Trojan.MulDrop2.55617

Техническая информация

Для обеспечения автозапуска и распространения:

Создает следующие сервисы:

[<HKLM>\SYSTEM\ControlSet001\Services\MS OsWork] 'Start' = '00000002'

Вредоносные функции:

Создает и запускает на исполнение:

<SYSTEM32>\msot32.exe
<SYSTEM32>\msdows.exe
<SYSTEM32>\msdio.exe

Изменения в файловой системе:

Создает следующие файлы:

%PROGRAM_FILES%\InstallShield Installation Information\{0E955E29-F2A0-4064-80AC-AF58B46C04CF}\setuef7b.rra
%PROGRAM_FILES%\InstallShield Installation Information\{0E955E29-F2A0-4064-80AC-AF58B46C04CF}\ISSeef1e.rra
%PROGRAM_FILES%\InstallShield Installation Information\{0E955E29-F2A0-4064-80AC-AF58B46C04CF}\setuefaa.rra
<SYSTEM32>\msdif027.rra
%PROGRAM_FILES%\InstallShield Installation Information\{0E955E29-F2A0-4064-80AC-AF58B46C04CF}\setup.ini
%PROGRAM_FILES%\InstallShield Installation Information\{0E955E29-F2A0-4064-80AC-AF58B46C04CF}\_Seteeef.rra
%PROGRAM_FILES%\InstallShield Installation Information\{0E955E29-F2A0-4064-80AC-AF58B46C04CF}\layoedd5.rra
%TEMP%\{67EB628E-9495-4B4C-AC5F-E6153F6B9268}\{0E955E29-F2A0-4064-80AC-AF58B46C04CF}\_IsRe1fe.rra
%PROGRAM_FILES%\InstallShield Installation Information\{0E955E29-F2A0-4064-80AC-AF58B46C04CF}\dataee04.rra
%PROGRAM_FILES%\InstallShield Installation Information\{0E955E29-F2A0-4064-80AC-AF58B46C04CF}\setueea1.rra
%PROGRAM_FILES%\InstallShield Installation Information\{0E955E29-F2A0-4064-80AC-AF58B46C04CF}\dataee33.rra
<SYSTEM32>\mswif160.rra
<SYSTEM32>\mswif140.rra
<SYSTEM32>\uuplf17f.rra
<SYSTEM32>\DFI32.dat
<SYSTEM32>\uuplf18f.rra
<SYSTEM32>\mswif121.rra
<SYSTEM32>\msotf085.rra
<SYSTEM32>\msdif056.rra
<SYSTEM32>\msdof0a4.rra
<SYSTEM32>\mswif0f2.rra
<SYSTEM32>\msotf0d3.rra
%TEMP%\{3ED4B9A9-2DFF-4EB8-AB4E-AF8E7195E69D}\Disk1\setup.inx
%TEMP%\{3ED4B9A9-2DFF-4EB8-AB4E-AF8E7195E69D}\Disk1\setup.ini
%TEMP%\{3ED4B9A9-2DFF-4EB8-AB4E-AF8E7195E69D}\Disk1\_Setup.dll
%APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-1275210071-117609710-1801674531-500\6edd068ef008c9e56d632ab706fe9747_ffcb838e-6d3b-4e44-a259-8ac8f5c94c4f
%APPDATA%\Microsoft\Protect\S-1-5-21-1275210071-117609710-1801674531-500\ec13e606-1ba9-4bcf-bb36-2d41664c54d0
%TEMP%\{3ED4B9A9-2DFF-4EB8-AB4E-AF8E7195E69D}\Disk1\setup.exe
%TEMP%\{3ED4B9A9-2DFF-4EB8-AB4E-AF8E7195E69D}\Disk1\data1.cab
%TEMP%\{3ED4B9A9-2DFF-4EB8-AB4E-AF8E7195E69D}\_ispackdel.ini
%TEMP%\{3ED4B9A9-2DFF-4EB8-AB4E-AF8E7195E69D}\Disk1\data1.hdr
%TEMP%\{3ED4B9A9-2DFF-4EB8-AB4E-AF8E7195E69D}\Disk1\layout.bin
%TEMP%\{3ED4B9A9-2DFF-4EB8-AB4E-AF8E7195E69D}\Disk1\ISSetup.dll
%TEMP%\{67EB628E-9495-4B4C-AC5F-E6153F6B9268}\{0E955E29-F2A0-4064-80AC-AF58B46C04CF}\DIFxe097.rra
%TEMP%\{67EB628E-9495-4B4C-AC5F-E6153F6B9268}\{0E955E29-F2A0-4064-80AC-AF58B46C04CF}\Fonte068.rra
%TEMP%\{67EB628E-9495-4B4C-AC5F-E6153F6B9268}\{0E955E29-F2A0-4064-80AC-AF58B46C04CF}\Strie0d5.rra
%TEMP%\{67EB628E-9495-4B4C-AC5F-E6153F6B9268}\{0E955E29-F2A0-4064-80AC-AF58B46C04CF}\defae1b0.rra
%TEMP%\{67EB628E-9495-4B4C-AC5F-E6153F6B9268}\{0E955E29-F2A0-4064-80AC-AF58B46C04CF}\isrte123.rra
%TEMP%\{67EB628E-9495-4B4C-AC5F-E6153F6B9268}\dotne039.rra
%TEMP%\{3ED4B9A9-2DFF-4EB8-AB4E-AF8E7195E69D}\_Setup.dll
%TEMP%\{3ED4B9A9-2DFF-4EB8-AB4E-AF8E7195E69D}\setup.ini
%TEMP%\{67EB628E-9495-4B4C-AC5F-E6153F6B9268}\{0E955E29-F2A0-4064-80AC-AF58B46C04CF}\setuded2.rra
%TEMP%\{67EB628E-9495-4B4C-AC5F-E6153F6B9268}\coree00a.rra
%TEMP%\{67EB628E-9495-4B4C-AC5F-E6153F6B9268}\{0E955E29-F2A0-4064-80AC-AF58B46C04CF}\licedf6e.rra