Trojan.MulDrop3.10332

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'ePassAuto_ABChina' = '%PROGRAM_FILES%\95599 Certificate Tools\FTSafe\CertD_abchina.exe'

Вредоносные функции:

Создает и запускает на исполнение:

Запускает на исполнение:

<SYSTEM32>\regsvr32.exe /s abcPrintCtl4RA.dll
<SYSTEM32>\regsvr32.exe /s NetSign.dll
<SYSTEM32>\rundll32.exe <SYSTEM32>\EPASSA~2.DLL,eb_service
%WINDIR%\regedit.exe /s "%PROGRAM_FILES%\95599 Certificate Tools\FTSafe\ePassAuto_ABChina_s.reg"

Изменяет следующие настройки браузера Windows Internet Explorer:

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] 'CurrentLevel' = '00011000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] 'Flags' = '00000047'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] 'Flags' = '00000043'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1201' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1001' = '00000001'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1C00' = '00010000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] 'Icon' = 'inetcpl.cpl#00004480'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] 'Description' = 'This zone contains Web sites that you trust not to damage your computer or data.'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] 'DisplayName' = 'Trusted sites'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] 'CurrentLevel' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] 'RecommendedLevel' = '00010000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] 'MinLevel' = '00010000'

Изменения в файловой системе:

Создает следующие файлы:

<SYSTEM32>\NetSign.dll
<SYSTEM32>\CEA_Crypt.dll
<SYSTEM32>\abchFTCX21.dll
<SYSTEM32>\ePassAutocsp11_ABChina_s.dll
<SYSTEM32>\ePassAutocsp11_ABChina.dll
<SYSTEM32>\abcPrintCtl4RA.dll
<SYSTEM32>\abcsFTCX21.dll
%ALLUSERSPROFILE%\Start Menu\Programs\Internet Banking of Agricultural Bank of China Certificate Tools\FTSafe\Uninstall.lnk
%TEMP%\nsg3.tmp\InstallOptions.dll
<SYSTEM32>\JCIDFTCX21.dll
%TEMP%\nsg3.tmp\ESNsisPlugin.dll
%ALLUSERSPROFILE%\Start Menu\Programs\Internet Banking of Agricultural Bank of China Certificate Tools\FTSafe\Manager.lnk
%PROGRAM_FILES%\95599 Certificate Tools\FTSafe\lang\escsp_ABChina_1028.lng
%TEMP%\nsg3.tmp\ioSpecial.ini
%TEMP%\nsg3.tmp\modern-wizard.bmp
%PROGRAM_FILES%\95599 Certificate Tools\FTSafe\uninst.exe
%TEMP%\nsb2.tmp
%TEMP%\nsg3.tmp\System.dll
%TEMP%\nsg3.tmp\UserInfo.dll
%PROGRAM_FILES%\95599 Certificate Tools\FTSafe\CertD_abchina.exe
%PROGRAM_FILES%\95599 Certificate Tools\FTSafe\lang\escertd_ABChina_1028.lng
%PROGRAM_FILES%\95599 Certificate Tools\FTSafe\lang\escsp_ABChina_1033.lng
%PROGRAM_FILES%\95599 Certificate Tools\FTSafe\lang\escsp_ABChina_2052.lng
%PROGRAM_FILES%\95599 Certificate Tools\FTSafe\ePassAuto_ABChina_s.reg
%PROGRAM_FILES%\95599 Certificate Tools\FTSafe\lang\escertd_ABChina_1033.lng
%PROGRAM_FILES%\95599 Certificate Tools\FTSafe\lang\escertd_ABChina_2052.lng