Trojan.MulDrop8.27082

Техническая информация

Изменения в файловой системе:

Создает следующие файлы:

%ProgramFiles%\Universal Extractor\add2inf.bat
%ProgramFiles%\Universal Extractor\bin\xace.exe
%ProgramFiles%\Universal Extractor\bin\WUN.exe
%ProgramFiles%\Universal Extractor\bin\WDOSXLE.EXE
%ProgramFiles%\Universal Extractor\bin\uudeview.exe
%ProgramFiles%\Universal Extractor\bin\upx.exe
%ProgramFiles%\Universal Extractor\bin\unzoo.exe
%ProgramFiles%\Universal Extractor\bin\unzip.exe
%ProgramFiles%\Universal Extractor\bin\UNUHARC06.EXE
%ProgramFiles%\Universal Extractor\bin\UnRAR.exe
%ProgramFiles%\Universal Extractor\bin\unlzx.exe
%ProgramFiles%\Universal Extractor\UniExtract.exe
%ProgramFiles%\Universal Extractor\bin\ForceLibrary.dll
%ProgramFiles%\Universal Extractor\bin\7z.dll
%ProgramFiles%\Universal Extractor\bin\UHARC04.EXE
%ProgramFiles%\Universal Extractor\bin\Uharc02.exe
%ProgramFiles%\Universal Extractor\bin\trid.exe
%ProgramFiles%\Universal Extractor\bin\tee.exe
%ProgramFiles%\Universal Extractor\bin\STIX_D.EXE
%ProgramFiles%\Universal Extractor\bin\SfxSplit.exe
%ProgramFiles%\Universal Extractor\bin\RAIU.EXE
%ProgramFiles%\Universal Extractor\bin\PEiD.exe
%ProgramFiles%\Universal Extractor\bin\pea.exe
%ProgramFiles%\Universal Extractor\bin\NBHextract.exe
%ProgramFiles%\Universal Extractor\bin\MsiX.exe
%ProgramFiles%\Universal Extractor\bin\unarc.exe
%ProgramFiles%\Universal Extractor\lang\Russian.ini
%ProgramFiles%\Universal Extractor\bin\InstExpl.dll
%ALLUSERSPROFILE%\Start Menu\Programs\Utilities\UniExtractor.lnk
%WINDIR%\inf\UExtract.PNF
%ProgramFiles%\Universal Extractor\bin\PDunSIS.wcx
%ProgramFiles%\Universal Extractor\bin\msi.wcx
%ProgramFiles%\Universal Extractor\bin\MhtUnPack.wcx
%ProgramFiles%\Universal Extractor\bin\iso.wcx
%ProgramFiles%\Universal Extractor\bin\InstExpl.wcx
%ProgramFiles%\Universal Extractor\bin\hlp.wcx
%ProgramFiles%\Universal Extractor\bin\dbxplug.wcx
%ProgramFiles%\Universal Extractor\bin\Unp\vise.unp
%ProgramFiles%\Universal Extractor\bin\Unp\pkware.unp
%ProgramFiles%\Universal Extractor\bin\Unp\lzma.unp
%ProgramFiles%\Universal Extractor\bin\Unp\inflate3.unp
%ProgramFiles%\Universal Extractor\bin\Unp\inflate2.unp
%ProgramFiles%\Universal Extractor\bin\Unp\inflate1.unp
%ProgramFiles%\Universal Extractor\bin\Unp\Gentee.unp
%ProgramFiles%\Universal Extractor\bin\Unp\Eschalon.unp
%ProgramFiles%\Universal Extractor\bin\Unp\Bzip2_3.unp
%ProgramFiles%\Universal Extractor\bin\Unp\Bzip2_2.unp
%ProgramFiles%\Universal Extractor\bin\Unp\Bzip2_1.unp
%ProgramFiles%\Universal Extractor\bin\TrIDDefs.TRD
%ProgramFiles%\Universal Extractor\UExtract.inf
%ProgramFiles%\Universal Extractor\bin\ZD55131.DLL
%ProgramFiles%\Universal Extractor\bin\ZD51145.DLL
%ProgramFiles%\Universal Extractor\bin\ZD50149.DLL
%ProgramFiles%\Universal Extractor\bin\lzop.exe
%ProgramFiles%\Universal Extractor\bin\uif2iso.exe
%ProgramFiles%\Universal Extractor\bin\kgb_arch_decompress.exe
%ProgramFiles%\Universal Extractor\bin\jcabxmsi.exe
%ProgramFiles%\Universal Extractor\bin\IsXunpack.exe
%ProgramFiles%\Universal Extractor\bin\E_WISE.INI
%ProgramFiles%\Universal Extractor\lang\Polish.ini
%ProgramFiles%\Universal Extractor\lang\Persian (Farsi).ini
%ProgramFiles%\Universal Extractor\lang\Korean.ini
%ProgramFiles%\Universal Extractor\lang\Japanese.ini
%ProgramFiles%\Universal Extractor\lang\Italian.ini
%ProgramFiles%\Universal Extractor\lang\Hungarian.ini
%ProgramFiles%\Universal Extractor\lang\Hebrew.ini
%ProgramFiles%\Universal Extractor\lang\Greek.ini
%ProgramFiles%\Universal Extractor\lang\German.ini
%ProgramFiles%\Universal Extractor\lang\French.ini
%ProgramFiles%\Universal Extractor\lang\Finnish.ini
%ProgramFiles%\Universal Extractor\lang\English.ini
%ProgramFiles%\Universal Extractor\lang\Portuguese.ini
%ProgramFiles%\Universal Extractor\lang\Dutch.ini
%ProgramFiles%\Universal Extractor\lang\Czech.ini
%ProgramFiles%\Universal Extractor\lang\Croatian.ini
%ProgramFiles%\Universal Extractor\lang\Chinese (Traditional).ini
%ProgramFiles%\Universal Extractor\lang\Chinese (Simplified).ini
%ProgramFiles%\Universal Extractor\lang\Bulgarian.ini
%ProgramFiles%\Universal Extractor\lang\Belarusian.ini
%ProgramFiles%\Universal Extractor\lang\Armenian.ini
%ProgramFiles%\Universal Extractor\lang\Arabic.ini
%ProgramFiles%\Universal Extractor\bin\UserDB.TXT
%ProgramFiles%\Universal Extractor\bin\MSIUnPack.vbs
%HOMEPATH%\SendTo\Extract with UniExtract.lnk
%ProgramFiles%\Universal Extractor\bin\stuffit5.engine-5.1.dll
%ProgramFiles%\Universal Extractor\lang\Romanian.ini
%ProgramFiles%\Universal Extractor\lang\Slovak.ini
%ProgramFiles%\Universal Extractor\lang\Portuguese (Brazilian).ini
%ProgramFiles%\Universal Extractor\bin\innounp.exe
%ProgramFiles%\Universal Extractor\bin\i6comp.exe
%ProgramFiles%\Universal Extractor\bin\i5comp.exe
%ProgramFiles%\Universal Extractor\bin\i3comp.exe
%ProgramFiles%\Universal Extractor\bin\E_WISE_W.EXE
%ProgramFiles%\Universal Extractor\bin\extractMHT.exe
%ProgramFiles%\Universal Extractor\bin\Expander.exe
%ProgramFiles%\Universal Extractor\bin\daa2iso.exe
%ProgramFiles%\Universal Extractor\bin\cmdTotal.exe
%ProgramFiles%\Universal Extractor\bin\clit.exe
%ProgramFiles%\Universal Extractor\bin\cdirip.exe
%ProgramFiles%\Universal Extractor\bin\AspackDie22.exe
%ProgramFiles%\Universal Extractor\bin\AspackDie.exe
%ProgramFiles%\Universal Extractor\bin\arj.exe
%ProgramFiles%\Universal Extractor\bin\arc.exe
%ProgramFiles%\Universal Extractor\bin\7z.exe
%ProgramFiles%\Universal Extractor\lang\Vietnamese.ini
%ProgramFiles%\Universal Extractor\lang\Valencian (Catalan).ini
%ProgramFiles%\Universal Extractor\UniExtract.ini
%ProgramFiles%\Universal Extractor\lang\Ukrainian.ini
%ProgramFiles%\Universal Extractor\lang\Turkish.ini
%ProgramFiles%\Universal Extractor\lang\Thai.ini
%ProgramFiles%\Universal Extractor\lang\Swedish.ini
%ProgramFiles%\Universal Extractor\lang\Spanish.ini
%ProgramFiles%\Universal Extractor\lang\Serbian.ini
%ProgramFiles%\Universal Extractor\desktop.ini

Присваивает атрибут 'скрытый' для следующих файлов:

%ProgramFiles%\Universal Extractor\desktop.ini

Перемещает следующие файлы:

%ProgramFiles%\Universal Extractor\UExtract.inf в %WINDIR%\inf\UExtract.inf

Другое:

Запускает на исполнение:

'<SYSTEM32>\cmd.exe' /c ""%ProgramFiles%\Universal Extractor\add2inf.bat" "
'<SYSTEM32>\rundll32.exe' advpack,LaunchINFSection %WINDIR%\INF\UExtract.inf,DefaultInstall,0
'<SYSTEM32>\cmd.exe' /S /D /c" Ver "
'<SYSTEM32>\find.exe' "6."
'<SYSTEM32>\attrib.exe' +H +S desktop.ini
'<SYSTEM32>\attrib.exe' +R "%ProgramFiles%\Universal Extractor"