Trojan.MulDrop8.28139

Техническая информация

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\7zSC2BAF9C1\CARDREADER\APBin\config.ini
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-21-2052111302-484763869-725345543-1003
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-21-2052111302-484763869-725345543-1003
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-20
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-20
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-19
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-19
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-18
%ProgramFiles%\InstallShield Installation Information\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\pkgc2a52.rra
%ProgramFiles%\InstallShield Installation Information\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\uset2a33.rra
%ProgramFiles%\Realtek\Realtek Card Reader\revc29f4.rra
%ProgramFiles%\Realtek\Realtek Card Reader\revc29c5.rra
%ProgramFiles%\Realtek\Realtek Card Reader\Disp2977.rra
%ProgramFiles%\Realtek\Realtek Card Reader\SetE2939.rra
%ProgramFiles%\Realtek\Realtek Card Reader\SDRT290a.rra
%ProgramFiles%\Realtek\Realtek Card Reader\Rmb28ac.rra
%ProgramFiles%\Realtek\Realtek Card Reader\conf288d.rra
%ProgramFiles%\Realtek\Realtek Card Reader\RsCR283f.rra
%ProgramFiles%\Realtek\Realtek Card Reader\RIco2773.rra
<DRIVERS>\RtsU2716.rra
%ProgramFiles%\Realtek\Realtek Card Reader\SDRT2699.rra
%ProgramFiles%\Realtek\Realtek Card Reader\RtsU22ef.rra
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_.DEFAULT
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SECURITY
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SOFTWARE
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SYSTEM
%WINDIR%\inf\oem3.inf
<SYSTEM32>\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\oem3.CAT
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\OBJECTS.MAP
%ProgramFiles%\InstallShield Installation Information\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\setup.ini
%ProgramFiles%\InstallShield Installation Information\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\setu4aca.rra
%ProgramFiles%\InstallShield Installation Information\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\setu4a8c.rra
%ProgramFiles%\InstallShield Installation Information\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\ISSe4a2e.rra
%ProgramFiles%\InstallShield Installation Information\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\_Set49b1.rra
%ProgramFiles%\InstallShield Installation Information\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\setu4944.rra
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\OBJECTS.DATA
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING1.MAP
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING2.MAP
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING.VER
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\INDEX.MAP
%ProgramFiles%\InstallShield Installation Information\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\data47ad.rra
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\INDEX.BTR
%ProgramFiles%\InstallShield Installation Information\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\data478e.rra
%ProgramFiles%\InstallShield Installation Information\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\layo476f.rra
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\$WinMgmt.CFG
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\domain.txt
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\ComDb.Dat
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SAM
%WINDIR%\inf\oem3.PNF
%ProgramFiles%\Realtek\Realtek Card Reader\RtsU22c0.rra
%ProgramFiles%\Realtek\Realtek Card Reader\RtsU2272.rra
%ProgramFiles%\Realtek\Realtek Card Reader\RtsU2253.rra
%TEMP%\7zSC2BAF9C1\CARDREADER\APBin\SetEHCIKey.exe
%TEMP%\7zSC2BAF9C1\CARDREADER\APBin\SDRTCPRM.dll
%TEMP%\7zSC2BAF9C1\CARDREADER\APBin\Rmb.exe
%TEMP%\7zSC2BAF9C1\CARDREADER\Utility\Display.ico
%TEMP%\7zSC2BAF9C1\CARDREADER\usetup.iss
%TEMP%\7zSC2BAF9C1\CARDREADER\u3setup.iss
%TEMP%\7zSC2BAF9C1\CARDREADER\u2setup.iss
%TEMP%\7zSC2BAF9C1\CARDREADER\setup.iss
%TEMP%\7zSC2BAF9C1\CARDREADER\setup.isn
%TEMP%\7zSC2BAF9C1\CARDREADER\setup.inx
%TEMP%\7zSC2BAF9C1\CARDREADER\setup.ini
%TEMP%\7zSC2BAF9C1\CARDREADER\readme.txt
%TEMP%\7zSC2BAF9C1\CARDREADER\pkgconf.ini
%TEMP%\7zSC2BAF9C1\CARDREADER\layout.bin
%TEMP%\7zSC2BAF9C1\CARDREADER\DrvBin64\RtsUVStor64.cat
%TEMP%\7zSC2BAF9C1\CARDREADER\DrvBin64\RtsUVStor.inf
%TEMP%\7zSC2BAF9C1\CARDREADER\DrvBin32\RtsUVStor32.cat
%TEMP%\7zSC2BAF9C1\CARDREADER\DrvBin32\RtsUVStor.inf
%TEMP%\7zSC2BAF9C1\CARDREADER\data2.cab
%TEMP%\7zSC2BAF9C1\CARDREADER\data1.hdr
%TEMP%\7zSC2BAF9C1\CARDREADER\data1.cab
%TEMP%\7zSC2BAF9C1\CARDREADER\APBin32\RIconMan.exe
%TEMP%\7zSC2BAF9C1\CARDREADER\APBin32\RsCRLib.dll
%TEMP%\7zSC2BAF9C1\CARDREADER\APBin64\RIconMan.exe
%TEMP%\7zSC2BAF9C1\CARDREADER\APBin64\RsCRLib.dll
%TEMP%\{7D197FB3-D54C-4FA7-AAFC-9E3A0AD4D260}\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\defa117a.rra
%TEMP%\{7D197FB3-D54C-4FA7-AAFC-9E3A0AD4D260}\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\isrt111d.rra
%TEMP%\{7D197FB3-D54C-4FA7-AAFC-9E3A0AD4D260}\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\Stri10cf.rra
%TEMP%\{7D197FB3-D54C-4FA7-AAFC-9E3A0AD4D260}\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\VASD1080.rra
%TEMP%\{7D197FB3-D54C-4FA7-AAFC-9E3A0AD4D260}\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\DIFx1042.rra
%TEMP%\{7D197FB3-D54C-4FA7-AAFC-9E3A0AD4D260}\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\Font1003.rra
%TEMP%\{7D197FB3-D54C-4FA7-AAFC-9E3A0AD4D260}\dotnfc5.rra
%TEMP%\{7D197FB3-D54C-4FA7-AAFC-9E3A0AD4D260}\coref77.rra
%TEMP%\{7D197FB3-D54C-4FA7-AAFC-9E3A0AD4D260}\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\setuf09.rra
%TEMP%\c1b.rra
%TEMP%\{60FE9235-8358-4F9F-8E92-869B58592F0B}\_Setup.dll
%TEMP%\{60FE9235-8358-4F9F-8E92-869B58592F0B}\setup.ini
%TEMP%\7zSC2BAF9C1\CARDREADER\_Setup.dll
%TEMP%\7zSC2BAF9C1\CARDREADER\Utility\revcon64.exe
%TEMP%\7zSC2BAF9C1\CARDREADER\Utility\revcon32.exe
%TEMP%\7zSC2BAF9C1\CARDREADER\setup.exe
%TEMP%\7zSC2BAF9C1\CARDREADER\ISSetup.dll
%TEMP%\7zSC2BAF9C1\CARDREADER\DrvBin64\RtsUVStorIcon.dll
%TEMP%\7zSC2BAF9C1\CARDREADER\DrvBin64\RtsUVStor.sys
%TEMP%\7zSC2BAF9C1\CARDREADER\DrvBin32\SDRTCPRM.dll
%TEMP%\7zSC2BAF9C1\CARDREADER\DrvBin32\RtsUVStorIcon.dll
%TEMP%\7zSC2BAF9C1\CARDREADER\DrvBin32\RtsUVStor.sys
%TEMP%\{7D197FB3-D54C-4FA7-AAFC-9E3A0AD4D260}\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\_IsR11b9.rra
<SYSTEM32>\sda\SDRTb387.rra

Присваивает атрибут 'скрытый' для следующих файлов:

<SYSTEM32>\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\oem3.CAT

Удаляет следующие файлы:

%ProgramFiles%\Realtek\Realtek Card Reader\SDRTCPRM.dll

Перемещает следующие файлы:

%TEMP%\{7D197FB3-D54C-4FA7-AAFC-9E3A0AD4D260}\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\setuf09.rra в %TEMP%\{7D197FB3-D54C-4FA7-AAFC-9E3A0AD4D260}\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\setup.inx
%ProgramFiles%\Realtek\Realtek Card Reader\Rmb28ac.rra в %ProgramFiles%\Realtek\Realtek Card Reader\Rmb.exe
%ProgramFiles%\Realtek\Realtek Card Reader\SetE2939.rra в %ProgramFiles%\Realtek\Realtek Card Reader\SetEHCIKey.exe
%ProgramFiles%\Realtek\Realtek Card Reader\Disp2977.rra в %ProgramFiles%\Realtek\Realtek Card Reader\Display.ico
%ProgramFiles%\Realtek\Realtek Card Reader\revc29c5.rra в %ProgramFiles%\Realtek\Realtek Card Reader\revcon32.exe
%ProgramFiles%\Realtek\Realtek Card Reader\revc29f4.rra в %ProgramFiles%\Realtek\Realtek Card Reader\revcon64.exe
%ProgramFiles%\InstallShield Installation Information\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\uset2a33.rra в %ProgramFiles%\InstallShield Installation Information\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\usetup.iss
%ProgramFiles%\InstallShield Installation Information\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\layo476f.rra в %ProgramFiles%\InstallShield Installation Information\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\layout.bin
%ProgramFiles%\InstallShield Installation Information\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\setu4aca.rra в %ProgramFiles%\InstallShield Installation Information\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\setup.ini
%ProgramFiles%\InstallShield Installation Information\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\data478e.rra в %ProgramFiles%\InstallShield Installation Information\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\data1.hdr
%ProgramFiles%\InstallShield Installation Information\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\data47ad.rra в %ProgramFiles%\InstallShield Installation Information\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\data1.cab
%ProgramFiles%\InstallShield Installation Information\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\setu4944.rra в %ProgramFiles%\InstallShield Installation Information\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\setup.exe
%ProgramFiles%\InstallShield Installation Information\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\_Set49b1.rra в %ProgramFiles%\InstallShield Installation Information\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\_Setup.dll
%ProgramFiles%\InstallShield Installation Information\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\ISSe4a2e.rra в %ProgramFiles%\InstallShield Installation Information\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\ISSetup.dll
%ProgramFiles%\InstallShield Installation Information\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\setu4a8c.rra в %ProgramFiles%\InstallShield Installation Information\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\setup.inx
%ProgramFiles%\Realtek\Realtek Card Reader\conf288d.rra в %ProgramFiles%\Realtek\Realtek Card Reader\config.ini
%ProgramFiles%\InstallShield Installation Information\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\pkgc2a52.rra в %ProgramFiles%\InstallShield Installation Information\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\pkgconf.ini
%ProgramFiles%\Realtek\Realtek Card Reader\RsCR283f.rra в %ProgramFiles%\Realtek\Realtek Card Reader\RsCRLib.dll
%TEMP%\{7D197FB3-D54C-4FA7-AAFC-9E3A0AD4D260}\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\isrt111d.rra в %TEMP%\{7D197FB3-D54C-4FA7-AAFC-9E3A0AD4D260}\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\isrt.dll
%TEMP%\{7D197FB3-D54C-4FA7-AAFC-9E3A0AD4D260}\coref77.rra в %TEMP%\{7D197FB3-D54C-4FA7-AAFC-9E3A0AD4D260}\corecomp.ini
%TEMP%\{7D197FB3-D54C-4FA7-AAFC-9E3A0AD4D260}\dotnfc5.rra в %TEMP%\{7D197FB3-D54C-4FA7-AAFC-9E3A0AD4D260}\dotnetinstaller.exe
%TEMP%\{7D197FB3-D54C-4FA7-AAFC-9E3A0AD4D260}\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\Font1003.rra в %TEMP%\{7D197FB3-D54C-4FA7-AAFC-9E3A0AD4D260}\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\FontData.ini
%TEMP%\{7D197FB3-D54C-4FA7-AAFC-9E3A0AD4D260}\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\DIFx1042.rra в %TEMP%\{7D197FB3-D54C-4FA7-AAFC-9E3A0AD4D260}\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\DIFxData.ini
%TEMP%\{7D197FB3-D54C-4FA7-AAFC-9E3A0AD4D260}\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\VASD1080.rra в %TEMP%\{7D197FB3-D54C-4FA7-AAFC-9E3A0AD4D260}\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\VASData.ini
%TEMP%\{7D197FB3-D54C-4FA7-AAFC-9E3A0AD4D260}\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\Stri10cf.rra в %TEMP%\{7D197FB3-D54C-4FA7-AAFC-9E3A0AD4D260}\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\StringTable-0009-English.ips
%TEMP%\{7D197FB3-D54C-4FA7-AAFC-9E3A0AD4D260}\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\defa117a.rra в %TEMP%\{7D197FB3-D54C-4FA7-AAFC-9E3A0AD4D260}\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\default.pal
<DRIVERS>\RtsU2716.rra в <DRIVERS>\RtsUVStor.sys
%TEMP%\{7D197FB3-D54C-4FA7-AAFC-9E3A0AD4D260}\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\_IsR11b9.rra в %TEMP%\{7D197FB3-D54C-4FA7-AAFC-9E3A0AD4D260}\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\_IsRes.dll
%ProgramFiles%\Realtek\Realtek Card Reader\RtsU2253.rra в %ProgramFiles%\Realtek\Realtek Card Reader\RtsUVStor.inf
%ProgramFiles%\Realtek\Realtek Card Reader\RtsU2272.rra в %ProgramFiles%\Realtek\Realtek Card Reader\RtsUVStor.sys
%ProgramFiles%\Realtek\Realtek Card Reader\RtsU22c0.rra в %ProgramFiles%\Realtek\Realtek Card Reader\RtsUVStor32.cat
%ProgramFiles%\Realtek\Realtek Card Reader\RtsU22ef.rra в %ProgramFiles%\Realtek\Realtek Card Reader\RtsUVStorIcon.dll
%ProgramFiles%\Realtek\Realtek Card Reader\SDRT2699.rra в %ProgramFiles%\Realtek\Realtek Card Reader\SDRTCPRM.dll
%ProgramFiles%\Realtek\Realtek Card Reader\RIco2773.rra в %ProgramFiles%\Realtek\Realtek Card Reader\RIconMan.exe
<SYSTEM32>\sda\SDRTb387.rra в <SYSTEM32>\sda\SDRTCPRM.dll

Подменяет следующие файлы:

%ProgramFiles%\Realtek\Realtek Card Reader\SDRTCPRM.dll

Другое:

Создает и запускает на исполнение:

'%TEMP%\7zSC2BAF9C1\CARDREADER\setup.exe'
'%ProgramFiles%\Realtek\Realtek Card Reader\revcon32.exe' RS_dp_add RtsUVStor.inf

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней