Trojan.MulDrop1.53516

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'ANIWZCS2Service' = '%PROGRAM_FILES%\ANI\ANIWZCS2 Service\WZCSLDR2.exe'

Создает следующие сервисы:

[<HKLM>\SYSTEM\ControlSet001\Services\ANIWZCSdService] 'Start' = '00000002'

Вредоносные функции:

Создает и запускает на исполнение:

%CommonProgramFiles%\InstallShield\Engine\6\Intel 32\IKernel.exe /REGSERVER -Embedding -RegServer

Изменения в файловой системе:

Создает следующие файлы:

%PROGRAM_FILES%\InstallShield Installation Information\{4C590030-7469-453E-8589-D15DA9D03F52}\data1294.rra
%PROGRAM_FILES%\InstallShield Installation Information\{4C590030-7469-453E-8589-D15DA9D03F52}\data1274.rra
%PROGRAM_FILES%\InstallShield Installation Information\{4C590030-7469-453E-8589-D15DA9D03F52}\layo1255.rra
%PROGRAM_FILES%\InstallShield Installation Information\{4C590030-7469-453E-8589-D15DA9D03F52}\setu1301.rra
%PROGRAM_FILES%\InstallShield Installation Information\{4C590030-7469-453E-8589-D15DA9D03F52}\Setu12e2.rra
%PROGRAM_FILES%\InstallShield Installation Information\{4C590030-7469-453E-8589-D15DA9D03F52}\Setu12c3.rra
%TEMP%\{c6e2cef6-d21c-4b05-95ed-4a5728ef7744}\valuf519.rra
%TEMP%\{c6e2cef6-d21c-4b05-95ed-4a5728ef7744}\setuf43e.rra
%TEMP%\{4C590030-7469-453E-8589-D15DA9D03F52}\_IsRf354.rra
%TEMP%\pft3~tmp\Disk1\setup.log
%TEMP%\{c6e2cef6-d21c-4b05-95ed-4a5728ef7744}\_IsR1ac.rra
%TEMP%\{c6e2cef6-d21c-4b05-95ed-4a5728ef7744}\valuf538.rra
%PROGRAM_FILES%\InstallShield Installation Information\{4C590030-7469-453E-8589-D15DA9D03F52}\Setup.ini
<SYSTEM32>\odSu14f5.rra
<SYSTEM32>\JJAK14d6.rra
<SYSTEM32>\AQCK14b7.rra
<SYSTEM32>\aIPH160e.rra
<SYSTEM32>\wnic15df.rra
<SYSTEM32>\Wlan15b1.rra
%PROGRAM_FILES%\ANI\ANIWZCS2 Service\Ctrl13fb.rra
%PROGRAM_FILES%\ANI\ANIWZCS2 Service\ANIW13eb.rra
%PROGRAM_FILES%\ANI\ANIWZCS2 Service\ANIW138e.rra
<SYSTEM32>\ANIW1449.rra
<SYSTEM32>\ANIC142a.rra
%PROGRAM_FILES%\ANI\ANIWZCS2 Service\WZCS141a.rra
%TEMP%\{c6e2cef6-d21c-4b05-95ed-4a5728ef7744}\_IsRf306.rra
%TEMP%\pft3~tmp\Disk1\Setup.exe
%TEMP%\pft3~tmp\Disk1\layout.bin
%TEMP%\pft3~tmp\Disk1\ikernel.ex_
%TEMP%\pft3~tmp\Disk1\setup.iss
%TEMP%\pft3~tmp\Disk1\setup.inx
%TEMP%\pft3~tmp\Disk1\Setup.ini
%TEMP%\pft3~tmp\pftw1.pkg
%TEMP%\plf1.tmp
%TEMP%\ext2.tmp
%TEMP%\pft3~tmp\Disk1\data2.cab
%TEMP%\pft3~tmp\Disk1\data1.hdr
%TEMP%\pft3~tmp\Disk1\data1.cab
%TEMP%\IEC4.tmp
%TEMP%\{c6e2cef6-d21c-4b05-95ed-4a5728ef7744}\isrtf16f.rra
%TEMP%\{4C590030-7469-453E-8589-D15DA9D03F52}\valuf0f2.rra
%TEMP%\{4C590030-7469-453E-8589-D15DA9D03F52}\setuf018.rra
%TEMP%\{4C590030-7469-453E-8589-D15DA9D03F52}\defaf23a.rra
%TEMP%\{c6e2cef6-d21c-4b05-95ed-4a5728ef7744}\defaf21b.rra
%TEMP%\{4C590030-7469-453E-8589-D15DA9D03F52}\isrtf1dd.rra
%CommonProgramFiles%\InstallShield\Engine\6\Intel 32\ctore25c.rra
%CommonProgramFiles%\InstallShield\Engine\6\Intel 32\coree20e.rra
%CommonProgramFiles%\InstallShield\Engine\6\Intel 32\temp.000
%CommonProgramFiles%\InstallShield\IScript\iscre6e0.rra
%CommonProgramFiles%\InstallShield\Engine\6\Intel 32\iusee48e.rra
%CommonProgramFiles%\InstallShield\Engine\6\Intel 32\objee440.rra