.exe "%TEMP%\SetSTDIR.vbs"
<SYSTEM32>\regsvr32.exe /s "%PROGRAM_FILES%\AC3Filter\ac3filter.ax"
%WINDIR%\regedit.exe /s "%PROGRAM_FILES%\AC3Filter\Presets.reg"

Изменения в файловой системе:

Создает следующие файлы:

%PROGRAM_FILES%\AC3Filter\lang\swe\LC_MESSAGES\is-6D77T.tmp
%PROGRAM_FILES%\AC3Filter\lang\zh@Simplified\LC_MESSAGES\is-IF60N.tmp
%PROGRAM_FILES%\AC3Filter\lang\spa\LC_MESSAGES\is-6EPRP.tmp
%PROGRAM_FILES%\AC3Filter\lang\slo\LC_MESSAGES\is-KR1M4.tmp
%PROGRAM_FILES%\AC3Filter\lang\slv\LC_MESSAGES\is-VKB61.tmp
%PROGRAM_FILES%\AC3Filter\is-66BIV.tmp
%PROGRAM_FILES%\AC3Filter\is-2S64A.tmp
%PROGRAM_FILES%\AC3Filter\is-ILDQV.tmp
%PROGRAM_FILES%\AC3Filter\lang\zh@Traditional\LC_MESSAGES\is-8EJA2.tmp
%PROGRAM_FILES%\AC3Filter\is-BCUR0.tmp
%PROGRAM_FILES%\AC3Filter\lang\rus\LC_MESSAGES\is-URRJ6.tmp
%PROGRAM_FILES%\AC3Filter\lang\hun\LC_MESSAGES\is-NG4CQ.tmp
%PROGRAM_FILES%\AC3Filter\lang\ind\LC_MESSAGES\is-PK19H.tmp
%PROGRAM_FILES%\AC3Filter\lang\heb\LC_MESSAGES\is-M4MLN.tmp
%PROGRAM_FILES%\AC3Filter\lang\ger\LC_MESSAGES\is-BD9NK.tmp
%PROGRAM_FILES%\AC3Filter\lang\gre\LC_MESSAGES\is-6VKIO.tmp
%PROGRAM_FILES%\AC3Filter\lang\pol\LC_MESSAGES\is-B6CDE.tmp
%PROGRAM_FILES%\AC3Filter\lang\pt_BR\LC_MESSAGES\is-JG25R.tmp
%PROGRAM_FILES%\AC3Filter\lang\kor\LC_MESSAGES\is-CISND.tmp
%PROGRAM_FILES%\AC3Filter\lang\ita\LC_MESSAGES\is-2EJ7D.tmp
%PROGRAM_FILES%\AC3Filter\lang\jpn\LC_MESSAGES\is-PCS41.tmp
%PROGRAM_FILES%\AC3Filter\is-CGFP7.tmp
%ALLUSERSPROFILE%\Start Menu\Programs\AC3Filter\Reset to defaults.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\AC3Filter\Restore default presets.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\AC3Filter\License.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\AC3Filter\SPDIF test (32bit).lnk
%ALLUSERSPROFILE%\Start Menu\Programs\AC3Filter\Readme.lnk
%PROGRAM_FILES%\AC3Filter\~GLH0001.TMP
%TEMP%\~GLH0002.TMP
%PROGRAM_FILES%\AC3Filter\unins000.dat
%ALLUSERSPROFILE%\Start Menu\Programs\AC3Filter\Clear filter cache.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\AC3Filter\Uninstall AC3Filter.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\AC3Filter\AC3Filter Config.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\AC3Filter\Documentation (eng)\AC3Filter User's Manual.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\AC3Filter\Documentation (eng)\AC3Filter & SPDIF.lnk
%PROGRAM_FILES%\AC3Filter\is-0D6JG.tmp
%PROGRAM_FILES%\AC3Filter\is-700P3.tmp
%PROGRAM_FILES%\AC3Filter\is-AV1CK.tmp
%ALLUSERSPROFILE%\Start Menu\Programs\AC3Filter\Documentation (rus)\Громкость и динамический диапазон.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\AC3Filter\AC3Filter home.url
%ALLUSERSPROFILE%\Start Menu\Programs\AC3Filter\Documentation (rus)\AC3Filter & SPDIF.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\AC3Filter\Documentation (eng)\Loudness and dynamic range.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\AC3Filter\Documentation (rus)\AC3Filter - Руководство пользователя.lnk
%PROGRAM_FILES%\AC3Filter\lang\fre\LC_MESSAGES\is-5UN2K.tmp
%PROGRAM_FILES%\AC3Filter\doc\is-038F1.tmp
%PROGRAM_FILES%\AC3Filter\doc\is-8VEJ9.tmp
%PROGRAM_FILES%\AC3Filter\doc\is-QJ831.tmp
<SYSTEM32>\is-0NQ57.tmp
%PROGRAM_FILES%\AC3Filter\doc\is-03JCF.tmp
%PROGRAM_FILES%\AC3Filter\lang\is-04PJN.tmp
%PROGRAM_FILES%\AC3Filter\lang\is-BAF31.tmp
%PROGRAM_FILES%\AC3Filter\lang\is-URS1N.tmp
%PROGRAM_FILES%\AC3Filter\doc\is-8PAHP.tmp
%PROGRAM_FILES%\AC3Filter\doc\is-3CGOI.tmp
%PROGRAM_FILES%\AC3Filter\is-BFLMD.tmp
%TEMP%\is-RO4N8.tmp\AC3FIL~1.tmp
%TEMP%\is-V95O8.tmp\_isetup\_RegDLL.tmp
%TEMP%\~GLH0000.TMP
%TEMP%\GLC1.tmp
%TEMP%\GLW2.tmp
%PROGRAM_FILES%\AC3Filter\is-HGE4C.tmp
%PROGRAM_FILES%\AC3Filter\is-MIFFG.tmp
%PROGRAM_FILES%\AC3Filter\is-PAEPP.tmp
%TEMP%\is-V95O8.tmp\_isetup\_shfoldr.dll
%PROGRAM_FILES%\AC3Filter\is-5U5R4.tmp
%PROGRAM_FILES%\AC3Filter\lang\is-61APR.tmp
%PROGRAM_FILES%\AC3Filter\lang\is-VET2J.tmp
%PROGRAM_FILES%\AC3Filter\lang\is-1FF3N.tmp
%PROGRAM_FILES%\AC3Filter\lang\is-UNOKE.tmp
%PROGRAM_FILES%\AC3Filter\lang\is-DBM1S.tmp
%PROGRAM_FILES%\AC3Filter\lang\is-48SC8.tmp
%PROGRAM_FILES%\AC3Filter\lang\dut\LC_MESSAGES\is-94BU4.tmp
%PROGRAM_FILES%\AC3Filter\lang\fin\LC_MESSAGES\is-T7FNG.tmp
%PROGRAM_FILES%\AC3Filter\lang\cze\LC_MESSAGES\is-QQ58S.tmp
%PROGRAM_FILES%\AC3Filter\lang\is-TKSCJ.tmp
%PROGRAM_FILES%\AC3Filter\lang\is-F8693.tmp
%PROGRAM_FILES%\AC3Filter\lang\is-GDDU1.tmp
%PROGRAM_FILES%\AC3Filter\lang\is-Q95KM.tmp
%PROGRAM_FILES%\AC3Filter\lang\is-SA6CA.tmp
%PROGRAM_FILES%\AC3Filter\lang\is-DMC30.tmp
%PROGRAM_FILES%\AC3Filter\lang\is-OAEV7.tmp
%PROGRAM_FILES%\AC3Filter\lang\is-K5BQA.tmp
%PROGRAM_FILES%\AC3Filter\lang\is-HHK1O.tmp
%PROGRAM_FILES%\AC3Filter\lang\is-Q7BST.tmp
%PROGRAM_FILES%\AC3Filter\lang\is-FJCQO.tmp
%PROGRAM_FILES%\AC3Filter\lang\is-A5MUP.tmp
%PROGRAM_FILES%\AC3Filter\lang\is-F3I8D.tmp