Trojan.MulDrop8.16045

Техническая информация

Вредоносные функции:

Ищет следующие окна с целью

обнаружения утилит для анализа:

ClassName: 'OLLYDBG', WindowName: ''
ClassName: 'pediy06', WindowName: ''
ClassName: 'TIdaWindow', WindowName: ''
ClassName: 'APIMonitor By Rohitab', WindowName: ''
ClassName: 'FileMonClass', WindowName: 'File Monitor - Sysinternals: www.sysinternals.com'
ClassName: 'PROCEXPL', WindowName: 'Process Explorer - SysInternals: www.sysinternals.com [CRNJEUFU\%USERNAME%]'
ClassName: 'PROCEXPL', WindowName: ''
ClassName: 'PROCMON_WINDOW_CLASS', WindowName: 'Process Monitor - Sysinternals: www.sysinternals.com'

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\CmdLineExtInstallerExe.exe
<SYSTEM32>\CmdLineExt.dll
%TEMP%\drm_dyndata_7330014.dll
%APPDATA%\SecuROM\UserData\readme.txt
%APPDATA%\SecuROM\UserData\securom_v7_01.tmp
%APPDATA%\SecuROM\UserData\securom_v7_01.dat
%APPDATA%\SecuROM\UserData\securom_v7_01.bak
%APPDATA%\SecuROM\UserData\ЃϵϳЅЂϿϽϯІχϯπρϴϱЄϱЃϵϳЅ
%APPDATA%\SecuROM\UserData\ЃϵϳЅЂϿϽϯІχϯπρЂϻϵЉЃϵϳЅ
%TEMP%\drm_dialogs.dll

Присваивает атрибут 'скрытый' для следующих файлов:

%APPDATA%\SecuROM\UserData\securom_v7_01.bak
%APPDATA%\SecuROM\UserData\ЃϵϳЅЂϿϽϯІχϯπρϴϱЄϱЃϵϳЅ
%APPDATA%\SecuROM\UserData\ЃϵϳЅЂϿϽϯІχϯπρЂϻϵЉЃϵϳЅ

Удаляет следующие файлы:

%TEMP%\CmdLineExtInstallerExe.exe
<SYSTEM32>\d3d9caps.dat

Подменяет следующие файлы:

<SYSTEM32>\d3d9caps.dat

Другое:

Ищет следующие окна:

ClassName: '18467-41' WindowName: ''
ClassName: '#32770' WindowName: 'Y.A.S.U v1.03 - Copyright © 2006 CureROM DT'
ClassName: '#32770' WindowName: 'Y.A.S.U v1.03 - Copyright ? 2006 CureROM DT'
ClassName: '#32770' WindowName: 'Y.A.S.U v1.04 - Copyright © 2006 CureROM DT'
ClassName: '#32770' WindowName: 'Y.A.S.U v1.04 - Copyright ? 2006 CureROM DT'
ClassName: 'ReBarWindow32' WindowName: ''
ClassName: 'ToolbarWindow32 ' WindowName: ''
ClassName: '#32770' WindowName: 'Atiptool'
ClassName: '#32770' WindowName: 'Task Explorer II - by Ntoskrnl'
ClassName: 'TApplication' WindowName: '<Имя файла>'
ClassName: 'ThunderRT6FormDC' WindowName: 'Pr0t.St0p v1.0'
ClassName: 'ThunderRT6Main' WindowName: 'Pr0t.St0p v1.0'
ClassName: 'ThunderRT6FormDC' WindowName: 'Settings'
ClassName: 'File Monitor - Sysinternals: www.sysinternals.com' WindowName: 'FileMonClass'
ClassName: '' WindowName: 'APIMonitor By Rohitab'
ClassName: 'ToolbarWindow32?' WindowName: ''
ClassName: '[ LordPE Deluxe b ] by yoda' WindowName: '#32770'
ClassName: 'ThunderRT6Main' WindowName: 'SysAnalyzer'
ClassName: 'TrayNotifyWnd' WindowName: ''
ClassName: 'JCDSPY_NT_001' WindowName: 'DriverspyNT v1.20. (c)2001,2002 Collake Software'
ClassName: 'cuteProgressClass' WindowName: ''
ClassName: 'c3' WindowName: 'API Functions'
ClassName: 'c1' WindowName: 'KaKeeware Application Monitor 1.21'
ClassName: 'PEBrowse Professional Interactive' WindowName: 'TMainForm'
ClassName: 'TMainForm' WindowName: 'PEBrowse Professional Interactive'
ClassName: 'SysAnalyzer Configuration Wizard' WindowName: 'ThunderRT6Main'
ClassName: 'ThunderRT6Main' WindowName: 'SysAnalyzer Configuration Wizard'
ClassName: 'sniff_hit' WindowName: 'ThunderRT6Main'
ClassName: 'ThunderRT6Main' WindowName: 'sniff_hit'
ClassName: 'Process Analyzer - right click on a process to access menu' WindowName: 'ThunderRT6Main'
ClassName: 'ThunderRT6Main' WindowName: 'Process Analyzer - right click on a process to access menu'
ClassName: 'ApiLogger' WindowName: 'ThunderRT6Main'
ClassName: 'ThunderRT6Main' WindowName: 'ApiLogger'
ClassName: 'SafeDisc4 Hider 1.1 © 2005 SKULL' WindowName: 'Tsd4hideform'
ClassName: 'ThunderRT6Main' WindowName: 'SD4 Sucks v0.10 by Joseph Cox'
ClassName: 'SafeDisc4 Hider 1.1 ? 2005 SKULL' WindowName: 'Tsd4hideform'
ClassName: 'Tsd4hideform' WindowName: 'SafeDisc4 Hider 1.1 © 2005 SKULL'
ClassName: 'Tsd4hideform' WindowName: 'SafeDisc4 Hider 1.1 ? 2005 SKULL'
ClassName: 'Virtual-CD-Hide' WindowName: 'Virtual-CD-Hide'
ClassName: '[ LordPE Deluxe ] by yoda' WindowName: ''
ClassName: '' WindowName: '[ LordPE Deluxe ] by yoda'
ClassName: 'ThunderRT6FormDC' WindowName: 'SR7.Stop v1.1'
ClassName: 'ThunderRT6Main' WindowName: 'SR7.Stop v1.1'
ClassName: 'ThunderRT6Main' WindowName: 'SR7.Stop v1.2'
ClassName: 'ThunderRT6Main' WindowName: 'SR7Stop'
ClassName: '#32770' WindowName: 'Starforce Nightmare'
ClassName: '[ LordPE Dumper Server ]' WindowName: ''
ClassName: 'ThunderRT6Main' WindowName: 'Anti-Blaxx'
ClassName: 'WispWindowClass' WindowName: 'Syser [Ctrl+F12]'
ClassName: 'kk1' WindowName: ''
ClassName: 'icu_dbg' WindowName: ''
ClassName: 'Lbr68' WindowName: ''
ClassName: 'SHADOW' WindowName: ''
ClassName: 'SysPager' WindowName: ''
ClassName: 'SysAnalyzer' WindowName: 'ThunderRT6Main'
ClassName: '#32770' WindowName: '[ LordPE Deluxe b ] by yoda'
ClassName: '[ LordPE RoyalTS ] by yoda' WindowName: '#32770'
ClassName: '' WindowName: '[ LordPE Dumper Server ]'
ClassName: 'SafeDisc4 Hider 1.0 © 2005 SKULL' WindowName: 'TForm1'
ClassName: 'SafeDisc4 Hider 1.0 ? 2005 SKULL' WindowName: 'TForm1'
ClassName: 'TForm1' WindowName: 'SafeDisc4 Hider 1.0 © 2005 SKULL'
ClassName: 'TForm1' WindowName: 'SafeDisc4 Hider 1.0 ? 2005 SKULL'
ClassName: 'SafeDisc4 Hider' WindowName: 'TApplication'
ClassName: 'TApplication' WindowName: 'SafeDisc4 Hider'
ClassName: 'BusTrace Status' WindowName: '#32770'
ClassName: '#32770' WindowName: 'BusTrace Status'
ClassName: 'Fucker of CDROM Protections v0.83 Beta' WindowName: 'TForm1'
ClassName: 'TForm1' WindowName: 'Fucker of CDROM Protections v0.83 Beta'
ClassName: 'Fucker of CDROM Protections v0.81 Beta' WindowName: 'TForm1'
ClassName: 'TForm1' WindowName: 'Fucker of CDROM Protections v0.81 Beta'
ClassName: 'STARFUCK TOOL' WindowName: '#32770'
ClassName: '#32770' WindowName: 'STARFUCK TOOL'
ClassName: '#32770' WindowName: '[ LordPE RoyalTS ] by yoda'
ClassName: 'ToolbarWindow32' WindowName: ''