Trojan.MulDrop8.24980

Техническая информация

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\RarSFX0\setup.exe
C:\totalcmd\LANGUAGE\WCMD_ESP.MNU
C:\totalcmd\LANGUAGE\WCMD_ESP.LNG
C:\totalcmd\LANGUAGE\WCMD_ESP.INC
C:\totalcmd\LANGUAGE\WCMD_ENG.MNU
C:\totalcmd\LANGUAGE\WCMD_DUT.MNU
C:\totalcmd\LANGUAGE\WCMD_DUT.LNG
C:\totalcmd\LANGUAGE\WCMD_DUT.INC
C:\totalcmd\LANGUAGE\WCMD_DEU.MNU
C:\totalcmd\LANGUAGE\WCMD_DEU.LNG
C:\totalcmd\LANGUAGE\WCMD_DEU.INC
C:\totalcmd\LANGUAGE\WCMD_DAN.MNU
C:\totalcmd\LANGUAGE\WCMD_DAN.LNG
C:\totalcmd\LANGUAGE\WCMD_DAN.INC
C:\totalcmd\LANGUAGE\WCMD_CZ.MNU
C:\totalcmd\LANGUAGE\WCMD_CZ.LNG
C:\totalcmd\LANGUAGE\WCMD_CZ.INC
C:\totalcmd\LANGUAGE\WCMD_CHN.MNU
C:\totalcmd\LANGUAGE\WCMD_CHN.LNG
C:\totalcmd\LANGUAGE\WCMD_CHN.INC
C:\totalcmd\LANGUAGE\pluginst.inf
C:\totalcmd\WCMZIP32.DLL
C:\totalcmd\WCMICONS.DLL
C:\totalcmd\WC32TO16.EXE
C:\totalcmd\UNRAR.DLL
C:\totalcmd\UNACEV2.DLL
C:\totalcmd\TOTALCMD.EXE
C:\totalcmd\TOTALCMD.CHM
C:\totalcmd\LANGUAGE\WCMD_FRA.INC
C:\totalcmd\LANGUAGE\WCMD_FRA.LNG
C:\totalcmd\LANGUAGE\WCMD_FRA.MNU
C:\totalcmd\LANGUAGE\WCMD_HUN.INC
%APPDATA%\GHISLER\wincmd.ini
%ALLUSERSPROFILE%\Desktop\Total Commander.lnk
C:\totalcmd\LANGUAGE\Wcmd_tur.mnu
C:\totalcmd\LANGUAGE\Wcmd_tur.lng
C:\totalcmd\LANGUAGE\WCMD_SWE.MNU
C:\totalcmd\LANGUAGE\WCMD_SWE.LNG
C:\totalcmd\LANGUAGE\WCMD_SVN.MNU
C:\totalcmd\LANGUAGE\WCMD_SVN.LNG
C:\totalcmd\LANGUAGE\WCMD_SK.MNU
C:\totalcmd\LANGUAGE\WCMD_SK.LNG
C:\totalcmd\LANGUAGE\WCMD_RUS.MNU
C:\totalcmd\LANGUAGE\WCMD_RUS.LNG
C:\totalcmd\LANGUAGE\WCMD_RUS.INC
C:\totalcmd\LANGUAGE\WCMD_ROM.LNG
C:\totalcmd\LANGUAGE\WCMD_ROM.MNU
C:\totalcmd\LANGUAGE\WCMD_ROM.INC
C:\totalcmd\LANGUAGE\WCMD_POL.MNU
C:\totalcmd\LANGUAGE\WCMD_POL.LNG
C:\totalcmd\LANGUAGE\WCMD_NOR.MNU
C:\totalcmd\LANGUAGE\WCMD_NOR.LNG
C:\totalcmd\LANGUAGE\WCMD_KOR.MNU
C:\totalcmd\LANGUAGE\WCMD_KOR.LNG
C:\totalcmd\LANGUAGE\WCMD_KOR.INC
C:\totalcmd\LANGUAGE\WCMD_ITA.MNU
C:\totalcmd\LANGUAGE\WCMD_ITA.LNG
C:\totalcmd\LANGUAGE\WCMD_ITA.INC
C:\totalcmd\LANGUAGE\WCMD_HUN.MNU
C:\totalcmd\LANGUAGE\WCMD_HUN.LNG
%WINDIR%\Installer\22f76.msi
C:\totalcmd\TCUNZLIB.DLL
C:\totalcmd\TCUNINST.EXE
C:\totalcmd\TCMDX64.EXE
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING1.MAP
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING.VER
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\INDEX.MAP
%WINDIR%\Installer\MSI2.tmp
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\INDEX.BTR
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\$WinMgmt.CFG
%WINDIR%\Installer\22f74.ipi
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\domain.txt
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\ComDb.Dat
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SAM
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SYSTEM
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SOFTWARE
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SECURITY
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_.DEFAULT
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-21-2052111302-484763869-725345543-1003
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-21-2052111302-484763869-725345543-1003
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-20
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-20
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-19
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-19
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-18
%WINDIR%\Installer\22f72.msi
%TEMP%\{30D152F1-1974-42C3-8C50-B85B745E4345}\Total Commander.msi
%TEMP%\~1.tmp
%TEMP%\{30D152F1-1974-42C3-8C50-B85B745E4345}\0x0409.ini
%TEMP%\{30D152F1-1974-42C3-8C50-B85B745E4345}\_ISMSIDEL.INI
%TEMP%\{30D152F1-1974-42C3-8C50-B85B745E4345}\Setup.INI
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING2.MAP
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\OBJECTS.DATA
C:\Config.Msi\22f75.rbs
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\OBJECTS.MAP
C:\totalcmd\TCMADMIN.EXE
C:\totalcmd\SHARE_NT.EXE
C:\totalcmd\FRERES32.DLL
C:\totalcmd\CGLPTNT.SYS
C:\totalcmd\wincmd.key
C:\totalcmd\WCUNINST.WUL
C:\totalcmd\WCMICONS.INC
C:\totalcmd\TOTALCMD.INC
C:\totalcmd\TOTALCMD.EXE.MANIFEST
C:\totalcmd\TCUNINST.WUL
C:\totalcmd\SIZE!.TXT
C:\totalcmd\SFXHEAD.SFX
C:\totalcmd\REGISTER.RTF
C:\totalcmd\KEYBOARD.TXT
C:\totalcmd\NO.BAR
C:\totalcmd\HISTORY.TXT
C:\totalcmd\descript.ion
C:\totalcmd\default.br2
C:\totalcmd\DEFAULT.BAR
C:\totalcmd\CGLPT9X.VXD
C:\totalcmd\CABRK.DLL
%WINDIR%\UC.PIF
%WINDIR%\RAR.PIF
%WINDIR%\PKZIP.PIF
%WINDIR%\PKUNZIP.PIF
%WINDIR%\NOCLOSE.PIF
%WINDIR%\LHA.PIF
%WINDIR%\ARJ.PIF
C:\totalcmd\TCMDLZMA.DLL
%WINDIR%\Installer\{F1FFC930-1FB2-47BB-8397-BDE6DCE68BA0}\Icon_TOTALCMD.EXE

Удаляет следующие файлы:

%TEMP%\~1.tmp
%WINDIR%\Installer\MSI2.tmp
C:\Config.Msi\22f75.rbs
%WINDIR%\Installer\22f72.msi
%WINDIR%\Installer\22f74.ipi
%TEMP%\{30D152F1-1974-42C3-8C50-B85B745E4345}\0x0409.ini
%TEMP%\{30D152F1-1974-42C3-8C50-B85B745E4345}\Setup.INI
%TEMP%\{30D152F1-1974-42C3-8C50-B85B745E4345}\Total Commander.msi
%TEMP%\{30D152F1-1974-42C3-8C50-B85B745E4345}\_ISMSIDEL.INI
%TEMP%\RarSFX0\setup.exe

Другое:

Ищет следующие окна:

ClassName: 'EDIT' WindowName: ''

Создает и запускает на исполнение:

'%TEMP%\RarSFX0\setup.exe' /s /v"/qb"

Запускает на исполнение:

'<SYSTEM32>\msiexec.exe' /i "%TEMP%\{30D152F1-1974-42C3-8C50-B85B745E4345}\Total Commander.msi" /qb SETUPEXEDIR="%TEMP%\RarSFX0"
'<SYSTEM32>\msiexec.exe' /V