Trojan.MulDrop8.28127

Техническая информация

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\7zS85B405D1\CardReader\APBin\config.ini
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-21-2052111302-484763869-725345543-1003
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-21-2052111302-484763869-725345543-1003
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-20
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-20
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-19
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-19
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-18
%ProgramFiles%\InstallShield Installation Information\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\pkgc2f43.rra
%ProgramFiles%\InstallShield Installation Information\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\uset2f24.rra
%ProgramFiles%\Realtek\Realtek Card Reader\revc2ef5.rra
%ProgramFiles%\Realtek\Realtek Card Reader\revc2ed6.rra
%ProgramFiles%\Realtek\Realtek Card Reader\Disp2eb7.rra
%ProgramFiles%\Realtek\Realtek Card Reader\SetE2e88.rra
%ProgramFiles%\Realtek\Realtek Card Reader\SDRT2e69.rra
%ProgramFiles%\Realtek\Realtek Card Reader\Rmb2e2a.rra
%ProgramFiles%\Realtek\Realtek Card Reader\conf2e0b.rra
%ProgramFiles%\Realtek\Realtek Card Reader\RsCR2dcc.rra
%ProgramFiles%\Realtek\Realtek Card Reader\RIco2cf2.rra
<DRIVERS>\RtsU2c84.rra
%ProgramFiles%\Realtek\Realtek Card Reader\SDRT2c27.rra
%ProgramFiles%\Realtek\Realtek Card Reader\RtsU28ac.rra
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_.DEFAULT
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SECURITY
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SOFTWARE
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SYSTEM
%WINDIR%\inf\oem3.inf
<SYSTEM32>\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\oem3.CAT
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\OBJECTS.MAP
%ProgramFiles%\InstallShield Installation Information\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\setup.ini
%ProgramFiles%\InstallShield Installation Information\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\setu4f9d.rra
%ProgramFiles%\InstallShield Installation Information\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\setu4f4f.rra
%ProgramFiles%\InstallShield Installation Information\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\ISSe4f10.rra
%ProgramFiles%\InstallShield Installation Information\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\_Set4ed2.rra
%ProgramFiles%\InstallShield Installation Information\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\setu4e83.rra
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\OBJECTS.DATA
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING1.MAP
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING2.MAP
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING.VER
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\INDEX.MAP
%ProgramFiles%\InstallShield Installation Information\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\data4d6a.rra
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\INDEX.BTR
%ProgramFiles%\InstallShield Installation Information\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\data4d4b.rra
%ProgramFiles%\InstallShield Installation Information\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\layo4d2c.rra
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\$WinMgmt.CFG
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\domain.txt
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\ComDb.Dat
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SAM
%WINDIR%\inf\oem3.PNF
%ProgramFiles%\Realtek\Realtek Card Reader\RtsU287d.rra
%ProgramFiles%\Realtek\Realtek Card Reader\RtsU284e.rra
%ProgramFiles%\Realtek\Realtek Card Reader\RtsU282f.rra
%TEMP%\7zS85B405D1\CardReader\APBin\SetEHCIKey.exe
%TEMP%\7zS85B405D1\CardReader\APBin\SDRTCPRM.dll
%TEMP%\7zS85B405D1\CardReader\APBin\Rmb.exe
%TEMP%\7zS85B405D1\CardReader\Utility\Display.ico
%TEMP%\7zS85B405D1\CardReader\usetup.iss
%TEMP%\7zS85B405D1\CardReader\u3setup.iss
%TEMP%\7zS85B405D1\CardReader\u2setup.iss
%TEMP%\7zS85B405D1\CardReader\setup.iss
%TEMP%\7zS85B405D1\CardReader\setup.isn
%TEMP%\7zS85B405D1\CardReader\setup.inx
%TEMP%\7zS85B405D1\CardReader\setup.ini
%TEMP%\7zS85B405D1\CardReader\readme.txt
%TEMP%\7zS85B405D1\CardReader\pkgconf.ini
%TEMP%\7zS85B405D1\CardReader\layout.bin
%TEMP%\7zS85B405D1\CardReader\DrvBin64\RtsUVStor64.cat
%TEMP%\7zS85B405D1\CardReader\DrvBin64\RtsUVStor.inf
%TEMP%\7zS85B405D1\CardReader\DrvBin32\RtsUVStor32.cat
%TEMP%\7zS85B405D1\CardReader\DrvBin32\RtsUVStor.inf
%TEMP%\7zS85B405D1\CardReader\data2.cab
%TEMP%\7zS85B405D1\CardReader\data1.hdr
%TEMP%\7zS85B405D1\CardReader\data1.cab
%TEMP%\7zS85B405D1\CardReader\APBin32\RIconMan.exe
%TEMP%\7zS85B405D1\CardReader\APBin32\RsCRLib.dll
%TEMP%\7zS85B405D1\CardReader\APBin64\RIconMan.exe
%TEMP%\7zS85B405D1\CardReader\APBin64\RsCRLib.dll
%TEMP%\{27131747-616D-44CD-B620-F43F5B0CBCCE}\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\defa1b8d.rra
%TEMP%\{27131747-616D-44CD-B620-F43F5B0CBCCE}\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\isrt1b4e.rra
%TEMP%\{27131747-616D-44CD-B620-F43F5B0CBCCE}\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\Stri1b2f.rra
%TEMP%\{27131747-616D-44CD-B620-F43F5B0CBCCE}\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\VASD1b00.rra
%TEMP%\{27131747-616D-44CD-B620-F43F5B0CBCCE}\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\DIFx1ae1.rra
%TEMP%\{27131747-616D-44CD-B620-F43F5B0CBCCE}\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\Font1ac1.rra
%TEMP%\{27131747-616D-44CD-B620-F43F5B0CBCCE}\dotn1aa2.rra
%TEMP%\{27131747-616D-44CD-B620-F43F5B0CBCCE}\core1a73.rra
%TEMP%\{27131747-616D-44CD-B620-F43F5B0CBCCE}\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\setu1a35.rra
%TEMP%\1822.rra
%TEMP%\{1F11EC79-45DD-490D-978B-C07F57ADECA8}\_Setup.dll
%TEMP%\{1F11EC79-45DD-490D-978B-C07F57ADECA8}\setup.ini
%TEMP%\7zS85B405D1\CardReader\_Setup.dll
%TEMP%\7zS85B405D1\CardReader\Utility\revcon64.exe
%TEMP%\7zS85B405D1\CardReader\Utility\revcon32.exe
%TEMP%\7zS85B405D1\CardReader\setup.exe
%TEMP%\7zS85B405D1\CardReader\ISSetup.dll
%TEMP%\7zS85B405D1\CardReader\DrvBin64\RtsUVStorIcon.dll
%TEMP%\7zS85B405D1\CardReader\DrvBin64\RtsUVStor.sys
%TEMP%\7zS85B405D1\CardReader\DrvBin32\SDRTCPRM.dll
%TEMP%\7zS85B405D1\CardReader\DrvBin32\RtsUVStorIcon.dll
%TEMP%\7zS85B405D1\CardReader\DrvBin32\RtsUVStor.sys
%TEMP%\{27131747-616D-44CD-B620-F43F5B0CBCCE}\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\_IsR1bac.rra
<SYSTEM32>\sda\SDRTb76f.rra

Присваивает атрибут 'скрытый' для следующих файлов:

<SYSTEM32>\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\oem3.CAT

Удаляет следующие файлы:

%ProgramFiles%\Realtek\Realtek Card Reader\SDRTCPRM.dll

Перемещает следующие файлы:

%TEMP%\{27131747-616D-44CD-B620-F43F5B0CBCCE}\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\setu1a35.rra в %TEMP%\{27131747-616D-44CD-B620-F43F5B0CBCCE}\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\setup.inx
%ProgramFiles%\Realtek\Realtek Card Reader\Rmb2e2a.rra в %ProgramFiles%\Realtek\Realtek Card Reader\Rmb.exe
%ProgramFiles%\Realtek\Realtek Card Reader\SetE2e88.rra в %ProgramFiles%\Realtek\Realtek Card Reader\SetEHCIKey.exe
%ProgramFiles%\Realtek\Realtek Card Reader\Disp2eb7.rra в %ProgramFiles%\Realtek\Realtek Card Reader\Display.ico
%ProgramFiles%\Realtek\Realtek Card Reader\revc2ed6.rra в %ProgramFiles%\Realtek\Realtek Card Reader\revcon32.exe
%ProgramFiles%\Realtek\Realtek Card Reader\revc2ef5.rra в %ProgramFiles%\Realtek\Realtek Card Reader\revcon64.exe
%ProgramFiles%\InstallShield Installation Information\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\uset2f24.rra в %ProgramFiles%\InstallShield Installation Information\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\usetup.iss
%ProgramFiles%\InstallShield Installation Information\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\layo4d2c.rra в %ProgramFiles%\InstallShield Installation Information\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\layout.bin
%ProgramFiles%\InstallShield Installation Information\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\setu4f9d.rra в %ProgramFiles%\InstallShield Installation Information\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\setup.ini
%ProgramFiles%\InstallShield Installation Information\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\data4d4b.rra в %ProgramFiles%\InstallShield Installation Information\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\data1.hdr
%ProgramFiles%\InstallShield Installation Information\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\data4d6a.rra в %ProgramFiles%\InstallShield Installation Information\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\data1.cab
%ProgramFiles%\InstallShield Installation Information\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\setu4e83.rra в %ProgramFiles%\InstallShield Installation Information\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\setup.exe
%ProgramFiles%\InstallShield Installation Information\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\_Set4ed2.rra в %ProgramFiles%\InstallShield Installation Information\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\_Setup.dll
%ProgramFiles%\InstallShield Installation Information\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\ISSe4f10.rra в %ProgramFiles%\InstallShield Installation Information\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\ISSetup.dll
%ProgramFiles%\InstallShield Installation Information\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\setu4f4f.rra в %ProgramFiles%\InstallShield Installation Information\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\setup.inx
%ProgramFiles%\Realtek\Realtek Card Reader\conf2e0b.rra в %ProgramFiles%\Realtek\Realtek Card Reader\config.ini
%ProgramFiles%\InstallShield Installation Information\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\pkgc2f43.rra в %ProgramFiles%\InstallShield Installation Information\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\pkgconf.ini
%ProgramFiles%\Realtek\Realtek Card Reader\RsCR2dcc.rra в %ProgramFiles%\Realtek\Realtek Card Reader\RsCRLib.dll
%TEMP%\{27131747-616D-44CD-B620-F43F5B0CBCCE}\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\isrt1b4e.rra в %TEMP%\{27131747-616D-44CD-B620-F43F5B0CBCCE}\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\isrt.dll
%TEMP%\{27131747-616D-44CD-B620-F43F5B0CBCCE}\core1a73.rra в %TEMP%\{27131747-616D-44CD-B620-F43F5B0CBCCE}\corecomp.ini
%TEMP%\{27131747-616D-44CD-B620-F43F5B0CBCCE}\dotn1aa2.rra в %TEMP%\{27131747-616D-44CD-B620-F43F5B0CBCCE}\dotnetinstaller.exe
%TEMP%\{27131747-616D-44CD-B620-F43F5B0CBCCE}\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\Font1ac1.rra в %TEMP%\{27131747-616D-44CD-B620-F43F5B0CBCCE}\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\FontData.ini
%TEMP%\{27131747-616D-44CD-B620-F43F5B0CBCCE}\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\DIFx1ae1.rra в %TEMP%\{27131747-616D-44CD-B620-F43F5B0CBCCE}\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\DIFxData.ini
%TEMP%\{27131747-616D-44CD-B620-F43F5B0CBCCE}\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\VASD1b00.rra в %TEMP%\{27131747-616D-44CD-B620-F43F5B0CBCCE}\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\VASData.ini
%TEMP%\{27131747-616D-44CD-B620-F43F5B0CBCCE}\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\Stri1b2f.rra в %TEMP%\{27131747-616D-44CD-B620-F43F5B0CBCCE}\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\StringTable-0009-English.ips
%TEMP%\{27131747-616D-44CD-B620-F43F5B0CBCCE}\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\defa1b8d.rra в %TEMP%\{27131747-616D-44CD-B620-F43F5B0CBCCE}\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\default.pal
<DRIVERS>\RtsU2c84.rra в <DRIVERS>\RtsUVStor.sys
%TEMP%\{27131747-616D-44CD-B620-F43F5B0CBCCE}\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\_IsR1bac.rra в %TEMP%\{27131747-616D-44CD-B620-F43F5B0CBCCE}\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\_IsRes.dll
%ProgramFiles%\Realtek\Realtek Card Reader\RtsU282f.rra в %ProgramFiles%\Realtek\Realtek Card Reader\RtsUVStor.inf
%ProgramFiles%\Realtek\Realtek Card Reader\RtsU284e.rra в %ProgramFiles%\Realtek\Realtek Card Reader\RtsUVStor.sys
%ProgramFiles%\Realtek\Realtek Card Reader\RtsU287d.rra в %ProgramFiles%\Realtek\Realtek Card Reader\RtsUVStor32.cat
%ProgramFiles%\Realtek\Realtek Card Reader\RtsU28ac.rra в %ProgramFiles%\Realtek\Realtek Card Reader\RtsUVStorIcon.dll
%ProgramFiles%\Realtek\Realtek Card Reader\SDRT2c27.rra в %ProgramFiles%\Realtek\Realtek Card Reader\SDRTCPRM.dll
%ProgramFiles%\Realtek\Realtek Card Reader\RIco2cf2.rra в %ProgramFiles%\Realtek\Realtek Card Reader\RIconMan.exe
<SYSTEM32>\sda\SDRTb76f.rra в <SYSTEM32>\sda\SDRTCPRM.dll

Подменяет следующие файлы:

%ProgramFiles%\Realtek\Realtek Card Reader\SDRTCPRM.dll

Другое:

Создает и запускает на исполнение:

'%TEMP%\7zS85B405D1\CardReader\setup.exe'
'%ProgramFiles%\Realtek\Realtek Card Reader\revcon32.exe' RS_dp_add RtsUVStor.inf

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней