Trojan.MulDrop7.54428

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKLM>\SOFTWARE\Classes\BurnAwareOpen\shell\open\command] '' = '"%ProgramFiles%\BurnAware Professional\burnaware.exe"'

Изменения в файловой системе:

Создает следующие файлы:

%ProgramFiles%\BurnAware Professional\is-7OSAO.tmp
%ProgramFiles%\BurnAware Professional\is-TM4US.tmp
%ProgramFiles%\BurnAware Professional\is-O0QVQ.tmp
%ProgramFiles%\BurnAware Professional\is-4FJGC.tmp
%ProgramFiles%\BurnAware Professional\is-TLD6N.tmp
%ProgramFiles%\BurnAware Professional\is-6VFQL.tmp
%ProgramFiles%\BurnAware Professional\is-BSFDH.tmp
%ProgramFiles%\BurnAware Professional\is-IKCHA.tmp
%ProgramFiles%\BurnAware Professional\is-8GAD6.tmp
%ALLUSERSPROFILE%\Start Menu\Programs\BurnAware Professional\Uninstall BurnAware Professional.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\BurnAware Professional\BurnAware Professional on the Web.url
%ProgramFiles%\BurnAware Professional\unins000.dat
%ALLUSERSPROFILE%\Desktop\BurnAware Professional.lnk
%ProgramFiles%\BurnAware Professional\is-GKVCU.tmp
%ProgramFiles%\BurnAware Professional\is-J4HHE.tmp
%ALLUSERSPROFILE%\Start Menu\Programs\BurnAware Professional\Help.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\BurnAware Professional\BurnAware Professional.lnk
%ProgramFiles%\BurnAware Professional\is-TBHPD.tmp
%ProgramFiles%\BurnAware Professional\is-5BSL8.tmp
%ProgramFiles%\BurnAware Professional\is-KJ7FO.tmp
%ProgramFiles%\BurnAware Professional\is-61HJD.tmp
%TEMP%\is-PQDAQ.tmp\burnaware_pro.tmp
%TEMP%\7ZipSfx.000\burnaware_pro.exe
%TEMP%\is-26L58.tmp\_isetup\_shfoldr.dll
%TEMP%\is-26L58.tmp\_isetup\_RegDLL.tmp
%ProgramFiles%\BurnAware Professional\is-20F0M.tmp
%ProgramFiles%\BurnAware Professional\is-JU32L.tmp
%ProgramFiles%\BurnAware Professional\is-GLSCR.tmp
%ProgramFiles%\BurnAware Professional\is-HOHQ3.tmp
%ProgramFiles%\BurnAware Professional\is-6SD21.tmp
%ProgramFiles%\BurnAware Professional\is-HQCFQ.tmp
%ProgramFiles%\BurnAware Professional\is-DLV5M.tmp
%ProgramFiles%\BurnAware Professional\is-CBTKN.tmp
%ProgramFiles%\BurnAware Professional\is-P65OO.tmp

Удаляет следующие файлы:

%TEMP%\is-PQDAQ.tmp\burnaware_pro.tmp
%TEMP%\7ZipSfx.000\burnaware_pro.exe
%TEMP%\is-26L58.tmp\_isetup\_RegDLL.tmp
%TEMP%\is-26L58.tmp\_isetup\_shfoldr.dll

Перемещает следующие файлы:

%ProgramFiles%\BurnAware Professional\is-IKCHA.tmp в %ProgramFiles%\BurnAware Professional\FoxPlayerU32.dll
%ProgramFiles%\BurnAware Professional\is-BSFDH.tmp в %ProgramFiles%\BurnAware Professional\FoxWmaPluginU32.dll
%ProgramFiles%\BurnAware Professional\is-TM4US.tmp в %ProgramFiles%\BurnAware Professional\tvqdec.dll
%ProgramFiles%\BurnAware Professional\is-HOHQ3.tmp в %ProgramFiles%\BurnAware Professional\MultiBurn.exe
%ProgramFiles%\BurnAware Professional\is-6VFQL.tmp в %ProgramFiles%\BurnAware Professional\BurnAware.exe
%ProgramFiles%\BurnAware Professional\is-TLD6N.tmp в %ProgramFiles%\BurnAware Professional\burnaware.chm
%ProgramFiles%\BurnAware Professional\is-8GAD6.tmp в %ProgramFiles%\BurnAware Professional\tags.dll
%ProgramFiles%\BurnAware Professional\is-J4HHE.tmp в %ProgramFiles%\BurnAware Professional\FoxSDKU32w.dll
%ProgramFiles%\BurnAware Professional\is-GKVCU.tmp в %ProgramFiles%\BurnAware Professional\NMSDVDXU.dll
%ProgramFiles%\BurnAware Professional\is-7OSAO.tmp в %ProgramFiles%\BurnAware Professional\bass.dll
%ProgramFiles%\BurnAware Professional\is-4FJGC.tmp в %ProgramFiles%\BurnAware Professional\bassflac.dll
%ProgramFiles%\BurnAware Professional\is-O0QVQ.tmp в %ProgramFiles%\BurnAware Professional\basswma.dll
%ProgramFiles%\BurnAware Professional\is-KJ7FO.tmp в %ProgramFiles%\BurnAware Professional\DVDVideo.exe
%ProgramFiles%\BurnAware Professional\is-20F0M.tmp в %ProgramFiles%\BurnAware Professional\DataDisc.exe
%ProgramFiles%\BurnAware Professional\is-DLV5M.tmp в %ProgramFiles%\BurnAware Professional\DiscInfo.exe
%ProgramFiles%\BurnAware Professional\is-5BSL8.tmp в %ProgramFiles%\BurnAware Professional\unins000.exe
%ProgramFiles%\BurnAware Professional\is-TBHPD.tmp в %ProgramFiles%\BurnAware Professional\AudioCD.exe
%ProgramFiles%\BurnAware Professional\is-61HJD.tmp в %ProgramFiles%\BurnAware Professional\DiscImage.exe
%ProgramFiles%\BurnAware Professional\is-GLSCR.tmp в %ProgramFiles%\BurnAware Professional\MakeISO.exe
%ProgramFiles%\BurnAware Professional\is-JU32L.tmp в %ProgramFiles%\BurnAware Professional\CopyDisc.exe
%ProgramFiles%\BurnAware Professional\is-6SD21.tmp в %ProgramFiles%\BurnAware Professional\DataRecovery.exe
%ProgramFiles%\BurnAware Professional\is-HQCFQ.tmp в %ProgramFiles%\BurnAware Professional\MP3Disc.exe
%ProgramFiles%\BurnAware Professional\is-P65OO.tmp в %ProgramFiles%\BurnAware Professional\EraseDisc.exe
%ProgramFiles%\BurnAware Professional\is-CBTKN.tmp в %ProgramFiles%\BurnAware Professional\CopyImage.exe

Другое:

Создает и запускает на исполнение:

'%TEMP%\is-PQDAQ.tmp\burnaware_pro.tmp' /SL5="$40036,4467342,64512,%TEMP%\7ZipSfx.000\burnaware_pro.exe" /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-
'%TEMP%\7ZipSfx.000\burnaware_pro.exe' /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-

Запускает на исполнение:

'<SYSTEM32>\regsvr32.exe' /s "%ProgramFiles%\BurnAware Professional\NMSDVDXU.dll"
'<SYSTEM32>\regsvr32.exe' /s "%ProgramFiles%\BurnAware Professional\FoxSDKU32w.dll"