Trojan.MulDrop8.28095

Техническая информация

Для обеспечения автозапуска и распространения:

Создает следующие сервисы:

[<HKLM>\SYSTEM\ControlSet001\Services\PGService] 'ImagePath' = '%ProgramFiles%\PageGuard\PGService.exe'
[<HKLM>\SYSTEM\ControlSet001\Services\PGService] 'Start' = '00000002'

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\aut1.tmp
%TEMP%\aut1B.tmp
%ProgramFiles%\PageGuard\download\msvcr71.dll
%TEMP%\aut1A.tmp
%ProgramFiles%\PageGuard\download\msvcp71.dll
%TEMP%\aut19.tmp
%ProgramFiles%\PageGuard\download\minizip.dll
%TEMP%\aut1C.tmp
%ProgramFiles%\PageGuard\download\XLBugHandler.dll
%TEMP%\aut17.tmp
%ProgramFiles%\PageGuard\download\MiniThunderPlatform.exe
%TEMP%\aut16.tmp
%ProgramFiles%\PageGuard\download\id.dat
%TEMP%\aut15.tmp
%ProgramFiles%\PageGuard\download\dsptw.dll
%TEMP%\aut18.tmp
%TEMP%\autA.tmp
%ProgramFiles%\PageGuard\download\XLBugReport.exe
%ProgramFiles%\PageGuard\HelperLib.dll
%TEMP%\aut24.tmp
%ProgramFiles%\PageGuard\PGFltMgrLib.dll
%TEMP%\aut23.tmp
%ProgramFiles%\PageGuard\ClientSocketDll.dll
%TEMP%\aut22.tmp
%ProgramFiles%\PageGuard\Uninstall.EXE
%TEMP%\aut21.tmp
%ProgramFiles%\PageGuard\Update\UpdateResource.dll
%TEMP%\aut20.tmp
%ProgramFiles%\PageGuard\Update\Update.exe
%TEMP%\aut1F.tmp
%ProgramFiles%\PageGuard\Update\HelperLib.dll
%TEMP%\aut1E.tmp
%ProgramFiles%\PageGuard\download\zlib1.dll
%TEMP%\aut14.tmp
%ProgramFiles%\PageGuard\download\MiniTPFw.exe
%ProgramFiles%\PageGuard\download\download_engine.dll
%TEMP%\aut13.tmp
%ProgramFiles%\PageGuard\download\dl_peer_id.dll
%TEMP%\aut5.tmp
%TEMP%\aut8.tmp
%ProgramFiles%\PageGuard\data\plugin\BrowserInjectDllX64.dll
%TEMP%\aut7.tmp
%ProgramFiles%\PageGuard\xldl.dll
%TEMP%\aut6.tmp
%ProgramFiles%\PageGuard\WebMini.exe
%ProgramFiles%\PageGuard\Resource.dll
%TEMP%\aut9.tmp
%TEMP%\aut4.tmp
%ProgramFiles%\PageGuard\Downloader.exe
%TEMP%\aut3.tmp
%ProgramFiles%\PageGuard\PGService.exe
%TEMP%\aut2.tmp
%ProgramFiles%\PageGuard\pageguard.dat
%TEMP%\aut25.tmp
%TEMP%\aut1D.tmp
%ProgramFiles%\PageGuard\data\cfg\cfg1
%TEMP%\autB.tmp
%ProgramFiles%\PageGuard\data\plugin\BrowserInjectDllX86.dll
%TEMP%\aut12.tmp
%ProgramFiles%\PageGuard\download\Bcdedit.dll
%TEMP%\aut11.tmp
%ProgramFiles%\PageGuard\download\atl71.dll
%TEMP%\aut10.tmp
%ProgramFiles%\PageGuard\data\cfg\cfg7
%TEMP%\autF.tmp
%ProgramFiles%\PageGuard\data\cfg\cfg6
%TEMP%\autE.tmp
%ProgramFiles%\PageGuard\data\cfg\cfg5
%TEMP%\autD.tmp
%ProgramFiles%\PageGuard\data\cfg\cfg4
%TEMP%\autC.tmp
%ProgramFiles%\PageGuard\data\cfg\cfg3
%ProgramFiles%\PageGuard\data\cfg\cfg2
%ProgramFiles%\PageGuard\PageGuard.exe

Удаляет следующие файлы:

%TEMP%\aut1.tmp
%TEMP%\aut15.tmp
%TEMP%\aut16.tmp
%TEMP%\aut17.tmp
%TEMP%\aut18.tmp
%TEMP%\aut19.tmp
%TEMP%\aut1A.tmp
%TEMP%\aut1B.tmp
%TEMP%\aut1C.tmp
%TEMP%\aut1D.tmp
%TEMP%\aut1E.tmp
%TEMP%\aut1F.tmp
%TEMP%\aut20.tmp
%TEMP%\aut21.tmp
%TEMP%\aut22.tmp
%TEMP%\aut23.tmp
%TEMP%\aut14.tmp
%TEMP%\aut24.tmp
%TEMP%\aut13.tmp
%TEMP%\aut11.tmp
%TEMP%\aut2.tmp
%TEMP%\aut3.tmp
%TEMP%\aut4.tmp
%TEMP%\aut5.tmp
%TEMP%\aut6.tmp
%TEMP%\aut7.tmp
%TEMP%\aut8.tmp
%TEMP%\aut9.tmp
%TEMP%\autA.tmp
%TEMP%\autB.tmp
%TEMP%\autC.tmp
%TEMP%\autD.tmp
%TEMP%\autE.tmp
%TEMP%\autF.tmp
%TEMP%\aut10.tmp
%TEMP%\aut12.tmp
%TEMP%\aut25.tmp

Другое:

Запускает на исполнение:

'<SYSTEM32>\cmd.exe' /c @sc delete PGService
'<SYSTEM32>\sc.exe' delete PGService
'<SYSTEM32>\cmd.exe' /c @sc create PGService binPath= "%ProgramFiles%\PageGuard\PGService.exe"
'<SYSTEM32>\sc.exe' create PGService binPath= "%ProgramFiles%\PageGuard\PGService.exe"
'<SYSTEM32>\cmd.exe' /c @sc config PGService start= auto
'<SYSTEM32>\sc.exe' config PGService start= auto