Trojan.MulDrop8.26262

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKLM>\SOFTWARE\Classes\PROTOCOLS\Handler\touchenex] 'CLSID' = '{75923a1e-997c-11e5-9a19-005056c00008}'

Изменения в файловой системе:

Создает следующие файлы:

%ProgramFiles%\KeySharp\KSCertRelayMain.dll
%ProgramFiles%\KeySharp\kscertrelay\KSCrc2ActiveX.dll
%ProgramFiles%\KeySharp\kscertrelay\SetupProgram.exe
%ProgramFiles%\KeySharp\kscertrelay\CKSetup32.exe
%ProgramFiles%\KeySharp\kscertrelay\TouchEnKeyCS.dll
%ProgramFiles%\KeySharp\kscertrelay\KeySharpCrypto.dll
%ProgramFiles%\KeySharp\kscertrelay\KSCertRelayQr.exe
%ProgramFiles%\KeySharp\kscertrelay\QRCodeEncodeDLL.dll
%ProgramFiles%\KeySharp\kscertrelay\ca.der
%ProgramFiles%\KeySharp\kscertrelay\certadm.dll
%ProgramFiles%\KeySharp\kscertrelay\npKSCertRelay.dll
%ProgramFiles%\RaonSecure\bridge\CrossEX\touchenex\1.0.1.845\kr.co.raon.touchenex.json
%ProgramFiles%\KeySharp\kscertrelay\crc2String_eng.dll
%ProgramFiles%\KeySharp\kscertrelay\crc2String_kor.dll
%ProgramFiles%\KeySharp\kscertrelay\KSCertRelayDll.dll
%TEMP%\nsb3.tmp\System.dll
%ProgramFiles%\RaonSecure\bridge\CrossEX\touchenex\1.0.1.845\CrossEXProtocol.dll
%ProgramFiles%\RaonSecure\bridge\CrossEX\touchenex\1.0.1.845\CrossEXChrome.exe
%ProgramFiles%\RaonSecure\bridge\CrossEX\touchenex\1.0.1.845\CrossEXFirefox.dll
%ProgramFiles%\RaonSecure\bridge\CrossEX\touchenex\1.0.1.845\npraontouchenex.dll
%ProgramFiles%\RaonSecure\bridge\CrossEX\touchenex\1.0.1.845\CrossEX.sig
%ProgramFiles%\KeySharp\kscertrelay\KSCertRelay.exe
%ProgramFiles%\KeySharp\kscertrelay\certutil.exe
%ProgramFiles%\KeySharp\KSCertRelayDll.dll
%ProgramFiles%\KeySharp\KSCrc2ActiveX.dll
%ProgramFiles%\KeySharp\KSCertRelay_Installer_32bit.exe
%ProgramFiles%\KeySharp\raon_touchenex_Install.exe
%ProgramFiles%\KeySharp\KSCertRelay_NXInstaller.exe
%ProgramFiles%\KeySharp\CrossEX_LocalService_Install.exe
%ProgramFiles%\RaonSecure\KeySharp nxWireless Cert\KSCertRelayMain.dll
%ProgramFiles%\RaonSecure\KeySharp nxWireless Cert\KSCertRelay_Installer_32bit.exe
%ProgramFiles%\RaonSecure\KeySharp nxWireless Cert\raon_touchenex_Install.exe
%ProgramFiles%\RaonSecure\KeySharp nxWireless Cert\CrossEX_LocalService_Install.exe
%ProgramFiles%\KeySharp\KSCertRelay.exe
%ProgramFiles%\KeySharp\CKSetup32.exe
%ProgramFiles%\KeySharp\crc2String_eng.dll
%ProgramFiles%\KeySharp\TouchEnKeyCS.dll
%ProgramFiles%\KeySharp\KSCertRelayQr.exe
%ProgramFiles%\KeySharp\SetupProgram.exe
%ProgramFiles%\KeySharp\KeySharpCrypto.dll
%ProgramFiles%\KeySharp\QRCodeEncodeDLL.dll
%ProgramFiles%\KeySharp\ca.der
%ProgramFiles%\KeySharp\certadm.dll
%ProgramFiles%\KeySharp\certutil.exe
%ProgramFiles%\KeySharp\npKSCertRelay.dll
%ProgramFiles%\KeySharp\crc2String_kor.dll
%ProgramFiles%\RaonSecure\bridge\CrossEX\touchenex\UnInstallCrossEX.exe

Удаляет следующие файлы:

%ProgramFiles%\KeySharp\KSCertRelay.exe
%ProgramFiles%\RaonSecure\KeySharp nxWireless Cert\raon_touchenex_Install.exe
%TEMP%\nsb3.tmp\System.dll
%ProgramFiles%\KeySharp\KSCertRelayDll.dll
%ProgramFiles%\KeySharp\crc2String_kor.dll
%ProgramFiles%\KeySharp\crc2String_eng.dll
%ProgramFiles%\KeySharp\npKSCertRelay.dll
%ProgramFiles%\KeySharp\certutil.exe
%ProgramFiles%\RaonSecure\KeySharp nxWireless Cert\KSCertRelay_Installer_32bit.exe
%ProgramFiles%\KeySharp\certadm.dll
%ProgramFiles%\KeySharp\QRCodeEncodeDLL.dll
%ProgramFiles%\KeySharp\KeySharpCrypto.dll
%ProgramFiles%\KeySharp\SetupProgram.exe
%ProgramFiles%\KeySharp\KSCertRelayQr.exe
%ProgramFiles%\KeySharp\TouchEnKeyCS.dll
%ProgramFiles%\KeySharp\CKSetup32.exe
%ProgramFiles%\KeySharp\KSCrc2ActiveX.dll
%ProgramFiles%\KeySharp\ca.der
%ProgramFiles%\RaonSecure\KeySharp nxWireless Cert\CrossEX_LocalService_Install.exe

Другое:

Создает и запускает на исполнение:

'%ProgramFiles%\KeySharp\KSCertRelay_NXInstaller.exe' -i c
'%ProgramFiles%\RaonSecure\KeySharp nxWireless Cert\KSCertRelay_Installer_32bit.exe' /s
'%ProgramFiles%\KeySharp\SetupProgram.exe' -i c u
'%ProgramFiles%\RaonSecure\KeySharp nxWireless Cert\raon_touchenex_Install.exe' /S