Trojan.MulDrop7.55012

Техническая информация

Вредоносные функции:

Завершает или пытается завершить

следующие пользовательские процессы:

chrome.exe
firefox.exe

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\WZSE0.TMP\fpres832-0419.dll
%TEMP%\WZSE0.TMP\fpres832-041b.dll
%TEMP%\WZSE0.TMP\fpres832-0416.dll
%TEMP%\WZSE0.TMP\fpres832-0413.dll
%TEMP%\WZSE0.TMP\fpres832-0415.dll
%TEMP%\WZSE0.TMP\fpui8-x64.dll
%TEMP%\WZSE0.TMP\fpui8.dll
%TEMP%\WZSE0.TMP\fpres832.dll
%TEMP%\WZSE0.TMP\fpres832-041d.dll
%TEMP%\WZSE0.TMP\fpres832-0804.dll
%TEMP%\WZSE0.TMP\fpres832-0411.dll
%TEMP%\WZSE0.TMP\fpres832-0404.dll
%TEMP%\WZSE0.TMP\fpres832-0405.dll
%TEMP%\WZSE0.TMP\fpres8-x64.dll
%TEMP%\WZSE0.TMP\fpres8-x64-041d.dll
%TEMP%\WZSE0.TMP\fpres8-x64-0804.dll
%TEMP%\WZSE0.TMP\fpres832-040c.dll
%TEMP%\WZSE0.TMP\fpres832-0410.dll
%TEMP%\WZSE0.TMP\fpres832-040a.dll
%TEMP%\WZSE0.TMP\fpres832-0406.dll
%TEMP%\WZSE0.TMP\fpres832-0407.dll
%TEMP%\WZSE0.TMP\framedyn.dll
%TEMP%\WZSE0.TMP\Ltfilu.dll
%TEMP%\WZSE0.TMP\Ltfilx.dll
%TEMP%\WZSE0.TMP\Ltdisx.dll
%TEMP%\WZSE0.TMP\Lftifx.dll
%TEMP%\WZSE0.TMP\Ltdisu.dll
%TEMP%\WZSE0.TMP\setup-x64.exe
%TEMP%\WZSE0.TMP\setup.exe
%TEMP%\WZSE0.TMP\Readme.txt
%TEMP%\WZSE0.TMP\Ltkrnu.dll
%TEMP%\WZSE0.TMP\Ltkrnx.dll
%TEMP%\WZSE0.TMP\Lftifu.dll
%TEMP%\WZSE0.TMP\Lfcmpx.dll
%TEMP%\WZSE0.TMP\Lffaxu.dll
%TEMP%\WZSE0.TMP\Lfcmpu.dll
%TEMP%\WZSE0.TMP\Lfbmpu.dll
%TEMP%\WZSE0.TMP\Lfbmpx.dll
%TEMP%\WZSE0.TMP\Lfpngu.dll
%TEMP%\WZSE0.TMP\Lfpngx.dll
%TEMP%\WZSE0.TMP\Lfgifx.dll
%TEMP%\WZSE0.TMP\Lffaxx.dll
%TEMP%\WZSE0.TMP\Lfgifu.dll
<LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\agabegcgoagbgcpiegohpamfdpcnmfba\1.0.1_0\icons\icon96.png
%TEMP%\nss3.tmp\nsJSON.dll
<LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\agabegcgoagbgcpiegohpamfdpcnmfba\1.0.1_0\icons\icon72.png
<LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\agabegcgoagbgcpiegohpamfdpcnmfba\1.0.1_0\manifest.json
<LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\agabegcgoagbgcpiegohpamfdpcnmfba\1.0.1_0\icons\icon128.png
%TEMP%\WZSE0.TMP\fpdisp8.exe
%TEMP%\WZSE0.TMP\fpdspl8-x64.dll
%TEMP%\WZSE0.TMP\fpdisp8-x64.exe
<LS_APPDATA>\Google\Chrome\User Data\Default\Preferences
C:\software.exe
<LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\agabegcgoagbgcpiegohpamfdpcnmfba\1.0.1_0\src\extension.js
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\{d64e478d-4dee-4bfb-afe4-30b84e6a3157}\icon.png
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\{d64e478d-4dee-4bfb-afe4-30b84e6a3157}\icon32.png
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\{d64e478d-4dee-4bfb-afe4-30b84e6a3157}\bootstrap.js
C:\mySecureSurfer.exe
%TEMP%\nss3.tmp\KillProcDLL.dll
%APPDATA%\mySecureSurfer\CHROME\mySecureSurfer.crx
%TEMP%\nss3.tmp\ZipDLL.dll
%TEMP%\nss3.tmp\System.dll
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\{d64e478d-4dee-4bfb-afe4-30b84e6a3157}\install.rdf
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\{d64e478d-4dee-4bfb-afe4-30b84e6a3157}\chrome\content\extension.js
%TEMP%\WZSE0.TMP\fpdspl8.dll
%TEMP%\WZSE0.TMP\fpres8-x64-0410.dll
%TEMP%\WZSE0.TMP\fpres8-x64-0411.dll
%TEMP%\WZSE0.TMP\fpres8-x64-040c.dll
%TEMP%\WZSE0.TMP\fpres8-x64-0407.dll
%TEMP%\WZSE0.TMP\fpres8-x64-040a.dll
%TEMP%\WZSE0.TMP\fpres8-x64-0419.dll
%TEMP%\WZSE0.TMP\fpres8-x64-041b.dll
%TEMP%\WZSE0.TMP\fpres8-x64-0416.dll
%TEMP%\WZSE0.TMP\fpres8-x64-0413.dll
%TEMP%\WZSE0.TMP\fpres8-x64-0415.dll
%TEMP%\WZSE0.TMP\fpres8-x64-0406.dll
%TEMP%\WZSE0.TMP\fpgraph8-x64.dll
%TEMP%\WZSE0.TMP\fpinter8-2K.dll
%TEMP%\WZSE0.TMP\fpgraph8-2K.dll
%TEMP%\WZSE0.TMP\fpent8a-x64.dll
%TEMP%\WZSE0.TMP\fpent8a.dll
%TEMP%\WZSE0.TMP\fpres8-x64-0404.dll
%TEMP%\WZSE0.TMP\fpres8-x64-0405.dll
%TEMP%\WZSE0.TMP\fpmon8.dll
%TEMP%\WZSE0.TMP\fpinter8-x64.dll
%TEMP%\WZSE0.TMP\fpmon8-x64.dll