Trojan.MulDrop3.22482

Техническая информация

Вредоносные функции:

Создает и запускает на исполнение:

%ALLUSERSPROFILE%\Application Data\bomgar-scc-4EC17D21\bomgar-scc.exe "-nctuf" "<Полный путь к вирусу>" "-install2" "<Полный путь к вирусу>" "%TEMP%\nsj3.tmp\" "%ALLUSERSPROFILE%\Application Data\bomgar-scc-4EC17D21\"
%TEMP%\nsj3.tmp\bomgar-scc.exe -nctuf <Полный путь к вирусу> -install1 "<Полный путь к вирусу>"

Изменения в файловой системе:

Создает следующие файлы:

%ALLUSERSPROFILE%\Application Data\bomgar-scc-4EC17D21\button_sidebar_expanded.png
%ALLUSERSPROFILE%\Application Data\bomgar-scc-4EC17D21\button_viewer_actual_size.png
%ALLUSERSPROFILE%\Application Data\bomgar-scc-4EC17D21\button_sidebar_alert.png
%ALLUSERSPROFILE%\Application Data\bomgar-scc-4EC17D21\button_sidebar_collapsed.png
%ALLUSERSPROFILE%\Application Data\bomgar-scc-4EC17D21\button_viewer_quality32.png
%ALLUSERSPROFILE%\Application Data\bomgar-scc-4EC17D21\button_viewer_quality8.png
%ALLUSERSPROFILE%\Application Data\bomgar-scc-4EC17D21\button_viewer_fit.png
%ALLUSERSPROFILE%\Application Data\bomgar-scc-4EC17D21\button_viewer_quality16.png
%ALLUSERSPROFILE%\Application Data\bomgar-scc-4EC17D21\button_panic.png
%ALLUSERSPROFILE%\Application Data\bomgar-scc-4EC17D21\BF13227E-B446-4E12-913E-7E5FBBEE54F6
%ALLUSERSPROFILE%\Application Data\bomgar-scc-4EC17D21\bomgar-scc.exe
%ALLUSERSPROFILE%\Application Data\bomgar-scc-4EC17D21\app_icon_16.png
%ALLUSERSPROFILE%\Application Data\bomgar-scc-4EC17D21\app_icon_32.png
%ALLUSERSPROFILE%\Application Data\bomgar-scc-4EC17D21\button_cb_survey.png
%ALLUSERSPROFILE%\Application Data\bomgar-scc-4EC17D21\button_cb_team.png
%ALLUSERSPROFILE%\Application Data\bomgar-scc-4EC17D21\button_cb_access_key.png
%ALLUSERSPROFILE%\Application Data\bomgar-scc-4EC17D21\button_cb_private.png
%ALLUSERSPROFILE%\Application Data\bomgar-scc-4EC17D21\indicator_ft_animation0.png
%ALLUSERSPROFILE%\Application Data\bomgar-scc-4EC17D21\preload-en-us.rdf
%ALLUSERSPROFILE%\Application Data\bomgar-scc-4EC17D21\remove.exe
%ALLUSERSPROFILE%\Application Data\bomgar-scc-4EC17D21\indicator_ss_watermark.png
%ALLUSERSPROFILE%\Application Data\bomgar-scc-4EC17D21\nstvhook.dll
%ALLUSERSPROFILE%\Application Data\bomgar-scc-4EC17D21\uninstall.bat
%ALLUSERSPROFILE%\Application Data\bomgar-scc-4EC17D21\settings.ini41
%ALLUSERSPROFILE%\Application Data\bomgar-scc-4EC17D21\server.lic
%ALLUSERSPROFILE%\Application Data\bomgar-scc-4EC17D21\settings-init.ini
%ALLUSERSPROFILE%\Application Data\bomgar-scc-4EC17D21\indicator_rep_viewing.png
%ALLUSERSPROFILE%\Application Data\bomgar-scc-4EC17D21\indicator_ft_animation3.png
%ALLUSERSPROFILE%\Application Data\bomgar-scc-4EC17D21\indicator_ft_animation4.png
%ALLUSERSPROFILE%\Application Data\bomgar-scc-4EC17D21\indicator_ft_animation1.png
%ALLUSERSPROFILE%\Application Data\bomgar-scc-4EC17D21\indicator_ft_animation2.png
%ALLUSERSPROFILE%\Application Data\bomgar-scc-4EC17D21\indicator_rep_not_present.png
%ALLUSERSPROFILE%\Application Data\bomgar-scc-4EC17D21\indicator_rep_present.png
%ALLUSERSPROFILE%\Application Data\bomgar-scc-4EC17D21\indicator_pinned_connected.png
%ALLUSERSPROFILE%\Application Data\bomgar-scc-4EC17D21\indicator_pinned_disconnected.png
%TEMP%\nsj3.tmp\remove.exe
%TEMP%\nsj3.tmp\button_sidebar_alert.png
%TEMP%\nsj3.tmp\button_sidebar_collapsed.png
%TEMP%\nsj3.tmp\button_cb_team.png
%TEMP%\nsj3.tmp\button_panic.png
%TEMP%\nsj3.tmp\button_viewer_fit.png
%TEMP%\nsj3.tmp\button_viewer_quality16.png
%TEMP%\nsj3.tmp\button_sidebar_expanded.png
%TEMP%\nsj3.tmp\button_viewer_actual_size.png
%TEMP%\nsj3.tmp\button_cb_survey.png
%TEMP%\nsj3.tmp\server.lic
%TEMP%\nsj3.tmp\preload-en-us.rdf
%TEMP%\nst2.tmp
%TEMP%\nsj3.tmp\System.dll
%TEMP%\nsj3.tmp\button_cb_access_key.png
%TEMP%\nsj3.tmp\button_cb_private.png
%TEMP%\nsj3.tmp\app_icon_16.png
%TEMP%\nsj3.tmp\app_icon_32.png
%TEMP%\nsj3.tmp\button_viewer_quality32.png
%TEMP%\nsj3.tmp\indicator_ss_watermark.png
%TEMP%\nsj3.tmp\nstvhook.dll
%TEMP%\nsj3.tmp\indicator_rep_present.png
%TEMP%\nsj3.tmp\indicator_rep_viewing.png
%TEMP%\nsj3.tmp\BF13227E-B446-4E12-913E-7E5FBBEE54F6
%TEMP%\nsj3.tmp\settings-init.ini
%TEMP%\nsj3.tmp\uninstall.bat
%TEMP%\nsj3.tmp\bomgar-scc.exe
%TEMP%\nsj3.tmp\indicator_rep_not_present.png
%TEMP%\nsj3.tmp\indicator_ft_animation1.png
%TEMP%\nsj3.tmp\indicator_ft_animation2.png
%TEMP%\nsj3.tmp\button_viewer_quality8.png
%TEMP%\nsj3.tmp\indicator_ft_animation0.png
%TEMP%\nsj3.tmp\indicator_pinned_connected.png
%TEMP%\nsj3.tmp\indicator_pinned_disconnected.png
%TEMP%\nsj3.tmp\indicator_ft_animation3.png
%TEMP%\nsj3.tmp\indicator_ft_animation4.png