Trojan.MulDrop2.56032

Техническая информация

Вредоносные функции:

Запускает на исполнение:

<SYSTEM32>\cacls.exe %WINDIR%\\system32\\ras\\dels.bat /e /t /g everyone:F
<SYSTEM32>\cacls.exe %WINDIR%\\system32\\ras\\dels.bat /e /t /g system:F
<SYSTEM32>\cacls.exe %WINDIR%\\system32\\export\\nvuninm.bat /e /t /g everyone:F
<SYSTEM32>\cacls.exe %WINDIR%\\system32\\export\\nvuninm.bat /e /t /g system:F
<SYSTEM32>\attrib.exe -r -s -h -a %WINDIR%\\ime\\imejp\\nvunins.bat
<SYSTEM32>\attrib.exe +s +r +h +a %WINDIR%\\ime\\imejp\\nvunins.bat
<SYSTEM32>\attrib.exe -h -s -r %WINDIR%\\system32\\export\\nvuninm.bat
<SYSTEM32>\attrib.exe +h +s +r %WINDIR%\\system32\\export\\nvuninm.bat
<SYSTEM32>\attrib.exe +s +r +h %WINDIR%\\system32\\ctfmon.exe
<SYSTEM32>\attrib.exe +s +r +h %WINDIR%\\system32\\dllcache\\ctfmon.exe
<SYSTEM32>\attrib.exe +s +r +h %WINDIR%\\system32\\cmd.exe
<SYSTEM32>\attrib.exe +s +r +h %WINDIR%\\system32\\dllcache\\cmd.exe
<SYSTEM32>\cacls.exe %WINDIR%\\system32\\cacls.exe /e /t /g everyone:F
<SYSTEM32>\cacls.exe %WINDIR%\\system32\\cacls.exe /e /t /g system:F
<SYSTEM32>\attrib.exe +r +s +h %WINDIR%\\system32\\net1.exe
<SYSTEM32>\attrib.exe +r +s +h %WINDIR%\\system32\\dllcache\\net1.exe
<SYSTEM32>\cacls.exe %WINDIR%\\ime\\imejp\\nvunins.bat /e /d system
<SYSTEM32>\attrib.exe +s +r +h %WINDIR%\\system32\\system2.bat
<SYSTEM32>\attrib.exe +s +r +h %WINDIR%\\system32\\system1.bat
<SYSTEM32>\attrib.exe +s +r +h %WINDIR%\\system32\\zzxxxd.sys
<SYSTEM32>\attrib.exe +s +r +h %WINDIR%\\system32\\zzjkxs.sys
<SYSTEM32>\cacls.exe %WINDIR%\\system32\\cc.bat /e /d system
<SYSTEM32>\cacls.exe %WINDIR%\\system32\\cc.bat /e /d everyone
<SYSTEM32>\attrib.exe +s +r +h %WINDIR%\\system32\\tencent.sys
<SYSTEM32>\attrib.exe +s +r +h %WINDIR%\\system32\\cc.bat
<SYSTEM32>\attrib.exe +s +r +h %WINDIR%\\debug\\kao.bat
<SYSTEM32>\cacls.exe %WINDIR%\\debug\\kao.bat /e /d system
<SYSTEM32>\attrib.exe -r -s -h -a %WINDIR%\\msapps\\del.bat
<SYSTEM32>\attrib.exe +s +r +h +a %WINDIR%\\msapps\\del.bat
<SYSTEM32>\attrib.exe +s +r +h %WINDIR%\\system32\\sysme.bat
<SYSTEM32>\cacls.exe %WINDIR%\\system32\\sysme.bat /e /d system
<SYSTEM32>\attrib.exe +s +r +h %WINDIR%\\system32\\\wbem\\\a.exe
<SYSTEM32>\attrib.exe +s +r +h %WINDIR%\\system32\\\wbem\\\b.exe
<SYSTEM32>\attrib.exe +s +r +h %WINDIR%\\system32\\doskey.exe
<SYSTEM32>\attrib.exe +s +r +h %WINDIR%\\system32\\dllcache\\doskey.exe
<SYSTEM32>\attrib.exe +s +r +h %WINDIR%\\system32\\command.com
<SYSTEM32>\attrib.exe +s +r +h %WINDIR%\\system32\\dllcache\\command.com
<SYSTEM32>\cacls.exe %WINDIR%\\system32\\ftp.exe /e /d everyone
<SYSTEM32>\cacls.exe %WINDIR%\\system32\\dllcache\\ftp.exe /e /d everyone
<SYSTEM32>\attrib.exe +s +r +h %WINDIR%\\system32\\regini.exe
<SYSTEM32>\attrib.exe +s +r +h %WINDIR%\\system32\\dllcache\\regini.exe
<SYSTEM32>\attrib.exe +h +s +r "E:\Program Files\Microsoft SQL Server\MSSQL\Binn\odsole70.dll"
<SYSTEM32>\attrib.exe +h +s +r "F:\Program Files\Microsoft SQL Server\MSSQL\Binn\odsole70.dll"
<SYSTEM32>\attrib.exe +h +s +r "%PROGRAM_FILES%\Microsoft SQL Server\MSSQL\Binn\odsole70.dll"
<SYSTEM32>\attrib.exe +h +s +r "<Имя диска съемного носителя>:\Program Files\Microsoft SQL Server\MSSQL\Binn\odsole70.dll"
<SYSTEM32>\attrib.exe +s +r +h %WINDIR%\\system32\\dllcache\\ftp.exe
<SYSTEM32>\attrib.exe +s +r +h %WINDIR%\\system32\\vbscript.dll
<SYSTEM32>\attrib.exe +h +s +r "G:\Program Files\Microsoft SQL Server\MSSQL\Binn\odsole70.dll"
<SYSTEM32>\attrib.exe +s +r +h %WINDIR%\\system32\\ftp.exe
<SYSTEM32>\cacls.exe %WINDIR%\\system32\\ftp.exe /e /d system
<SYSTEM32>\attrib.exe +s +r +h %WINDIR%\\system32\\dllcache\\reg.exe
<SYSTEM32>\attrib.exe +r %WINDIR%\\system32\\sc.exe
<SYSTEM32>\cacls.exe %WINDIR%\\system32\\cscript.exe /e /d system
<SYSTEM32>\attrib.exe +s +r +h %WINDIR%\\system32\\reg.exe
<SYSTEM32>\attrib.exe +r %WINDIR%\\system32\\cacls.exe
<SYSTEM32>\attrib.exe +r %WINDIR%\\system32\\dllcache\\cacls.exe
<SYSTEM32>\attrib.exe +r %WINDIR%\\system32\\attrib.exe
<SYSTEM32>\attrib.exe +r %WINDIR%\\system32\\dllcache\\attrib.exe
<SYSTEM32>\cacls.exe %WINDIR%\\system32\\xcopy.exe /e /d everyone
<SYSTEM32>\cacls.exe %WINDIR%\\system32\\tftp.exe /e /d everyone
<SYSTEM32>\cacls.exe %WINDIR%\\system32\\dllcache\\ftp.exe /e /d system
<SYSTEM32>\cacls.exe %WINDIR%\\system32\\regini.exe /e /d everyone
<SYSTEM32>\cacls.exe %WINDIR%\\system32\\regsvr32.exe /e /d system
<SYSTEM32>\cacls.exe %WINDIR%\\system32\\cscript.exe /e /d everyone
<SYSTEM32>\cacls.exe %WINDIR%\\system32\\tftp.exe /e /d system
<SYSTEM32>\cacls.exe %WINDIR%\\system32\\regsvr32.exe /e /d everyone