Trojan.MulDrop7.37867

Техническая информация

Для обеспечения автозапуска и распространения:

Создает следующие сервисы:

[<HKLM>\SYSTEM\ControlSet001\Services\Pharos Systems ComTaskMaster] 'Start' = '00000002'
[<HKLM>\SYSTEM\ControlSet001\Services\Pharos Systems ComTaskMaster] 'ImagePath' = '"%ProgramFiles%\Pharos\Core\CTskMstr.exe"'

Вредоносные функции:

Запускает на исполнение:

'<SYSTEM32>\rundll32.exe' "%ProgramFiles%\Pharos\BIN\RoutUtil.dll",Exec Uninstall
'<SYSTEM32>\cmd.exe' /c "%ProgramFiles%\PharosSystems\Core\UserServer.exe" /regserver
'<SYSTEM32>\cmd.exe' /c "%ProgramFiles%\Pharos\Bin\popupcli.exe" /regserver

Изменения в файловой системе:

Создает следующие файлы:

%ProgramFiles%\Pharos\bin\~GLH0014.TMP
%ProgramFiles%\Pharos\bin\~GLH0016.TMP
%ProgramFiles%\Pharos\bin\~GLH0017.TMP
%ALLUSERSPROFILE%\Start Menu\Programs\Pharos\Pharos Popup Client Configuration.lnk
%ProgramFiles%\Pharos\bin\~GLH000f.TMP
%ProgramFiles%\Pharos\bin\~GLH0011.TMP
%ProgramFiles%\Pharos\bin\~GLH0012.TMP
%ProgramFiles%\Pharos\bin\~GLH001e.TMP
%ProgramFiles%\Pharos\bin\~GLH0020.TMP
%ProgramFiles%\PharosSystems\Core\~GLH0022.TMP
%ProgramFiles%\Pharos\bin\Images\~GLH001d.TMP
%ProgramFiles%\Pharos\bin\~GLH0019.TMP
%ProgramFiles%\Pharos\bin\Images\~GLH001b.TMP
%ProgramFiles%\Pharos\bin\Images\~GLH001c.TMP
%ProgramFiles%\Pharos\bin\~GLH000d.TMP
<Текущая директория>\~GLH0001.TMP
%ProgramFiles%\Pharos\bin\~GLH0002.TMP
%ProgramFiles%\Pharos\bin\temp.000
%TEMP%\GLI5.tmp
%TEMP%\GLC1.tmp
%TEMP%\GLJ2.tmp
%TEMP%\~GLH0000.TMP
%ProgramFiles%\Pharos\bin\~GLH0008.TMP
%ProgramFiles%\Pharos\bin\~GLH000a.TMP
%ProgramFiles%\Pharos\bin\~GLH000b.TMP
%ProgramFiles%\PharosSystems\Core\~GLH0007.TMP
%ProgramFiles%\PharosSystems\Core\~GLH0004.TMP
%ProgramFiles%\PharosSystems\Core\~GLH0005.TMP
%ProgramFiles%\PharosSystems\Core\temp.000

Удаляет следующие файлы:

%ProgramFiles%\Pharos\bin\~GLH0019.TMP
%ProgramFiles%\Pharos\bin\~GLH0017.TMP
%ProgramFiles%\Pharos\bin\~GLH0014.TMP
%ProgramFiles%\PharosSystems\Core\~GLH0022.TMP
%ProgramFiles%\Pharos\bin\~GLH0020.TMP
%ProgramFiles%\Pharos\bin\~GLH001e.TMP
%ProgramFiles%\Pharos\bin\~GLH0012.TMP
%ProgramFiles%\Pharos\bin\~GLH0008.TMP
%ProgramFiles%\PharosSystems\Core\~GLH0005.TMP
%ProgramFiles%\Pharos\bin\~GLH0002.TMP
%ProgramFiles%\Pharos\bin\~GLH000f.TMP
%ProgramFiles%\Pharos\bin\~GLH000d.TMP
%ProgramFiles%\Pharos\bin\~GLH000b.TMP

Перемещает следующие файлы:

%ProgramFiles%\Pharos\bin\~GLH0018.TMP в %ProgramFiles%\Pharos\bin\Microsoft.WindowsAPICodePack.dll
%ProgramFiles%\Pharos\bin\temp.000 в %ProgramFiles%\Pharos\bin\~GLH0018.TMP
%ProgramFiles%\Pharos\bin\~GLH001a.TMP в %ProgramFiles%\Pharos\bin\Microsoft.WindowsAPICodePack.Shell.dll
%ProgramFiles%\Pharos\bin\temp.000 в %ProgramFiles%\Pharos\bin\~GLH001a.TMP
%ProgramFiles%\Pharos\bin\~GLH0016.TMP в %ProgramFiles%\Pharos\bin\Console-Notifier.exe.config
%ProgramFiles%\Pharos\bin\~GLH0013.TMP в %ProgramFiles%\Pharos\bin\PopupClientConfiguration.exe
%ProgramFiles%\Pharos\bin\temp.000 в %ProgramFiles%\Pharos\bin\~GLH0013.TMP
%ProgramFiles%\Pharos\bin\~GLH0015.TMP в %ProgramFiles%\Pharos\bin\Console-Notifier.exe
%ProgramFiles%\Pharos\bin\temp.000 в %ProgramFiles%\Pharos\bin\~GLH0015.TMP
%ProgramFiles%\Pharos\bin\~GLH0021.TMP в %ProgramFiles%\Pharos\bin\RoutUtil.dll
%ProgramFiles%\Pharos\bin\temp.000 в %ProgramFiles%\Pharos\bin\~GLH0021.TMP
%ProgramFiles%\PharosSystems\Core\~GLH0023.TMP в %ProgramFiles%\PharosSystems\Core\UserServer.exe
%ProgramFiles%\PharosSystems\Core\temp.000 в %ProgramFiles%\PharosSystems\Core\~GLH0023.TMP
%ProgramFiles%\Pharos\bin\~GLH001f.TMP в %ProgramFiles%\Pharos\bin\Router.dll
%ProgramFiles%\Pharos\bin\Images\~GLH001c.TMP в %ProgramFiles%\Pharos\bin\Images\symbol_exclamation.png
%ProgramFiles%\Pharos\bin\Images\~GLH001b.TMP в %ProgramFiles%\Pharos\bin\Images\symbol_error.png
%ProgramFiles%\Pharos\bin\temp.000 в %ProgramFiles%\Pharos\bin\~GLH001f.TMP
%ProgramFiles%\Pharos\bin\Images\~GLH001d.TMP в %ProgramFiles%\Pharos\bin\Images\symbol_information.png
%ProgramFiles%\PharosSystems\Core\~GLH0006.TMP в %ProgramFiles%\PharosSystems\Core\CTskMstr.exe
%ProgramFiles%\PharosSystems\Core\temp.000 в %ProgramFiles%\PharosSystems\Core\~GLH0006.TMP
%ProgramFiles%\Pharos\bin\temp.000 в %ProgramFiles%\Pharos\bin\~GLH0009.TMP
%ProgramFiles%\PharosSystems\Core\~GLH0007.TMP в %ProgramFiles%\PharosSystems\Core\CTskMstr.exe.config
%ProgramFiles%\PharosSystems\Core\~GLH0004.TMP в %ProgramFiles%\PharosSystems\Core\CrInstHelper.dll
<Текущая директория>\~GLH0001.TMP в <Текущая директория>\PSInst32.dll
%TEMP%\~GLH0000.TMP в %TEMP%\GLF4.tmp
%ProgramFiles%\Pharos\bin\~GLH0003.TMP в %ProgramFiles%\Pharos\bin\PSDBInst.DLL
%ProgramFiles%\Pharos\bin\temp.000 в %ProgramFiles%\Pharos\bin\~GLH0003.TMP
%ProgramFiles%\Pharos\bin\temp.000 в %ProgramFiles%\Pharos\bin\~GLH0010.TMP
%ProgramFiles%\Pharos\bin\~GLH000e.TMP в %ProgramFiles%\Pharos\bin\iManageDMS.dll
%ProgramFiles%\Pharos\bin\~GLH0011.TMP в %ProgramFiles%\Pharos\bin\Popups.chm
%ProgramFiles%\Pharos\bin\~GLH0010.TMP в %ProgramFiles%\Pharos\bin\HummingbirdDMS.dll
%ProgramFiles%\Pharos\bin\temp.000 в %ProgramFiles%\Pharos\bin\~GLH000e.TMP
%ProgramFiles%\Pharos\bin\~GLH000a.TMP в %ProgramFiles%\Pharos\bin\popupcli.lan
%ProgramFiles%\Pharos\bin\~GLH0009.TMP в %ProgramFiles%\Pharos\bin\popupcli.exe
%ProgramFiles%\Pharos\bin\~GLH000c.TMP в %ProgramFiles%\Pharos\bin\popnet.exe
%ProgramFiles%\Pharos\bin\temp.000 в %ProgramFiles%\Pharos\bin\~GLH000c.TMP