Trojan.MulDrop7.13097

Техническая информация

Вредоносные функции:

Запускает на исполнение:

'%CommonProgramFiles%\InstallShield\Engine\6\Intel 32\IKernel.exe' 32\IKernel.exe -Embedding
'%CommonProgramFiles%\InstallShield\Engine\6\Intel 32\IKernel.exe' /REGSERVER
'%TEMP%\pft3.tmp\Setup.exe'
'%CommonProgramFiles%\InstallShield\Engine\6\Intel 32\IKernel.exe' -RegServer

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\{60932A82-E923-452A-8494-0822614F1177}\setu20ec.rra
%CommonProgramFiles%\InstallShield\IScript\iscr1ad1.rra
%TEMP%\{60932A82-E923-452A-8494-0822614F1177}\Mktc2169.rra
%TEMP%\{60932A82-E923-452A-8494-0822614F1177}\Mktc21d6.rra
%TEMP%\{60932A82-E923-452A-8494-0822614F1177}\Mktc21a7.rra
%CommonProgramFiles%\InstallShield\Engine\6\Intel 32\core1718.rra
%TEMP%\13dc.rra
%CommonProgramFiles%\InstallShield\Engine\6\Intel 32\ctor1766.rra
%CommonProgramFiles%\InstallShield\Engine\6\Intel 32\iuse191c.rra
%CommonProgramFiles%\InstallShield\Engine\6\Intel 32\obje18cd.rra
%TEMP%\{60932A82-E923-452A-8494-0822614F1177}\Bbrd2205.rra
%TEMP%\{60932A82-E923-452A-8494-0822614F1177}\valu236c.rra
%TEMP%\{60932A82-E923-452A-8494-0822614F1177}\Lice22ff.rra
%TEMP%\{60932A82-E923-452A-8494-0822614F1177}\isrt23da.rra
%TEMP%\{60932A82-E923-452A-8494-0822614F1177}\_IsR2495.rra
%TEMP%\{60932A82-E923-452A-8494-0822614F1177}\defa2437.rra
%TEMP%\{60932A82-E923-452A-8494-0822614F1177}\Bbrd2253.rra
%TEMP%\{60932A82-E923-452A-8494-0822614F1177}\Bbrd2234.rra
%TEMP%\{60932A82-E923-452A-8494-0822614F1177}\Bbrd2282.rra
%TEMP%\{60932A82-E923-452A-8494-0822614F1177}\Bbrd22c0.rra
%TEMP%\{60932A82-E923-452A-8494-0822614F1177}\Bbrd22a1.rra
%CommonProgramFiles%\InstallShield\Engine\6\Intel 32\temp.000
%TEMP%\pft3.tmp\data2.cab
%TEMP%\pft3.tmp\data1.hdr
%TEMP%\pft3.tmp\ikernel.ex_
%TEMP%\pft3.tmp\KEY5USB.SYS
%TEMP%\pft3.tmp\KEY5USB.INF
%TEMP%\plf1.tmp
%TEMP%\ext2.tmp
%TEMP%\pft3.tmp\pftw1.pkg
%TEMP%\pft3.tmp\data1.cab
%TEMP%\pft3.tmp\Billboard.bmp
%TEMP%\pft3.tmp\layout.bin
%TEMP%\pft3.tmp\Setup.ini
%TEMP%\pft3.tmp\Setup.exe
%TEMP%\pft3.tmp\setup.inx
%TEMP%\IEC4.tmp
%TEMP%\pft3.tmp\setupdialog.bmp
%TEMP%\pft3.tmp\n5lptstp.log
%TEMP%\pft3.tmp\Mktcard.bmp
%TEMP%\pft3.tmp\n5setup.dll
%TEMP%\pft3.tmp\setup.bmp
%TEMP%\pft3.tmp\Regedit.txt

Удаляет следующие файлы:

%TEMP%\IEC4.tmp
%TEMP%\{60932A82-E923-452A-8494-0822614F1177}\Mktcard.bmp
%TEMP%\ext2.tmp
%TEMP%\pft3.tmp\pftw1.pkg

Перемещает следующие файлы:

%TEMP%\{60932A82-E923-452A-8494-0822614F1177}\Bbrd22a1.rra в %TEMP%\{60932A82-E923-452A-8494-0822614F1177}\Bbrd5.bmp
%TEMP%\{60932A82-E923-452A-8494-0822614F1177}\Bbrd22c0.rra в %TEMP%\{60932A82-E923-452A-8494-0822614F1177}\Bbrd6.bmp
%TEMP%\{60932A82-E923-452A-8494-0822614F1177}\Bbrd2253.rra в %TEMP%\{60932A82-E923-452A-8494-0822614F1177}\Bbrd3.bmp
%TEMP%\{60932A82-E923-452A-8494-0822614F1177}\Bbrd2282.rra в %TEMP%\{60932A82-E923-452A-8494-0822614F1177}\Bbrd4.bmp
%TEMP%\{60932A82-E923-452A-8494-0822614F1177}\Lice22ff.rra в %TEMP%\{60932A82-E923-452A-8494-0822614F1177}\License.txt
%TEMP%\{60932A82-E923-452A-8494-0822614F1177}\defa2437.rra в %TEMP%\{60932A82-E923-452A-8494-0822614F1177}\default.pal
%TEMP%\{60932A82-E923-452A-8494-0822614F1177}\_IsR2495.rra в %TEMP%\{60932A82-E923-452A-8494-0822614F1177}\_IsRes.dll
%TEMP%\{60932A82-E923-452A-8494-0822614F1177}\valu236c.rra в %TEMP%\{60932A82-E923-452A-8494-0822614F1177}\value.shl
%TEMP%\{60932A82-E923-452A-8494-0822614F1177}\isrt23da.rra в %TEMP%\{60932A82-E923-452A-8494-0822614F1177}\isrt.dll
%TEMP%\{60932A82-E923-452A-8494-0822614F1177}\Bbrd2234.rra в %TEMP%\{60932A82-E923-452A-8494-0822614F1177}\Bbrd2.bmp
%CommonProgramFiles%\InstallShield\Engine\6\Intel 32\ctor1766.rra в %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\ctor.dll
%CommonProgramFiles%\InstallShield\Engine\6\Intel 32\obje18cd.rra в %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\objectps.dll
%CommonProgramFiles%\InstallShield\Engine\6\Intel 32\temp.000 в %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\IKernel.exe
%CommonProgramFiles%\InstallShield\Engine\6\Intel 32\core1718.rra в %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\corecomp.ini
%CommonProgramFiles%\InstallShield\Engine\6\Intel 32\iuse191c.rra в %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\iuser.dll
%TEMP%\{60932A82-E923-452A-8494-0822614F1177}\Mktc21a7.rra в %TEMP%\{60932A82-E923-452A-8494-0822614F1177}\Mktcard.bmp
%TEMP%\{60932A82-E923-452A-8494-0822614F1177}\Bbrd2205.rra в %TEMP%\{60932A82-E923-452A-8494-0822614F1177}\Bbrd1.bmp
%CommonProgramFiles%\InstallShield\IScript\iscr1ad1.rra в %CommonProgramFiles%\InstallShield\IScript\iscript.dll
%TEMP%\{60932A82-E923-452A-8494-0822614F1177}\setu20ec.rra в %TEMP%\{60932A82-E923-452A-8494-0822614F1177}\setup.inx