Trojan.MulDrop4.50477

Техническая информация

Вредоносные функции:

Создает и запускает на исполнение:

'%HOMEPATH%\IDLWT\Autoit3.879681.exe' ORKVIXUR.dat
'%HOMEPATH%\IDLWT\Autoit3.879681.exe' 423143.dat
'%HOMEPATH%\IDLWT\Wakitobot3.0.exe'

Запускает на исполнение:

'<SYSTEM32>\wscript.exe' "%HOMEPATH%\IDLWT\run.vbs"

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\aut41.tmp
%TEMP%\S00098760923\Resource - Cueillir - Pommier.bmp
%TEMP%\aut40.tmp
%TEMP%\S00098760923\Resource - Cueillir - Palmito - 2.bmp
%TEMP%\aut42.tmp
%TEMP%\S00098760923\Resource - Cueillir - Palmito - 1.bmp
%TEMP%\aut3E.tmp
%TEMP%\S00098760923\Resource - Fleur Bleue - Recolter - 3.bmp
%TEMP%\aut3D.tmp
%TEMP%\S00098760923\Resource - Cueillir - Chataigner.bmp
%TEMP%\aut3F.tmp
%TEMP%\S00098760923\Resource - Cueillir - Noisetier.bmp
%TEMP%\aut43.tmp
%TEMP%\S00098760923\Resource - Cawotte - Recolter.bmp
%TEMP%\aut47.tmp
%TEMP%\S00098760923\Resource - Tuberbulbe - Couper.bmp
%TEMP%\aut49.tmp
%TEMP%\S00098760923\Resource - Cawotte - Couper.bmp
%TEMP%\aut48.tmp
%TEMP%\S00098760923\Resource - Topinambour - Couper.bmp
%TEMP%\aut44.tmp
%TEMP%\S00098760923\Resource - Topinambour - Recolter.bmp
%TEMP%\aut46.tmp
%TEMP%\S00098760923\Resource - Tuberbulbe - Recolter.bmp
%TEMP%\aut45.tmp
%TEMP%\S00098760923\Resource - Fleur Bleue - Recolter - 2.bmp
%TEMP%\aut34.tmp
%TEMP%\S00098760923\Couper - Ortie.bmp
%TEMP%\aut33.tmp
%TEMP%\S00098760923\Couper - Pulsatile Soufree - 1.bmp
%TEMP%\aut35.tmp
%TEMP%\S00098760923\Resource - Ortie - Recolter.bmp
%TEMP%\aut31.tmp
%TEMP%\S00098760923\Resource - Croton - Recolter.bmp
%TEMP%\aut30.tmp
%TEMP%\S00098760923\Resource - Orchidee - Recolter.bmp
%TEMP%\aut32.tmp
%TEMP%\S00098760923\Couper - Orchidee.bmp
%TEMP%\aut36.tmp
%TEMP%\S00098760923\Couper - Fleur Bleue - 3.bmp
%TEMP%\aut3A.tmp
%TEMP%\S00098760923\Couper - Fleur Bleue - 2.bmp
%TEMP%\aut3C.tmp
%TEMP%\S00098760923\Resource - Fleur Bleue - Recolter - 1.bmp
%TEMP%\aut3B.tmp
%TEMP%\S00098760923\Resource - Pulsatile soufree - Recolter.bmp
%TEMP%\aut37.tmp
%TEMP%\S00098760923\Couper - Pulsatile Soufree - 2.bmp
%TEMP%\aut39.tmp
%TEMP%\S00098760923\Couper - Fleur Bleue - 1.bmp
%TEMP%\aut38.tmp
%TEMP%\S00098760923\Planter - Topinambour - 1.bmp
%TEMP%\aut5A.tmp
%TEMP%\S00098760923\Planter - Ble - 3.bmp
%TEMP%\aut5C.tmp
%TEMP%\S00098760923\Planter - Topinambour - 2.bmp
%TEMP%\aut5B.tmp
%TEMP%\S00098760923\Planter - Ble - 1.bmp
%TEMP%\aut57.tmp
%TEMP%\S00098760923\Planter - Sole - 8.bmp
%TEMP%\aut59.tmp
%TEMP%\S00098760923\Planter - Ble - 2.bmp
%TEMP%\aut58.tmp
%TEMP%\S00098760923\Planter - Topinambour - 3.bmp
%TEMP%\aut61.tmp
%TEMP%\S00098760923\Planter - Cawotte - 1.bmp
%TEMP%\aut60.tmp
%TEMP%\S00098760923\Planter - Cawotte - 3.bmp
%TEMP%\aut62.tmp
%TEMP%\S00098760923\Planter - Cawotte - 2.bmp
%TEMP%\aut5E.tmp
%TEMP%\S00098760923\Planter - Tuberbulbe - 1.bmp
%TEMP%\aut5D.tmp
%TEMP%\S00098760923\Planter - Tuberbulbe - 3.bmp
%TEMP%\aut5F.tmp
%TEMP%\S00098760923\Planter - Tuberbulbe - 2.bmp
%TEMP%\aut56.tmp
%TEMP%\S00098760923\Resource - Salace - Recolter.bmp
%TEMP%\aut4D.tmp
%TEMP%\S00098760923\Resource - Citrouille - Couper - 2.bmp
%TEMP%\aut4F.tmp
%TEMP%\S00098760923\Resource - Salace - Couper.bmp
%TEMP%\aut4E.tmp
%TEMP%\S00098760923\Resource - Citrouille - Recolter - 2.bmp
%TEMP%\aut4A.tmp
%TEMP%\S00098760923\Resource - Citrouille - Recolter - 1.bmp
%TEMP%\aut4C.tmp
%TEMP%\S00098760923\Resource - Citrouille - Couper - 1.bmp
%TEMP%\aut4B.tmp
%TEMP%\S00098760923\Planter - Sole - 1.bmp
%TEMP%\aut54.tmp
%TEMP%\S00098760923\Planter - Sole - 5.bmp
%TEMP%\aut53.tmp
%TEMP%\S00098760923\Planter - Sole - 7.bmp
%TEMP%\aut55.tmp
%TEMP%\S00098760923\Planter - Sole - 6.bmp
%TEMP%\aut51.tmp
%TEMP%\S00098760923\Planter - Sole - 2.bmp
%TEMP%\aut50.tmp
%TEMP%\S00098760923\Planter - Sole - 4.bmp
%TEMP%\aut52.tmp
%TEMP%\S00098760923\Planter - Sole - 3.bmp
%TEMP%\S00098760923\Resource - Couper - 1.bmp
%TEMP%\autE.tmp
%TEMP%\S00098760923\Resource - Cueillir - 3.bmp
%TEMP%\aut10.tmp
%TEMP%\S00098760923\Resource - Couper - 2.bmp
%TEMP%\autF.tmp
%TEMP%\S00098760923\Resource - Cueillir - 1.bmp
%TEMP%\autB.tmp
%TEMP%\S00098760923\Resource - Recolter - 3.bmp
%TEMP%\autD.tmp
%TEMP%\S00098760923\Resource - Cueillir - 2.bmp
%TEMP%\autC.tmp
%TEMP%\S00098760923\Resource - Couper - 3.bmp
%TEMP%\aut15.tmp
%TEMP%\S00098760923\Ressource - eau - 1.bmp
%TEMP%\aut14.tmp
%TEMP%\S00098760923\Ressource - eau - 3.bmp
%TEMP%\aut16.tmp
%TEMP%\S00098760923\Ressource - eau - 2.bmp
%TEMP%\aut12.tmp
%TEMP%\S00098760923\Resource - Faucher - 1.bmp
%TEMP%\aut11.tmp
%TEMP%\S00098760923\Resource - Faucher - 3.bmp
%TEMP%\aut13.tmp
%TEMP%\S00098760923\Resource - Faucher - 2.bmp
%TEMP%\autA.tmp
%TEMP%\S00098760923\Resource - non - InviteGroupe - 1.bmp
%TEMP%\aut1.tmp
%HOMEPATH%\IDLWT\Wakitobot3.0.exe
%TEMP%\aut3.tmp
%TEMP%\S00098760923\Resource - non - InviteGroupe - 2.bmp
%TEMP%\aut2.tmp
%HOMEPATH%\IDLWT\750039.dat
%HOMEPATH%\IDLWT\105135.dat
%HOMEPATH%\IDLWT\423143.dat
%HOMEPATH%\IDLWT\run.vbs
%HOMEPATH%\IDLWT\settings.ini
%HOMEPATH%\IDLWT\Autoit3.879681.exe
%TEMP%\S00098760923\Resource - non - InviteGroupe - 3.bmp
%TEMP%\aut8.tmp
%TEMP%\S00098760923\Raccourci.bmp
%TEMP%\aut7.tmp
%TEMP%\S00098760923\Resource - Recolter - 2.bmp
%TEMP%\aut9.tmp
%TEMP%\S00098760923\Resource - Recolter - 1.bmp
%TEMP%\aut5.tmp
%TEMP%\S00098760923\Resource - RecolteEncours - 1.bmp
%TEMP%\aut4.tmp
%TEMP%\S00098760923\Resource - RecolteEncours - 3.bmp
%TEMP%\aut6.tmp
%TEMP%\S00098760923\Resource - RecolteEncours - 2.bmp
%TEMP%\S00098760923\Couper - Trefle - 2.bmp
%TEMP%\aut27.tmp
%TEMP%\S00098760923\Couper - Trefle - 1.bmp
%TEMP%\aut29.tmp
%TEMP%\S00098760923\Couper - Trefle - 3.bmp
%TEMP%\aut28.tmp
%TEMP%\S00098760923\Trefle - Recolter - 2.bmp
%TEMP%\aut24.tmp
%TEMP%\S00098760923\Trefle - Recolter - 1.bmp
%TEMP%\aut26.tmp
%TEMP%\S00098760923\Trefle - Recolter - 3.bmp
%TEMP%\aut25.tmp
%TEMP%\S00098760923\Couper - Lin - 1.bmp
%TEMP%\aut2E.tmp
%TEMP%\S00098760923\Couper - Rhodon.bmp
%TEMP%\aut2D.tmp
%TEMP%\S00098760923\Couper - Croton.bmp
%TEMP%\aut2F.tmp
%TEMP%\S00098760923\Resource - Rhodon - Recolter.bmp
%TEMP%\aut2B.tmp
%TEMP%\S00098760923\Resource - Lin - Recolter.bmp
%TEMP%\aut2A.tmp
%TEMP%\S00098760923\Resource - Menthe - Recolter.bmp
%TEMP%\aut2C.tmp
%TEMP%\S00098760923\Couper - Menthe.bmp
%TEMP%\aut23.tmp
%TEMP%\S00098760923\Faucher - Orge - 1.bmp
%TEMP%\aut1A.tmp
%TEMP%\S00098760923\Resource - Orge - Recolter.bmp
%TEMP%\aut1C.tmp
%TEMP%\S00098760923\Faucher - Avoine - 1.bmp
%TEMP%\aut1B.tmp
%TEMP%\aut18.tmp
%TEMP%\S00098760923\Resource - Ble - Recolter.bmp
%TEMP%\aut17.tmp
%TEMP%\aut19.tmp
%HOMEPATH%\IDLWT\ORKVIXUR.dat
%TEMP%\S00098760923\Faucher - Ble - 1.bmp
%TEMP%\S00098760923\Resource - Avoine - Recolter.bmp
%TEMP%\aut21.tmp
%TEMP%\S00098760923\Resource - Chardon - Recolter - 2.bmp
%TEMP%\aut20.tmp
%TEMP%\S00098760923\Faucher - Chardon - 2.bmp
%TEMP%\aut22.tmp
%TEMP%\S00098760923\Faucher - Chardon - 1.bmp
%TEMP%\aut1E.tmp
%TEMP%\S00098760923\Faucher - Seigle - 1.bmp
%TEMP%\aut1D.tmp
%TEMP%\S00098760923\Resource - Chardon - Recolter - 1.bmp
%TEMP%\aut1F.tmp
%TEMP%\S00098760923\Resource - Seigle - Recolter.bmp

Присваивает атрибут 'скрытый' для следующих файлов:

%HOMEPATH%\IDLWT\Autoit3.879681.exe
%HOMEPATH%\IDLWT\settings.ini
%HOMEPATH%\IDLWT\run.vbs
%HOMEPATH%\IDLWT\423143.dat
%HOMEPATH%\IDLWT\105135.dat
%HOMEPATH%\IDLWT\750039.dat

Удаляет следующие файлы:

%TEMP%\aut41.tmp
%TEMP%\aut42.tmp
%TEMP%\aut43.tmp
%TEMP%\aut3E.tmp
%TEMP%\aut3F.tmp
%TEMP%\aut40.tmp
%TEMP%\aut47.tmp
%TEMP%\aut48.tmp
%TEMP%\aut49.tmp
%TEMP%\aut44.tmp
%TEMP%\aut45.tmp
%TEMP%\aut46.tmp
%TEMP%\aut35.tmp
%TEMP%\aut36.tmp
%TEMP%\aut37.tmp
%TEMP%\aut32.tmp
%TEMP%\aut33.tmp
%TEMP%\aut34.tmp
%TEMP%\aut3B.tmp
%TEMP%\aut3C.tmp
%TEMP%\aut3D.tmp
%TEMP%\aut38.tmp
%TEMP%\aut39.tmp
%TEMP%\aut3A.tmp
%TEMP%\aut4A.tmp
%TEMP%\aut5A.tmp
%TEMP%\aut5B.tmp
%TEMP%\aut5C.tmp
%TEMP%\aut57.tmp
%TEMP%\aut58.tmp
%TEMP%\aut59.tmp
%TEMP%\aut60.tmp
%TEMP%\aut61.tmp
%TEMP%\aut62.tmp
%TEMP%\aut5D.tmp
%TEMP%\aut5E.tmp
%TEMP%\aut5F.tmp
%TEMP%\aut4E.tmp
%TEMP%\aut4F.tmp
%TEMP%\aut50.tmp
%TEMP%\aut4B.tmp
%TEMP%\aut4C.tmp
%TEMP%\aut4D.tmp
%TEMP%\aut54.tmp
%TEMP%\aut55.tmp
%TEMP%\aut56.tmp
%TEMP%\aut51.tmp
%TEMP%\aut52.tmp
%TEMP%\aut53.tmp
%TEMP%\aut31.tmp
%TEMP%\aut10.tmp
%TEMP%\aut11.tmp
%TEMP%\aut12.tmp
%TEMP%\autD.tmp
%TEMP%\autE.tmp
%TEMP%\autF.tmp
%TEMP%\aut16.tmp
%TEMP%\aut17.tmp
%TEMP%\aut18.tmp
%TEMP%\aut13.tmp
%TEMP%\aut14.tmp
%TEMP%\aut15.tmp
%TEMP%\aut4.tmp
%TEMP%\aut5.tmp
%TEMP%\aut6.tmp
%TEMP%\aut1.tmp
%TEMP%\aut2.tmp
%TEMP%\aut3.tmp
%TEMP%\autA.tmp
%TEMP%\autB.tmp
%TEMP%\autC.tmp
%TEMP%\aut7.tmp
%TEMP%\aut8.tmp
%TEMP%\aut9.tmp
%TEMP%\aut19.tmp
%TEMP%\aut28.tmp
%TEMP%\aut29.tmp
%TEMP%\aut2A.tmp
%TEMP%\aut25.tmp
%TEMP%\aut26.tmp
%TEMP%\aut27.tmp
%TEMP%\aut2E.tmp
%TEMP%\aut2F.tmp
%TEMP%\aut30.tmp
%TEMP%\aut2B.tmp
%TEMP%\aut2C.tmp
%TEMP%\aut2D.tmp
%TEMP%\aut1C.tmp
%TEMP%\aut1D.tmp
%TEMP%\aut1E.tmp
%TEMP%\aut1A.tmp
%HOMEPATH%\IDLWT\ORKVIXUR.dat
%TEMP%\aut1B.tmp
%TEMP%\aut22.tmp
%TEMP%\aut23.tmp
%TEMP%\aut24.tmp
%TEMP%\aut1F.tmp
%TEMP%\aut20.tmp
%TEMP%\aut21.tmp

Другое:

Ищет следующие окна:

ClassName: 'Shell_TrayWnd' WindowName: '(null)'
ClassName: 'EDIT' WindowName: '(null)'

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней