Trojan.MulDrop5.27832

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKLM>\SOFTWARE\Classes\MSProgramGroup\Shell\Open\Command] '' = '<SYSTEM32>\grpconv.exe %1'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] 'GrpConv' = 'grpconv -o'

Вредоносные функции:

Создает и запускает на исполнение:

'%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\ruplp.exe' /regserver /NOREDIRECT
'%TEMP%\nst3.tmp\nsA.tmp' "%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\ruplp.exe" /regserver /NOREDIRECT
'%TEMP%\nst3.tmp\nsC.tmp' regedit.exe /s "%TEMP%\RarSFX0\Settings.reg"
'%TEMP%\nst3.tmp\nsB.tmp' regedit.exe /s "%TEMP%\RarSFX0\Settings.reg"
'%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe' /bc
'%TEMP%\nst3.tmp\ns4.tmp' RUNDLL32.EXE SETUPAPI.DLL,InstallHinfSection DefaultInstall 132 %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\revoflt.inf
'%TEMP%\RarSFX0\Revo.Uninstaller.Pro.v3.0.8.exe' /S /I
'%TEMP%\nst3.tmp\ns9.tmp' "%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe" /bc
'%TEMP%\nst3.tmp\ns8.tmp' regsvr32.exe /s "%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\RUExt.dll"

Запускает на исполнение:

'<SYSTEM32>\regsvr32.exe' /s "%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\RUExt.dll"
'%WINDIR%\regedit.exe' /s "%TEMP%\RarSFX0\Settings.reg"
'<SYSTEM32>\grpconv.exe' -o
'<SYSTEM32>\rundll32.exe' SETUPAPI.DLL,InstallHinfSection DefaultInstall 132 %PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\revoflt.inf
'<SYSTEM32>\runonce.exe' -r

Изменения в файловой системе:

Создает следующие файлы:

%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\slovenian.ini
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\spanish.ini
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\simplifiedchinese.ini
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\slovak.ini
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\turkish.ini
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\ukrainian.ini
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\swedish.ini
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\traditionalchinese.ini
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\serbianLatin.ini
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\polish.ini
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\portuguese.ini
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\macedonian.ini
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\norwegian.ini
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\russian.ini
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\serbian.ini
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\portuguesebrazil.ini
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\romanian.ini
%TEMP%\nst3.tmp\nsA.tmp
%TEMP%\nst3.tmp\nsB.tmp
%TEMP%\nst3.tmp\ns9.tmp
<LS_APPDATA>\VS Revo Group\Revo Uninstaller Pro\data\cachedata.dat
%HOMEPATH%\Start Menu\Programs\Revo Uninstaller Pro\Revo Uninstaller Pro.lnk
%HOMEPATH%\Start Menu\Programs\Revo Uninstaller Pro\Uninstall Revo Uninstaller Pro.lnk
%TEMP%\nst3.tmp\nsC.tmp
%HOMEPATH%\Desktop\Revo Uninstaller Pro.lnk
%TEMP%\nst3.tmp\ns8.tmp
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\Uninstall.exe
%TEMP%\nst3.tmp\nsExec.dll
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\vietnamese.ini
%ALLUSERSPROFILE%\Application Data\VS Revo Group\Revo Uninstaller Pro\revouninstallerpro.lic
%WINDIR%\inf\oem3.PNF
<DRIVERS>\SET7.tmp
%TEMP%\nst3.tmp\ns4.tmp
%WINDIR%\inf\oem3.inf
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\rupilogs.rupldb
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\ruplp.exe
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\revoflt.sys
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\revouninstallerpro.lic
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\armenian.ini
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\bulgarian.ini
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\albanian.ini
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\arabic.ini
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\revoflt.inf
%TEMP%\nsi2.tmp
%TEMP%\nst3.tmp\System.dll
%TEMP%\RarSFX0\Revo.Uninstaller.Pro.v3.0.8.exe
%TEMP%\RarSFX0\Settings.reg
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\RevoCmd.exe
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\RUExt.dll
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\RevoAppBar.exe
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\hungarian.ini
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\indonesian.ini
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\hellenic.ini
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\hrvatski.ini
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\korean.ini
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\kurdish.ini
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\italiano.ini
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\japanese.ini
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\hebrew.ini
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\dutch.ini
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\english.ini
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\czech.ini
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\danish.ini
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\french.ini
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\german.ini
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\estonian.ini
%PROGRAM_FILES%\VS Revo Group\Revo Uninstaller Pro\lang\finnish.ini