Trojan.MulDrop8.26299

Техническая информация

Вредоносные функции:

Запускает на исполнение:

'<SYSTEM32>\taskkill.exe' /F /IM AirExplorer.exe
'<SYSTEM32>\taskkill.exe' /F /IM AirExplorerCmd.exe

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\1.tmp\2.bat
%ProgramFiles%\AirExplorer\Language\airexplorer_tr-TR.xml
%ProgramFiles%\AirExplorer\Language\airexplorer_sv-SE.xml
%ProgramFiles%\AirExplorer\Language\airexplorer_sk-SK.xml
%ProgramFiles%\AirExplorer\Language\airexplorer_ru-RU.xml
%ProgramFiles%\AirExplorer\Language\airexplorer_ro-RO.xml
%ProgramFiles%\AirExplorer\Language\airexplorer_pt-BR.xml
%ProgramFiles%\AirExplorer\Language\airexplorer_pl-PL.xml
%ProgramFiles%\AirExplorer\Language\airexplorer_nl-NL.xml
%ProgramFiles%\AirExplorer\Language\airexplorer_he-IL.xml
%ProgramFiles%\AirExplorer\Language\airexplorer_nb-NO.xml
%ProgramFiles%\AirExplorer\Language\airexplorer_mfe.xml
%ProgramFiles%\AirExplorer\Language\airexplorer_lt-Lt.xml
%ProgramFiles%\AirExplorer\Language\airexplorer_ko-KR.xml
%ProgramFiles%\AirExplorer\Language\airexplorer_ja-JP.xml
%ProgramFiles%\AirExplorer\Language\airexplorer_it-IT.xml
%ProgramFiles%\AirExplorer\Language\airexplorer_id-ID.xml
%ProgramFiles%\AirExplorer\Language\airexplorer_hy-am.xml
%ProgramFiles%\AirExplorer\Language\airexplorer_hu-HU.xml
%ProgramFiles%\AirExplorer\Language\airexplorer_ms-MY.xml
%ProgramFiles%\AirExplorer\Language\airexplorer_hr-HR.xml
%ProgramFiles%\AirExplorer\Language\airexplorer_uk-UA.xml
%ProgramFiles%\AirExplorer\Plugins\Baidu\CloudBaidu.dll
%ProgramFiles%\AirExplorer\Plugins\Naver\CloudNaver.dll
%ProgramFiles%\AirExplorer\Plugins\SFTP\CloudSFTP.dll
%ProgramFiles%\AirExplorer\Plugins\MailRu\CloudMailRu.dll
%ProgramFiles%\AirExplorer\Plugins\OneDriveForBusiness\CloudOneDriveForBusiness.dll
%ProgramFiles%\AirExplorer\Plugins\PCloud\CloudPCloud.dll
%ProgramFiles%\AirExplorer\Plugins\HiDrive\CloudHiDrive.dll
%ProgramFiles%\AirExplorer\Plugins\Amazon\CloudAmazon.dll
%ProgramFiles%\AirExplorer\Plugins\FTP\CloudFTP.dll
%ProgramFiles%\AirExplorer\Language\airexplorer_zh-CN.xml
%ProgramFiles%\AirExplorer\Language\airexplorer_vi-VN.xml
%ProgramFiles%\AirExplorer\Plugins\WebDav\CloudWebDav.dll
%ProgramFiles%\AirExplorer\Plugins\OneDrive\CloudOneDrive.dll
%ProgramFiles%\AirExplorer\Plugins\Mega\CloudMega.dll
%ProgramFiles%\AirExplorer\Plugins\MediaFire\CloudMediaFire.dll
%ProgramFiles%\AirExplorer\Plugins\GoogleDrive\CloudGoogleDrive.dll
%ProgramFiles%\AirExplorer\Plugins\DropBox\CloudDropBox.dll
%ProgramFiles%\AirExplorer\Plugins\Boxcom\CloudBoxcom.dll
%ProgramFiles%\AirExplorer\Language\airexplorer_zh-TW.xml
%ProgramFiles%\AirExplorer\Plugins\4Shared\Cloud4Shared.dll
%ProgramFiles%\AirExplorer\Language\airexplorer_fr-FR.xml
%ProgramFiles%\AirExplorer\Language\airexplorer_es-ES.xml
%ProgramFiles%\AirExplorer\Language\airexplorer_en-US.xml
%TEMP%\1.tmp\crack\Plugins\OneDriveForBusiness\CloudOneDriveForBusiness.dll
%TEMP%\1.tmp\crack\Plugins\OneDrive\CloudOneDrive.dll
%TEMP%\1.tmp\crack\Plugins\Naver\CloudNaver.dll
%TEMP%\1.tmp\crack\Plugins\Mega\CloudMega.dll
%TEMP%\1.tmp\crack\Plugins\MediaFire\CloudMediaFire.dll
%TEMP%\1.tmp\crack\Plugins\MailRu\CloudMailRu.dll
%TEMP%\1.tmp\crack\Plugins\HiDrive\CloudHiDrive.dll
%TEMP%\1.tmp\crack\Plugins\SFTP\CloudSFTP.dll
%TEMP%\1.tmp\crack\Plugins\GoogleDrive\CloudGoogleDrive.dll
%TEMP%\1.tmp\crack\Plugins\DropBox\CloudDropBox.dll
%TEMP%\1.tmp\crack\Plugins\Boxcom\CloudBoxcom.dll
%TEMP%\1.tmp\crack\Plugins\Baidu\CloudBaidu.dll
%TEMP%\1.tmp\crack\Plugins\Amazon\CloudAmazon.dll
%TEMP%\1.tmp\crack\Plugins\4Shared\Cloud4Shared.dll
%TEMP%\1.tmp\crack\AirExplorerCmd.exe
%TEMP%\1.tmp\crack\AirExplorer.exe
%TEMP%\1.tmp\AirExplorer-OnlineInstaller.exe
%TEMP%\1.tmp\crack\Plugins\FTP\CloudFTP.dll
%TEMP%\1.tmp\crack\Plugins\WebDav\CloudWebDav.dll
%TEMP%\1.tmp\crack\Plugins\PCloud\CloudPCloud.dll
%TEMP%\nsr5.tmp\System.dll
%ProgramFiles%\AirExplorer\Language\airexplorer_el-GR.xml
%ProgramFiles%\AirExplorer\AirExplorerCmd.exe.config
%ProgramFiles%\AirExplorer\Language\airexplorer_de-DE.xml
%ProgramFiles%\AirExplorer\Language\airexplorer_da-DK.xml
%ProgramFiles%\AirExplorer\Language\airexplorer_cs-CZ.xml
%ProgramFiles%\AirExplorer\Language\airexplorer_ca-ES.xml
%ProgramFiles%\AirExplorer\Language\airexplorer_bg-BG.xml
%ProgramFiles%\AirExplorer\Language\airexplorer_ar-jo.xml
%HOMEPATH%\Start Menu\Programs\AirExplorer\Uninstall.lnk
%HOMEPATH%\Start Menu\Programs\AirExplorer\AirExplorer.lnk
%ProgramFiles%\AirExplorer\AirExplorer.exe.config
%TEMP%\nsr5.tmp\FindProcDLL.dll
%ProgramFiles%\AirExplorer\BouncyCastle.Crypto.dll
%ProgramFiles%\AirExplorer\PSTaskDialog.dll
%ProgramFiles%\AirExplorer\Odyssey.dll
%ProgramFiles%\AirExplorer\Microsoft.WindowsAPICodePack.Shell.dll
%ProgramFiles%\AirExplorer\Microsoft.WindowsAPICodePack.dll
%ProgramFiles%\AirExplorer\KRBTabControl.dll
%ProgramFiles%\AirExplorer\AirExplorerCmd.exe
%ProgramFiles%\AirExplorer\AirExplorer.exe
%HOMEPATH%\Desktop\AirExplorer.lnk
%ProgramFiles%\AirExplorer\uninst.exe