Trojan.MulDrop8.16465

Техническая информация

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\7zS81BE8D72\CardReader\APBin\config.ini
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_.DEFAULT
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-21-2052111302-484763869-725345543-1003
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-21-2052111302-484763869-725345543-1003
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-20
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-20
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-19
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-19
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-18
%ProgramFiles%\InstallShield Installation Information\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\pkgc8c58.rra
%ProgramFiles%\InstallShield Installation Information\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\uset8c29.rra
%ProgramFiles%\Realtek\Realtek Card Reader\revc8bea.rra
%ProgramFiles%\Realtek\Realtek Card Reader\revc8bbb.rra
%ProgramFiles%\Realtek\Realtek Card Reader\Disp8b7d.rra
%ProgramFiles%\Realtek\Realtek Card Reader\SetE8b4e.rra
%ProgramFiles%\Realtek\Realtek Card Reader\SDRT8b1f.rra
%ProgramFiles%\Realtek\Realtek Card Reader\Rmb8ad1.rra
%ProgramFiles%\Realtek\Realtek Card Reader\conf8ab2.rra
%ProgramFiles%\Realtek\Realtek Card Reader\RsCR8a73.rra
%ProgramFiles%\Realtek\Realtek Card Reader\RIco894a.rra
<DRIVERS>\RtsP88cd.rra
%ProgramFiles%\Realtek\Realtek Card Reader\SDRT888f.rra
%ProgramFiles%\Realtek\Realtek Card Reader\RtsP8533.rra
%ProgramFiles%\Realtek\Realtek Card Reader\RtsP8850.rra
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SECURITY
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SOFTWARE
<SYSTEM32>\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\oem3.CAT
%ProgramFiles%\InstallShield Installation Information\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\setup.ini
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\OBJECTS.MAP
%ProgramFiles%\InstallShield Installation Information\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\setua984.rra
%ProgramFiles%\InstallShield Installation Information\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\setua946.rra
%ProgramFiles%\InstallShield Installation Information\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\ISSea8f8.rra
%ProgramFiles%\InstallShield Installation Information\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\_Seta8b9.rra
%ProgramFiles%\InstallShield Installation Information\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\setua85b.rra
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\OBJECTS.DATA
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING2.MAP
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING.VER
%TEMP%\{32E48D80-50BF-41CD-84A3-9C7D73199AE3}\_Setup.dll
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\INDEX.MAP
%ProgramFiles%\InstallShield Installation Information\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\dataa713.rra
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\INDEX.BTR
%ProgramFiles%\InstallShield Installation Information\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\dataa6f4.rra
%ProgramFiles%\InstallShield Installation Information\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\layoa6e4.rra
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\$WinMgmt.CFG
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\domain.txt
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\ComDb.Dat
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SAM
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SYSTEM
%ProgramFiles%\Realtek\Realtek Card Reader\RtsP8514.rra
%ProgramFiles%\Realtek\Realtek Card Reader\RtsP84d6.rra
%TEMP%\{3C047337-CA66-459B-AA94-88BCA2A0F66A}\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\_IsR7574.rra
%TEMP%\7zS81BE8D72\CardReader\APBin\SDRTCPRM.dll
%TEMP%\7zS81BE8D72\CardReader\APBin\Rmb.exe
%TEMP%\7zS81BE8D72\CardReader\Utility\Display.ico
%TEMP%\7zS81BE8D72\CardReader\usetup.iss
%TEMP%\7zS81BE8D72\CardReader\u3setup.iss
%TEMP%\7zS81BE8D72\CardReader\u2setup.iss
%TEMP%\7zS81BE8D72\CardReader\setup.iss
%TEMP%\7zS81BE8D72\CardReader\setup.isn
%TEMP%\7zS81BE8D72\CardReader\setup.inx
%TEMP%\7zS81BE8D72\CardReader\setup.ini
%TEMP%\7zS81BE8D72\CardReader\readme.txt
%TEMP%\7zS81BE8D72\CardReader\pkgconf.ini
%TEMP%\7zS81BE8D72\CardReader\layout.bin
%TEMP%\7zS81BE8D72\CardReader\DrvBin64\RtsPStorMSI.inf
%TEMP%\7zS81BE8D72\CardReader\DrvBin64\RtsPStor64.cat
%TEMP%\7zS81BE8D72\CardReader\DrvBin32\RtsPStorMSI.inf
%TEMP%\7zS81BE8D72\CardReader\DrvBin32\RtsPStor32.cat
%TEMP%\7zS81BE8D72\CardReader\data2.cab
%TEMP%\7zS81BE8D72\CardReader\data1.hdr
%TEMP%\7zS81BE8D72\CardReader\data1.cab
%TEMP%\7zS81BE8D72\CardReader\APBin32\RIconMan.exe
%TEMP%\7zS81BE8D72\CardReader\APBin32\RsCRLib.dll
%TEMP%\7zS81BE8D72\CardReader\APBin\SetEHCIKey.exe
%TEMP%\7zS81BE8D72\CardReader\APBin64\RIconMan.exe
%TEMP%\{3C047337-CA66-459B-AA94-88BCA2A0F66A}\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\defa7545.rra
%TEMP%\7zS81BE8D72\CardReader\APBin64\RsCRLib.dll
%TEMP%\{3C047337-CA66-459B-AA94-88BCA2A0F66A}\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\isrt74e8.rra
%TEMP%\{3C047337-CA66-459B-AA94-88BCA2A0F66A}\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\Stri74a9.rra
%TEMP%\{3C047337-CA66-459B-AA94-88BCA2A0F66A}\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\VASD747a.rra
%TEMP%\{3C047337-CA66-459B-AA94-88BCA2A0F66A}\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\DIFx744b.rra
%TEMP%\{3C047337-CA66-459B-AA94-88BCA2A0F66A}\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\Font742c.rra
%TEMP%\{3C047337-CA66-459B-AA94-88BCA2A0F66A}\dotn73fd.rra
%TEMP%\{3C047337-CA66-459B-AA94-88BCA2A0F66A}\core73bf.rra
%TEMP%\{3C047337-CA66-459B-AA94-88BCA2A0F66A}\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\setu7351.rra
%TEMP%\70f0.rra
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING1.MAP
%WINDIR%\inf\oem3.inf
%TEMP%\7zS81BE8D72\CardReader\_Setup.dll
%TEMP%\7zS81BE8D72\CardReader\Utility\revcon64.exe
%TEMP%\7zS81BE8D72\CardReader\Utility\revcon32.exe
%TEMP%\7zS81BE8D72\CardReader\setup.exe
%TEMP%\7zS81BE8D72\CardReader\ISSetup.dll
%TEMP%\7zS81BE8D72\CardReader\DrvBin64\RtsPStorIcon.dll
%TEMP%\7zS81BE8D72\CardReader\DrvBin64\RtsPStor.sys
%TEMP%\7zS81BE8D72\CardReader\DrvBin32\SDRTCPRM.dll
%TEMP%\7zS81BE8D72\CardReader\DrvBin32\RtsPStorIcon.dll
%TEMP%\7zS81BE8D72\CardReader\DrvBin32\RtsPStor.sys
%TEMP%\{32E48D80-50BF-41CD-84A3-9C7D73199AE3}\setup.ini
%WINDIR%\inf\oem3.PNF

Присваивает атрибут 'скрытый' для следующих файлов:

<SYSTEM32>\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\oem3.CAT

Удаляет следующие файлы:

%ProgramFiles%\Realtek\Realtek Card Reader\SDRTCPRM.dll

Перемещает следующие файлы:

%TEMP%\{3C047337-CA66-459B-AA94-88BCA2A0F66A}\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\setu7351.rra в %TEMP%\{3C047337-CA66-459B-AA94-88BCA2A0F66A}\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\setup.inx
%ProgramFiles%\Realtek\Realtek Card Reader\conf8ab2.rra в %ProgramFiles%\Realtek\Realtek Card Reader\config.ini
%ProgramFiles%\Realtek\Realtek Card Reader\Rmb8ad1.rra в %ProgramFiles%\Realtek\Realtek Card Reader\Rmb.exe
%ProgramFiles%\Realtek\Realtek Card Reader\SetE8b4e.rra в %ProgramFiles%\Realtek\Realtek Card Reader\SetEHCIKey.exe
%ProgramFiles%\Realtek\Realtek Card Reader\Disp8b7d.rra в %ProgramFiles%\Realtek\Realtek Card Reader\Display.ico
%ProgramFiles%\Realtek\Realtek Card Reader\revc8bbb.rra в %ProgramFiles%\Realtek\Realtek Card Reader\revcon32.exe
%ProgramFiles%\Realtek\Realtek Card Reader\revc8bea.rra в %ProgramFiles%\Realtek\Realtek Card Reader\revcon64.exe
%ProgramFiles%\InstallShield Installation Information\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\pkgc8c58.rra в %ProgramFiles%\InstallShield Installation Information\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\pkgconf.ini
%TEMP%\{3C047337-CA66-459B-AA94-88BCA2A0F66A}\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\defa7545.rra в %TEMP%\{3C047337-CA66-459B-AA94-88BCA2A0F66A}\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\default.pal
%ProgramFiles%\InstallShield Installation Information\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\layoa6e4.rra в %ProgramFiles%\InstallShield Installation Information\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\layout.bin
%ProgramFiles%\InstallShield Installation Information\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\dataa6f4.rra в %ProgramFiles%\InstallShield Installation Information\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\data1.hdr
%ProgramFiles%\InstallShield Installation Information\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\dataa713.rra в %ProgramFiles%\InstallShield Installation Information\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\data1.cab
%ProgramFiles%\InstallShield Installation Information\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\setua85b.rra в %ProgramFiles%\InstallShield Installation Information\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\setup.exe
%ProgramFiles%\InstallShield Installation Information\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\_Seta8b9.rra в %ProgramFiles%\InstallShield Installation Information\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\_Setup.dll
%ProgramFiles%\InstallShield Installation Information\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\ISSea8f8.rra в %ProgramFiles%\InstallShield Installation Information\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\ISSetup.dll
%ProgramFiles%\Realtek\Realtek Card Reader\RsCR8a73.rra в %ProgramFiles%\Realtek\Realtek Card Reader\RsCRLib.dll
%ProgramFiles%\Realtek\Realtek Card Reader\RIco894a.rra в %ProgramFiles%\Realtek\Realtek Card Reader\RIconMan.exe
<DRIVERS>\RtsP88cd.rra в <DRIVERS>\RtsPStor.sys
%ProgramFiles%\Realtek\Realtek Card Reader\SDRT888f.rra в %ProgramFiles%\Realtek\Realtek Card Reader\SDRTCPRM.dll
%ProgramFiles%\Realtek\Realtek Card Reader\RtsP8850.rra в %ProgramFiles%\Realtek\Realtek Card Reader\RtsPStorMSI.inf
%ProgramFiles%\Realtek\Realtek Card Reader\RtsP8533.rra в %ProgramFiles%\Realtek\Realtek Card Reader\RtsPStorIcon.dll
%ProgramFiles%\Realtek\Realtek Card Reader\RtsP8514.rra в %ProgramFiles%\Realtek\Realtek Card Reader\RtsPStor32.cat
%ProgramFiles%\Realtek\Realtek Card Reader\RtsP84d6.rra в %ProgramFiles%\Realtek\Realtek Card Reader\RtsPStor.sys
%TEMP%\{3C047337-CA66-459B-AA94-88BCA2A0F66A}\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\_IsR7574.rra в %TEMP%\{3C047337-CA66-459B-AA94-88BCA2A0F66A}\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\_IsRes.dll
%ProgramFiles%\InstallShield Installation Information\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\uset8c29.rra в %ProgramFiles%\InstallShield Installation Information\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\usetup.iss
%TEMP%\{3C047337-CA66-459B-AA94-88BCA2A0F66A}\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\isrt74e8.rra в %TEMP%\{3C047337-CA66-459B-AA94-88BCA2A0F66A}\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\isrt.dll
%TEMP%\{3C047337-CA66-459B-AA94-88BCA2A0F66A}\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\Stri74a9.rra в %TEMP%\{3C047337-CA66-459B-AA94-88BCA2A0F66A}\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\StringTable-0009-English.ips
%TEMP%\{3C047337-CA66-459B-AA94-88BCA2A0F66A}\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\VASD747a.rra в %TEMP%\{3C047337-CA66-459B-AA94-88BCA2A0F66A}\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\VASData.ini
%TEMP%\{3C047337-CA66-459B-AA94-88BCA2A0F66A}\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\DIFx744b.rra в %TEMP%\{3C047337-CA66-459B-AA94-88BCA2A0F66A}\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\DIFxData.ini
%TEMP%\{3C047337-CA66-459B-AA94-88BCA2A0F66A}\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\Font742c.rra в %TEMP%\{3C047337-CA66-459B-AA94-88BCA2A0F66A}\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\FontData.ini
%TEMP%\{3C047337-CA66-459B-AA94-88BCA2A0F66A}\dotn73fd.rra в %TEMP%\{3C047337-CA66-459B-AA94-88BCA2A0F66A}\dotnetinstaller.exe
%TEMP%\{3C047337-CA66-459B-AA94-88BCA2A0F66A}\core73bf.rra в %TEMP%\{3C047337-CA66-459B-AA94-88BCA2A0F66A}\corecomp.ini
%ProgramFiles%\InstallShield Installation Information\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\setua946.rra в %ProgramFiles%\InstallShield Installation Information\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\setup.inx
%ProgramFiles%\InstallShield Installation Information\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\setua984.rra в %ProgramFiles%\InstallShield Installation Information\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\setup.ini

Подменяет следующие файлы:

%ProgramFiles%\Realtek\Realtek Card Reader\SDRTCPRM.dll

Другое:

Создает и запускает на исполнение:

'%TEMP%\7zS81BE8D72\CardReader\setup.exe'
'%ProgramFiles%\Realtek\Realtek Card Reader\revcon32.exe' RS_dp_add RtsPStorMSI.inf
'%ProgramFiles%\Realtek\Realtek Card Reader\revcon32.exe' RS_update RtsPStorMSI.inf PCI\VEN_10EC&DEV_5208&CC_FF00
'%ProgramFiles%\Realtek\Realtek Card Reader\revcon32.exe' RS_remove PCI\VEN_10EC&DEV_5208&CC_FF00
'%ProgramFiles%\Realtek\Realtek Card Reader\revcon32.exe' RS_update RtsPStorMSI.inf PCI\VEN_10EC&DEV_5209&CC_FF00
'%ProgramFiles%\Realtek\Realtek Card Reader\revcon32.exe' RS_remove PCI\VEN_10EC&DEV_5209&CC_FF00

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней