Trojan.MulDrop8.24614

Техническая информация

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\7zS82B7A332\W940LU\APBin\config.ini
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_.DEFAULT
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-21-2052111302-484763869-725345543-1003
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-21-2052111302-484763869-725345543-1003
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-20
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-20
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-19
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-19
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-18
%ProgramFiles%\InstallShield Installation Information\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\pkgc523d.rra
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SECURITY
%ProgramFiles%\InstallShield Installation Information\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\uset522d.rra
%ProgramFiles%\Realtek\Realtek Card Reader\revc51cf.rra
%ProgramFiles%\Realtek\Realtek Card Reader\Disp5181.rra
<DRIVERS>\RtsP5114.rra
%ProgramFiles%\Realtek\Realtek Card Reader\SDRT50e5.rra
%ProgramFiles%\Realtek\Realtek Card Reader\rtsp50c6.rra
%ProgramFiles%\Realtek\Realtek Card Reader\RtsP5077.rra
%ProgramFiles%\Realtek\Realtek Card Reader\RtsP5058.rra
%ProgramFiles%\Realtek\Realtek Card Reader\RsCR4d99.rra
%ProgramFiles%\Realtek\Realtek Card Reader\SetE4d5b.rra
%ProgramFiles%\Realtek\Realtek Card Reader\revc51ee.rra
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING1.MAP
%WINDIR%\inf\oem3.inf
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SAM
<SYSTEM32>\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\oem3.CAT
%ProgramFiles%\InstallShield Installation Information\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\setup.ini
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\OBJECTS.MAP
%ProgramFiles%\InstallShield Installation Information\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\setu6d56.rra
%ProgramFiles%\InstallShield Installation Information\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\setu6d27.rra
%ProgramFiles%\InstallShield Installation Information\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\ISSe6cd9.rra
%ProgramFiles%\InstallShield Installation Information\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\_Set6c9b.rra
%ProgramFiles%\InstallShield Installation Information\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\setu6c4c.rra
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\OBJECTS.DATA
%ProgramFiles%\Realtek\Realtek Card Reader\SDRT4d3b.rra
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING2.MAP
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING.VER
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\INDEX.MAP
%ProgramFiles%\InstallShield Installation Information\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\data6b24.rra
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\INDEX.BTR
%ProgramFiles%\InstallShield Installation Information\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\data6b04.rra
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\$WinMgmt.CFG
%ProgramFiles%\InstallShield Installation Information\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\layo6ae5.rra
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\domain.txt
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\ComDb.Dat
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SOFTWARE
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SYSTEM
%ProgramFiles%\Realtek\Realtek Card Reader\Rmb4ced.rra
%TEMP%\7zS82B7A332\W940LU\DrvBin32\RtsPer.sys
%TEMP%\7zS82B7A332\W940LU\APBin\SDRTCPRM.dll
%TEMP%\7zS82B7A332\W940LU\APBin\Rmb.exe
%TEMP%\7zS82B7A332\W940LU\Utility\Display.ico
%TEMP%\7zS82B7A332\W940LU\usetup.iss
%TEMP%\7zS82B7A332\W940LU\u3setup.iss
%TEMP%\7zS82B7A332\W940LU\u2setup.iss
%TEMP%\7zS82B7A332\W940LU\setup.iss
%TEMP%\7zS82B7A332\W940LU\setup.isn
%TEMP%\7zS82B7A332\W940LU\setup.inx
%TEMP%\7zS82B7A332\W940LU\APBin\SetEHCIKey.exe
%TEMP%\7zS82B7A332\W940LU\setup.ini
%TEMP%\7zS82B7A332\W940LU\pkgconf.ini
%TEMP%\7zS82B7A332\W940LU\layout.bin
%TEMP%\7zS82B7A332\W940LU\DrvBin64\rtsper64.cat
%TEMP%\7zS82B7A332\W940LU\DrvBin64\RtsPer.inf
%TEMP%\7zS82B7A332\W940LU\DrvBin32\rtsper32.cat
%TEMP%\7zS82B7A332\W940LU\DrvBin32\RtsPer.inf
%TEMP%\7zS82B7A332\W940LU\data2.cab
%TEMP%\7zS82B7A332\W940LU\data1.hdr
%TEMP%\7zS82B7A332\W940LU\data1.cab
%TEMP%\7zS82B7A332\W940LU\readme.txt
%TEMP%\383c.rra
%TEMP%\{5D229997-2E55-4FF5-BF7C-FA59271522CF}\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\_IsR3c34.rra
%TEMP%\7zS82B7A332\W940LU\DrvBin32\SDRTCPRM.dll
%TEMP%\{5D229997-2E55-4FF5-BF7C-FA59271522CF}\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\defa3c15.rra
%TEMP%\{5D229997-2E55-4FF5-BF7C-FA59271522CF}\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\isrt3bd6.rra
%TEMP%\{5D229997-2E55-4FF5-BF7C-FA59271522CF}\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\Stri3ba7.rra
%TEMP%\{5D229997-2E55-4FF5-BF7C-FA59271522CF}\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\VASD3b88.rra
%TEMP%\{5D229997-2E55-4FF5-BF7C-FA59271522CF}\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\DIFx3b69.rra
%TEMP%\{5D229997-2E55-4FF5-BF7C-FA59271522CF}\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\Font3b4a.rra
%TEMP%\{5D229997-2E55-4FF5-BF7C-FA59271522CF}\dotn3b1b.rra
%TEMP%\{5D229997-2E55-4FF5-BF7C-FA59271522CF}\core3aec.rra
%TEMP%\{5D229997-2E55-4FF5-BF7C-FA59271522CF}\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\Hide3a9e.rra
%ProgramFiles%\Realtek\Realtek Card Reader\conf4cde.rra
%TEMP%\{5D229997-2E55-4FF5-BF7C-FA59271522CF}\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\setu3a50.rra
%TEMP%\{E693A30A-84B7-4006-A511-B72F3605B46C}\setup.ini
%TEMP%\{E693A30A-84B7-4006-A511-B72F3605B46C}\_Setup.dll
%TEMP%\7zS82B7A332\W940LU\_Setup.dll
%TEMP%\7zS82B7A332\W940LU\Utility\revcon64.exe
%TEMP%\7zS82B7A332\W940LU\Utility\revcon32.exe
%TEMP%\7zS82B7A332\W940LU\setup.exe
%TEMP%\7zS82B7A332\W940LU\ISSetup.dll
%TEMP%\7zS82B7A332\W940LU\DrvBin64\RtsPer.sys
%TEMP%\7zS82B7A332\W940LU\DrvBin64\RsCRIcon.dll
%TEMP%\7zS82B7A332\W940LU\DrvBin32\RsCRIcon.dll
%WINDIR%\inf\oem3.PNF

Присваивает атрибут 'скрытый' для следующих файлов:

<SYSTEM32>\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\oem3.CAT

Удаляет следующие файлы:

%ProgramFiles%\Realtek\Realtek Card Reader\SDRTCPRM.dll

Перемещает следующие файлы:

%TEMP%\{5D229997-2E55-4FF5-BF7C-FA59271522CF}\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\setu3a50.rra в %TEMP%\{5D229997-2E55-4FF5-BF7C-FA59271522CF}\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\setup.inx
%ProgramFiles%\InstallShield Installation Information\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\ISSe6cd9.rra в %ProgramFiles%\InstallShield Installation Information\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\ISSetup.dll
%ProgramFiles%\InstallShield Installation Information\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\_Set6c9b.rra в %ProgramFiles%\InstallShield Installation Information\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\_Setup.dll
%ProgramFiles%\InstallShield Installation Information\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\setu6c4c.rra в %ProgramFiles%\InstallShield Installation Information\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\setup.exe
%ProgramFiles%\InstallShield Installation Information\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\data6b24.rra в %ProgramFiles%\InstallShield Installation Information\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\data1.cab
%ProgramFiles%\InstallShield Installation Information\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\data6b04.rra в %ProgramFiles%\InstallShield Installation Information\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\data1.hdr
%ProgramFiles%\InstallShield Installation Information\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\layo6ae5.rra в %ProgramFiles%\InstallShield Installation Information\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\layout.bin
%ProgramFiles%\InstallShield Installation Information\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\pkgc523d.rra в %ProgramFiles%\InstallShield Installation Information\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\pkgconf.ini
%ProgramFiles%\InstallShield Installation Information\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\uset522d.rra в %ProgramFiles%\InstallShield Installation Information\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\usetup.iss
%ProgramFiles%\Realtek\Realtek Card Reader\revc51ee.rra в %ProgramFiles%\Realtek\Realtek Card Reader\revcon64.exe
%ProgramFiles%\Realtek\Realtek Card Reader\revc51cf.rra в %ProgramFiles%\Realtek\Realtek Card Reader\revcon32.exe
%ProgramFiles%\Realtek\Realtek Card Reader\Disp5181.rra в %ProgramFiles%\Realtek\Realtek Card Reader\Display.ico
<DRIVERS>\RtsP5114.rra в <DRIVERS>\RtsPer.sys
%ProgramFiles%\Realtek\Realtek Card Reader\rtsp50c6.rra в %ProgramFiles%\Realtek\Realtek Card Reader\rtsper32.cat
%ProgramFiles%\Realtek\Realtek Card Reader\RtsP5077.rra в %ProgramFiles%\Realtek\Realtek Card Reader\RtsPer.sys
%ProgramFiles%\InstallShield Installation Information\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\setu6d27.rra в %ProgramFiles%\InstallShield Installation Information\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\setup.inx
%ProgramFiles%\Realtek\Realtek Card Reader\RtsP5058.rra в %ProgramFiles%\Realtek\Realtek Card Reader\RtsPer.inf
%ProgramFiles%\Realtek\Realtek Card Reader\SetE4d5b.rra в %ProgramFiles%\Realtek\Realtek Card Reader\SetEHCIKey.exe
%ProgramFiles%\Realtek\Realtek Card Reader\SDRT4d3b.rra в %ProgramFiles%\Realtek\Realtek Card Reader\SDRTCPRM.dll
%ProgramFiles%\Realtek\Realtek Card Reader\Rmb4ced.rra в %ProgramFiles%\Realtek\Realtek Card Reader\Rmb.exe
%ProgramFiles%\Realtek\Realtek Card Reader\conf4cde.rra в %ProgramFiles%\Realtek\Realtek Card Reader\config.ini
%TEMP%\{5D229997-2E55-4FF5-BF7C-FA59271522CF}\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\_IsR3c34.rra в %TEMP%\{5D229997-2E55-4FF5-BF7C-FA59271522CF}\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\_IsRes.dll
%TEMP%\{5D229997-2E55-4FF5-BF7C-FA59271522CF}\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\defa3c15.rra в %TEMP%\{5D229997-2E55-4FF5-BF7C-FA59271522CF}\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\default.pal
%TEMP%\{5D229997-2E55-4FF5-BF7C-FA59271522CF}\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\isrt3bd6.rra в %TEMP%\{5D229997-2E55-4FF5-BF7C-FA59271522CF}\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\isrt.dll
%TEMP%\{5D229997-2E55-4FF5-BF7C-FA59271522CF}\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\Stri3ba7.rra в %TEMP%\{5D229997-2E55-4FF5-BF7C-FA59271522CF}\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\StringTable-0009-English.ips
%TEMP%\{5D229997-2E55-4FF5-BF7C-FA59271522CF}\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\VASD3b88.rra в %TEMP%\{5D229997-2E55-4FF5-BF7C-FA59271522CF}\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\VASData.ini
%TEMP%\{5D229997-2E55-4FF5-BF7C-FA59271522CF}\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\DIFx3b69.rra в %TEMP%\{5D229997-2E55-4FF5-BF7C-FA59271522CF}\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\DIFxData.ini
%TEMP%\{5D229997-2E55-4FF5-BF7C-FA59271522CF}\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\Font3b4a.rra в %TEMP%\{5D229997-2E55-4FF5-BF7C-FA59271522CF}\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\FontData.ini
%TEMP%\{5D229997-2E55-4FF5-BF7C-FA59271522CF}\dotn3b1b.rra в %TEMP%\{5D229997-2E55-4FF5-BF7C-FA59271522CF}\dotnetinstaller.exe
%TEMP%\{5D229997-2E55-4FF5-BF7C-FA59271522CF}\core3aec.rra в %TEMP%\{5D229997-2E55-4FF5-BF7C-FA59271522CF}\corecomp.ini
%TEMP%\{5D229997-2E55-4FF5-BF7C-FA59271522CF}\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\Hide3a9e.rra в %TEMP%\{5D229997-2E55-4FF5-BF7C-FA59271522CF}\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\HideSetupWizard.dll
%ProgramFiles%\Realtek\Realtek Card Reader\RsCR4d99.rra в %ProgramFiles%\Realtek\Realtek Card Reader\RsCRIcon.dll
%ProgramFiles%\InstallShield Installation Information\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\setu6d56.rra в %ProgramFiles%\InstallShield Installation Information\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\setup.ini

Подменяет следующие файлы:

%ProgramFiles%\Realtek\Realtek Card Reader\SDRTCPRM.dll

Другое:

Создает и запускает на исполнение:

'%TEMP%\7zS82B7A332\W940LU\setup.exe'
'%ProgramFiles%\Realtek\Realtek Card Reader\revcon32.exe' RS_dp_add RtsPer.inf
'%ProgramFiles%\Realtek\Realtek Card Reader\revcon32.exe' RS_update RtsPer.inf PCI\VEN_10EC&DEV_5227&CC_FF00
'%ProgramFiles%\Realtek\Realtek Card Reader\revcon32.exe' RS_remove PCI\VEN_10EC&DEV_5227&CC_FF00
'%ProgramFiles%\Realtek\Realtek Card Reader\revcon32.exe' RS_update RtsPer.inf PCI\VEN_10EC&DEV_5249&CC_FF00
'%ProgramFiles%\Realtek\Realtek Card Reader\revcon32.exe' RS_remove PCI\VEN_10EC&DEV_5249&CC_FF00

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней