Trojan.MulDrop7.55016

Техническая информация

Изменения в файловой системе:

Создает следующие файлы:

%ProgramFiles%\TeamViewer\TVExtractTemp\TeamViewer_Resource_sv.dll
%ProgramFiles%\TeamViewer\TVExtractTemp\TeamViewer_Resource_th.dll
%ProgramFiles%\TeamViewer\TVExtractTemp\TeamViewer_Resource_sk.dll
%ProgramFiles%\TeamViewer\TVExtractTemp\TeamViewer_Resource_sr.dll
%ProgramFiles%\TeamViewer\TVExtractTemp\TeamViewer_Resource_tr.dll
%ProgramFiles%\TeamViewer\TVExtractTemp\TeamViewer_Resource_zhCN.dll
%ProgramFiles%\TeamViewer\TVExtractTemp\TeamViewer_Resource_zhTW.dll
%ProgramFiles%\TeamViewer\TVExtractTemp\TeamViewer_Resource_uk.dll
%ProgramFiles%\TeamViewer\TVExtractTemp\TeamViewer_Resource_vi.dll
%ProgramFiles%\TeamViewer\TVExtractTemp\TeamViewer_Resource_lt.dll
%ProgramFiles%\TeamViewer\TVExtractTemp\TeamViewer_Resource_nl.dll
%ProgramFiles%\TeamViewer\TVExtractTemp\TeamViewer_Resource_ja.dll
%ProgramFiles%\TeamViewer\TVExtractTemp\TeamViewer_Resource_ko.dll
%ProgramFiles%\TeamViewer\TVExtractTemp\TeamViewer_Resource_no.dll
%ProgramFiles%\TeamViewer\TVExtractTemp\TeamViewer_Resource_ro.dll
%ProgramFiles%\TeamViewer\TVExtractTemp\TeamViewer_Resource_ru.dll
%ProgramFiles%\TeamViewer\TVExtractTemp\TeamViewer_Resource_pl.dll
%ProgramFiles%\TeamViewer\TVExtractTemp\TeamViewer_Resource_pt.dll
%ProgramFiles%\TeamViewer\TVExtractTemp\Printer\TeamViewer_XPSDriverFilter-PipelineConfig.xml
%ProgramFiles%\TeamViewer\TVExtractTemp\Printer\TeamViewer_XPSDriverFilter-manifest.ini
%ProgramFiles%\TeamViewer\TVExtractTemp\x86\TVMonitor.sy_
%ProgramFiles%\TeamViewer\TVExtractTemp\tvfiles_printer_WinLt10.7z
%ProgramFiles%\TeamViewer\TVExtractTemp\Printer\teamviewer_xpsdriverfilter.cat
%ProgramFiles%\TeamViewer\TVExtractTemp\tvfiles_printer_x86.7z
%ProgramFiles%\TeamViewer\TVExtractTemp\Printer\x86\TeamViewer_XPSDriverFilter.dll
%ProgramFiles%\TeamViewer\TVExtractTemp\Printer\TeamViewer_XPSDriverFilter.gpd
%ProgramFiles%\TeamViewer\TVExtractTemp\Printer\TeamViewer_XPSDriverFilter.inf
%ProgramFiles%\TeamViewer\TVExtractTemp\tv_x64.dll
%ProgramFiles%\TeamViewer\TVExtractTemp\tvfilesx86.7z
%ProgramFiles%\TeamViewer\TVExtractTemp\TeamViewer_StaticRes.dll
%ProgramFiles%\TeamViewer\TVExtractTemp\tv_w32.dll
%ProgramFiles%\TeamViewer\TVExtractTemp\x86\teamviewervpn.cat
%ProgramFiles%\TeamViewer\TVExtractTemp\x86\TVMonitor.inf
%ProgramFiles%\TeamViewer\TVExtractTemp\x86\teamviewervpn.sy_
%ProgramFiles%\TeamViewer\TVExtractTemp\x86\tvmonitor.cat
%ProgramFiles%\TeamViewer\TVExtractTemp\x86\TeamViewerVPN.inf
%ProgramFiles%\TeamViewer\TVExtractTemp\TeamViewer_Desktop.exe
%ProgramFiles%\TeamViewer\TVExtractTemp\TeamViewer_Note.exe
%ProgramFiles%\TeamViewer\TVExtractTemp\TeamViewer13.otf
%ProgramFiles%\TeamViewer\TVExtractTemp\TeamViewer.exe
%ProgramFiles%\TeamViewer\TVExtractTemp\TeamViewer_Service.exe
%ProgramFiles%\TeamViewer\TVExtractTemp\uninstall.exe
%ProgramFiles%\TeamViewer\TVExtractTemp\outlook\ManagedAggregator.dll
%ProgramFiles%\TeamViewer\TVExtractTemp\tv_w32.exe
%ProgramFiles%\TeamViewer\TVExtractTemp\tv_x64.exe
%TEMP%\nsa3.tmp
%CommonProgramFiles%\TV13Install.log
%TEMP%\aut1.tmp
%CommonProgramFiles%\~mvarwiz.tmp
%ProgramFiles%\TeamViewer\TVExtractTemp\tvfiles.7z
%ProgramFiles%\TeamViewer\TVExtractTemp\Lizenz_TeamViewer_DE_unicode.txt
%ProgramFiles%\TeamViewer\TVExtractTemp\Lizenz_TeamViewer_EN_unicode.txt
%ProgramFiles%\TeamViewer\TVExtractTemp\CopyRights_DE.txt
%ProgramFiles%\TeamViewer\TVExtractTemp\CopyRights_EN.txt
%ProgramFiles%\TeamViewer\TVExtractTemp\TeamViewer_Resource_fi.dll
%ProgramFiles%\TeamViewer\TVExtractTemp\TeamViewer_Resource_fr.dll
%ProgramFiles%\TeamViewer\TVExtractTemp\TeamViewer_Resource_en.dll
%ProgramFiles%\TeamViewer\TVExtractTemp\TeamViewer_Resource_es.dll
%ProgramFiles%\TeamViewer\TVExtractTemp\TeamViewer_Resource_he.dll
%ProgramFiles%\TeamViewer\TVExtractTemp\TeamViewer_Resource_id.dll
%ProgramFiles%\TeamViewer\TVExtractTemp\TeamViewer_Resource_it.dll
%ProgramFiles%\TeamViewer\TVExtractTemp\TeamViewer_Resource_hr.dll
%ProgramFiles%\TeamViewer\TVExtractTemp\TeamViewer_Resource_hu.dll
%ProgramFiles%\TeamViewer\TVExtractTemp\outlook\TeamViewerMeetingAddinShim64.dll
%ProgramFiles%\TeamViewer\TVExtractTemp\TeamViewer_Resource_ar.dll
%ProgramFiles%\TeamViewer\TVExtractTemp\outlook\TeamViewerMeetingAddIn.dll
%ProgramFiles%\TeamViewer\TVExtractTemp\outlook\TeamViewerMeetingAddinShim.dll
%ProgramFiles%\TeamViewer\TVExtractTemp\TeamViewer_Resource_bg.dll
%ProgramFiles%\TeamViewer\TVExtractTemp\TeamViewer_Resource_de.dll
%ProgramFiles%\TeamViewer\TVExtractTemp\TeamViewer_Resource_el.dll
%ProgramFiles%\TeamViewer\TVExtractTemp\TeamViewer_Resource_cs.dll
%ProgramFiles%\TeamViewer\TVExtractTemp\TeamViewer_Resource_da.dll

Присваивает атрибут 'скрытый' для следующих файлов:

%CommonProgramFiles%\~mvarwiz.tmp

Удаляет следующие файлы:

%ProgramFiles%\TeamViewer\TVExtractTemp\tvfilesx86.7z
%ProgramFiles%\TeamViewer\TVExtractTemp\tvfiles_printer_WinLt10.7z
%ProgramFiles%\TeamViewer\TVExtractTemp\tvfiles_printer_x86.7z
%TEMP%\aut1.tmp
%TEMP%\nsg4.tmp\ns5.tmp
%ProgramFiles%\TeamViewer\TVExtractTemp\tvfiles.7z

Другое:

Ищет следующие окна:

ClassName: '#32770' WindowName: ''

Создает и запускает на исполнение:

'%TEMP%\nsg4.tmp\ns5.tmp' <SYSTEM32>\schtasks /Create /TN TVInstallRestore /TR "%CommonProgramFiles%\~mvarwiz.tmp /RESTORE" /RU SYSTEM /SC ONLOGON /F
'%CommonProgramFiles%\~mvarwiz.tmp' /S

Запускает на исполнение: