Trojan.MulDrop8.25549

Техническая информация

Для обеспечения автозапуска и распространения:

Создает следующие сервисы:

[<HKLM>\SYSTEM\ControlSet001\Services\bcmwlPortAccessDriver] 'Start' = '00000002'
[<HKLM>\SYSTEM\ControlSet001\Services\bcmwlPortAccessDriver] 'ImagePath' = '%TEMP%\bcmwlNTP.sys'

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\7zS81B6BCC1\WLAN_Broadcom(802.11b+g)_3.100.46.0_XPx86\bcm42rly.vxd
%TEMP%\7zS81B6BCC1\WLAN_Broadcom(802.11b+g)_3.100.46.0_XPx86\bcmwlu00.exe
%TEMP%\7zS81B6BCC1\WLAN_Broadcom(802.11b+g)_3.100.46.0_XPx86\is.exe
%TEMP%\7zS81B6BCC1\WLAN_Broadcom(802.11b+g)_3.100.46.0_XPx86\MFC42.DLL
%TEMP%\7zS81B6BCC1\WLAN_Broadcom(802.11b+g)_3.100.46.0_XPx86\MFC42U.DLL
%TEMP%\7zS81B6BCC1\WLAN_Broadcom(802.11b+g)_3.100.46.0_XPx86\MSVCP60.DLL
%TEMP%\7zS81B6BCC1\WLAN_Broadcom(802.11b+g)_3.100.46.0_XPx86\MSVCRT.DLL
%TEMP%\7zS81B6BCC1\WLAN_Broadcom(802.11b+g)_3.100.46.0_XPx86\setup.exe
%TEMP%\7zS81B6BCC1\WLAN_Broadcom(802.11b+g)_3.100.46.0_XPx86\wltray.exe
%TEMP%\7zS81B6BCC1\WLAN_Broadcom(802.11b+g)_3.100.46.0_XPx86\wltrynt.dll
%TEMP%\7zS81B6BCC1\WLAN_Broadcom(802.11b+g)_3.100.46.0_XPx86\wltrysvc.exe
%TEMP%\IEC1.tmp
%TEMP%\7zS81B6BCC1\WLAN_Broadcom(802.11b+g)_3.100.46.0_XPx86\layout.bin
%CommonProgramFiles%\InstallShield\Engine\6\Intel 32\temp.000
%CommonProgramFiles%\InstallShield\Engine\6\Intel 32\core2159.rra
%CommonProgramFiles%\InstallShield\Engine\6\Intel 32\ctor21b7.rra
%CommonProgramFiles%\InstallShield\Engine\6\Intel 32\obje231e.rra
%CommonProgramFiles%\InstallShield\Engine\6\Intel 32\iuse239b.rra
%CommonProgramFiles%\InstallShield\IScript\iscr2551.rra
%TEMP%\{F16DD1B4-4933-4019-BC07-A9BF18830338}\setu2d11.rra
%TEMP%\{F16DD1B4-4933-4019-BC07-A9BF18830338}\valu2ddc.rra
%TEMP%\{F16DD1B4-4933-4019-BC07-A9BF18830338}\isrt2e3a.rra
%TEMP%\{F16DD1B4-4933-4019-BC07-A9BF18830338}\defa2e98.rra
%TEMP%\{F16DD1B4-4933-4019-BC07-A9BF18830338}\_IsR2ee6.rra
%WINDIR%\bcmwl.DMS
%TEMP%\7zS81B6BCC1\WLAN_Broadcom(802.11b+g)_3.100.46.0_XPx86\bcmwlntp.sys
%TEMP%\7zS81B6BCC1\WLAN_Broadcom(802.11b+g)_3.100.46.0_XPx86\bcmwltry.exe
%TEMP%\7zS81B6BCC1\WLAN_Broadcom(802.11b+g)_3.100.46.0_XPx86\bcmwlhom.exe
%TEMP%\7zS81B6BCC1\WLAN_Broadcom(802.11b+g)_3.100.46.0_XPx86\BCMWLD9X.EXE
%TEMP%\7zS81B6BCC1\WLAN_Broadcom(802.11b+g)_3.100.46.0_XPx86\bcmwld2k.exe
%TEMP%\7zS81B6BCC1\WLAN_Broadcom(802.11b+g)_3.100.46.0_XPx86\bcm43xxa.cat
%TEMP%\7zS81B6BCC1\WLAN_Broadcom(802.11b+g)_3.100.46.0_XPx86\BCMLogo.gif
%TEMP%\7zS81B6BCC1\WLAN_Broadcom(802.11b+g)_3.100.46.0_XPx86\bcmwl5.inf
%TEMP%\7zS81B6BCC1\WLAN_Broadcom(802.11b+g)_3.100.46.0_XPx86\bcmwl5a.inf
%TEMP%\7zS81B6BCC1\WLAN_Broadcom(802.11b+g)_3.100.46.0_XPx86\bcmwlcpl.cpl
%TEMP%\7zS81B6BCC1\WLAN_Broadcom(802.11b+g)_3.100.46.0_XPx86\bcmwlhlp.chm
%TEMP%\7zS81B6BCC1\WLAN_Broadcom(802.11b+g)_3.100.46.0_XPx86\bcmwlhom.ini
%TEMP%\7zS81B6BCC1\WLAN_Broadcom(802.11b+g)_3.100.46.0_XPx86\data1.cab
%TEMP%\7zS81B6BCC1\WLAN_Broadcom(802.11b+g)_3.100.46.0_XPx86\data1.hdr
%TEMP%\7zS81B6BCC1\WLAN_Broadcom(802.11b+g)_3.100.46.0_XPx86\data2.cab
%TEMP%\7zS81B6BCC1\WLAN_Broadcom(802.11b+g)_3.100.46.0_XPx86\ikernel.ex_
%TEMP%\bcmwlNTP.sys
%TEMP%\1dcf.rra
%TEMP%\7zS81B6BCC1\WLAN_Broadcom(802.11b+g)_3.100.46.0_XPx86\launcher.ini
%TEMP%\7zS81B6BCC1\WLAN_Broadcom(802.11b+g)_3.100.46.0_XPx86\ReleaseNotes.html
%TEMP%\7zS81B6BCC1\WLAN_Broadcom(802.11b+g)_3.100.46.0_XPx86\Setup.ini
%TEMP%\7zS81B6BCC1\WLAN_Broadcom(802.11b+g)_3.100.46.0_XPx86\setup.inx
%TEMP%\7zS81B6BCC1\WLAN_Broadcom(802.11b+g)_3.100.46.0_XPx86\Setup.iss
%TEMP%\7zS81B6BCC1\WLAN_Broadcom(802.11b+g)_3.100.46.0_XPx86\vssver.scc
%TEMP%\7zS81B6BCC1\WLAN_Broadcom(802.11b+g)_3.100.46.0_XPx86\AegisE2.dll
%TEMP%\7zS81B6BCC1\WLAN_Broadcom(802.11b+g)_3.100.46.0_XPx86\AegisE5.dll
%TEMP%\7zS81B6BCC1\WLAN_Broadcom(802.11b+g)_3.100.46.0_XPx86\AegisI2.exe
%TEMP%\7zS81B6BCC1\WLAN_Broadcom(802.11b+g)_3.100.46.0_XPx86\AegisI5.exe
%TEMP%\7zS81B6BCC1\WLAN_Broadcom(802.11b+g)_3.100.46.0_XPx86\BCMLogon.dll
%TEMP%\7zS81B6BCC1\WLAN_Broadcom(802.11b+g)_3.100.46.0_XPx86\bcmwl5.sys
%TEMP%\7zS81B6BCC1\WLAN_Broadcom(802.11b+g)_3.100.46.0_XPx86\bcm43xx.cat
%TEMP%\7zS81B6BCC1\WLAN_Broadcom(802.11b+g)_3.100.46.0_XPx86\mdc.jpg
%WINDIR%\bcmwl.DMR

Удаляет следующие файлы:

%TEMP%\IEC1.tmp
%TEMP%\bcmwlNTP.sys
%WINDIR%\bcmwl.DMR
%WINDIR%\bcmwl.DMS

Перемещает следующие файлы:

%CommonProgramFiles%\InstallShield\Engine\6\Intel 32\temp.000 в %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\IKernel.exe
%CommonProgramFiles%\InstallShield\Engine\6\Intel 32\core2159.rra в %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\corecomp.ini
%CommonProgramFiles%\InstallShield\Engine\6\Intel 32\ctor21b7.rra в %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\ctor.dll
%CommonProgramFiles%\InstallShield\Engine\6\Intel 32\obje231e.rra в %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\objectps.dll
%CommonProgramFiles%\InstallShield\Engine\6\Intel 32\iuse239b.rra в %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\iuser.dll
%CommonProgramFiles%\InstallShield\IScript\iscr2551.rra в %CommonProgramFiles%\InstallShield\IScript\iscript.dll
%TEMP%\{F16DD1B4-4933-4019-BC07-A9BF18830338}\setu2d11.rra в %TEMP%\{F16DD1B4-4933-4019-BC07-A9BF18830338}\setup.inx
%TEMP%\{F16DD1B4-4933-4019-BC07-A9BF18830338}\valu2ddc.rra в %TEMP%\{F16DD1B4-4933-4019-BC07-A9BF18830338}\value.shl
%TEMP%\{F16DD1B4-4933-4019-BC07-A9BF18830338}\isrt2e3a.rra в %TEMP%\{F16DD1B4-4933-4019-BC07-A9BF18830338}\isrt.dll
%TEMP%\{F16DD1B4-4933-4019-BC07-A9BF18830338}\defa2e98.rra в %TEMP%\{F16DD1B4-4933-4019-BC07-A9BF18830338}\default.pal
%TEMP%\{F16DD1B4-4933-4019-BC07-A9BF18830338}\_IsR2ee6.rra в %TEMP%\{F16DD1B4-4933-4019-BC07-A9BF18830338}\_IsRes.dll

Другое:

Создает и запускает на исполнение:

'%TEMP%\7zS81B6BCC1\WLAN_Broadcom(802.11b+g)_3.100.46.0_XPx86\setup.exe'
'%TEMP%\7zS81B6BCC1\WLAN_Broadcom(802.11b+g)_3.100.46.0_XPx86\is.exe' -x -l0x9
'%CommonProgramFiles%\InstallShield\Engine\6\Intel 32\IKernel.exe' -RegServer
'%CommonProgramFiles%\InstallShield\Engine\6\Intel 32\IKernel.exe' 32\IKernel.exe -Embedding
'%CommonProgramFiles%\InstallShield\Engine\6\Intel 32\IKernel.exe' /REGSERVER
'%TEMP%\7zS81B6BCC1\WLAN_Broadcom(802.11b+g)_3.100.46.0_XPx86\bcmwld2k.exe' count