Trojan.MulDrop8.28253

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKLM>\SOFTWARE\Classes\launchspeed\Shell\Open\command] '' = '"%ProgramFiles%\XMNetSpeeder\XMNetSpeeder.exe" "%1" '

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nsp2.tmp\System.dll
%ProgramFiles%\XMNetSpeeder\bin\tap-windows.exe
%ProgramFiles%\XMNetSpeeder\SpeedLauncher.exe
%ProgramFiles%\XMNetSpeeder\bin\openvpnserv2.exe
%ProgramFiles%\XMNetSpeeder\bin\openvpnserv.exe
%ProgramFiles%\XMNetSpeeder\bin\openvpn.exe
%ProgramFiles%\XMNetSpeeder\bin\openvpn-gui.exe
%ProgramFiles%\XMNetSpeeder\bin\openssl.exe
%ProgramFiles%\XMNetSpeeder\config\gameacc.ovpn
%ProgramFiles%\XMNetSpeeder\rkcfg.ini
%ProgramFiles%\XMNetSpeeder\config\README.txt
%ProgramFiles%\XMNetSpeeder\config\login.txt
%ProgramFiles%\XMNetSpeeder\bin\1.txt
%ProgramFiles%\XMNetSpeeder\Skins\WebContainer.xml
%ProgramFiles%\XMNetSpeeder\Skins\NodeListItem.xml
%ProgramFiles%\XMNetSpeeder\Skins\MainSkin.xml
%ProgramFiles%\XMNetSpeeder\Skins\ChooseNodeWnd.xml
%ProgramFiles%\XMNetSpeeder\Skins\AreaListItem.xml
%ProgramFiles%\XMNetSpeeder\Skins\res\unselectable.png
%ProgramFiles%\XMNetSpeeder\Skins\res\tipwnd.png
%ProgramFiles%\XMNetSpeeder\Skins\res\scrollbar.png
%ProgramFiles%\XMNetSpeeder\Skins\res\rocketready.png
%ProgramFiles%\XMNetSpeeder\Skins\res\ping_red.png
%ProgramFiles%\XMNetSpeeder\Skins\res\ping_orange.png
%ProgramFiles%\XMNetSpeeder\XMNetSpeeder.exe
%ProgramFiles%\XMNetSpeeder\interface_layer.dll
%ProgramFiles%\XMNetSpeeder\bin\libeay32.dll
%ProgramFiles%\XMNetSpeeder\bin\liblzo2-2.dll
%ProgramFiles%\TAP-Windows\icon.ico
%ProgramFiles%\TAP-Windows\license.txt
%ALLUSERSPROFILE%\Start Menu\Programs\TAP-Windows\Utilities\Delete ALL TAP virtual ethernet adapters.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\TAP-Windows\Utilities\Add a new TAP virtual ethernet adapter.lnk
%ProgramFiles%\TAP-Windows\bin\deltapall.bat
%ProgramFiles%\TAP-Windows\bin\addtap.bat
%ProgramFiles%\TAP-Windows\driver\tap0901.sys
%ProgramFiles%\TAP-Windows\driver\tap0901.cat
%ProgramFiles%\TAP-Windows\driver\OemVista.inf
%ProgramFiles%\TAP-Windows\bin\tapinstall.exe
%TEMP%\nsz4.tmp\System.dll
%TEMP%\nsp2.tmp\nsCommon.dll
%TEMP%\nsz4.tmp\UserInfo.dll
%HOMEPATH%\Desktop\РЎВнјУЛЩЖч.lnk
%HOMEPATH%\Start Menu\Programs\РЎВнјУЛЩЖч\Р¶ФШіМРт.lnk
%HOMEPATH%\Start Menu\Programs\РЎВнјУЛЩЖч\РЎВнјУЛЩЖч.lnk
%ProgramFiles%\XMNetSpeeder\uninst.exe
%ProgramFiles%\XMNetSpeeder\STUiLib.dll
%ProgramFiles%\XMNetSpeeder\STCEF2.dll
%ProgramFiles%\XMNetSpeeder\bin\ssleay32.dll
%ProgramFiles%\XMNetSpeeder\NetResSDK.dll
%ProgramFiles%\XMNetSpeeder\msvcr100.dll
%ProgramFiles%\XMNetSpeeder\msvcp100.dll
%ProgramFiles%\XMNetSpeeder\bin\libpkcs11-helper-1.dll
%TEMP%\nsz4.tmp\nsExec.dll
%ProgramFiles%\XMNetSpeeder\Skins\res\ping_grey.png
%ProgramFiles%\XMNetSpeeder\Skins\res\ping_green.png
%ProgramFiles%\XMNetSpeeder\Skins\res\pgs_full.png
%ProgramFiles%\XMNetSpeeder\Skins\res\btn_rightmore_hover.png
%ProgramFiles%\XMNetSpeeder\Skins\res\btn_min_normal.png
%ProgramFiles%\XMNetSpeeder\Skins\res\btn_min_hover.png
%ProgramFiles%\XMNetSpeeder\Skins\res\btn_login_normal.png
%ProgramFiles%\XMNetSpeeder\Skins\res\btn_login_hover.png
%ProgramFiles%\XMNetSpeeder\Skins\res\btn_leftmore_normal.png
%ProgramFiles%\XMNetSpeeder\Skins\res\btn_leftmore_hover.png
%ProgramFiles%\XMNetSpeeder\Skins\res\btn_close_normal.png
%ProgramFiles%\XMNetSpeeder\Skins\res\btn_close_hover.png
%ProgramFiles%\XMNetSpeeder\Skins\res\btn_choose_normal.png
%ProgramFiles%\XMNetSpeeder\Skins\res\btn_choose_hover.png
%ProgramFiles%\XMNetSpeeder\Skins\res\btn_chooseconfirm_normal.png
%ProgramFiles%\XMNetSpeeder\Skins\res\btn_chooseconfirm_hover.png
%ProgramFiles%\XMNetSpeeder\Skins\res\btn_cancel_normal.png
%ProgramFiles%\XMNetSpeeder\Skins\res\btn_cancel_hover.png
%ProgramFiles%\XMNetSpeeder\Skins\res\bg.png
%ProgramFiles%\XMNetSpeeder\Skins\res\success.gif
%ProgramFiles%\XMNetSpeeder\Skins\res\pingload.gif
%ProgramFiles%\XMNetSpeeder\Skins\res\circle.gif
%ProgramFiles%\XMNetSpeeder\bin\c_rehash
%TEMP%\nsp2.tmp\nsis7z.dll
%ProgramFiles%\XMNetSpeeder\server_update.7z
%TEMP%\nsp2.tmp\nsProcess.dll
%ProgramFiles%\XMNetSpeeder\Skins\res\btn_rightmore_normal.png
%ProgramFiles%\XMNetSpeeder\Skins\res\btn_showinfo_hover.png
%ProgramFiles%\XMNetSpeeder\Skins\res\btn_showinfo_normal.png
%ProgramFiles%\XMNetSpeeder\Skins\res\btn_start_disable.png
%ProgramFiles%\XMNetSpeeder\Skins\res\opt_game_selected.png
%ProgramFiles%\XMNetSpeeder\Skins\res\opt_game_normal.png
%ProgramFiles%\XMNetSpeeder\Skins\res\nodeinfo_bg.png
%ProgramFiles%\XMNetSpeeder\Skins\res\label_stopping.png
%ProgramFiles%\XMNetSpeeder\Skins\res\icon.png
%ProgramFiles%\XMNetSpeeder\Skins\res\circle.png
%ProgramFiles%\XMNetSpeeder\Skins\res\choosenodebk.png
%ProgramFiles%\XMNetSpeeder\Skins\res\checked.png
%ProgramFiles%\XMNetSpeeder\Skins\res\checkbk.png
%ProgramFiles%\XMNetSpeeder\Skins\res\check.png
%ProgramFiles%\XMNetSpeeder\Skins\res\btn_tippay_normal.png
%ProgramFiles%\XMNetSpeeder\Skins\res\btn_tiplogin_normal.png
%ProgramFiles%\XMNetSpeeder\Skins\res\btn_tippay_hover.png
%ProgramFiles%\XMNetSpeeder\Skins\res\btn_tiplogin_hover.png
%ProgramFiles%\XMNetSpeeder\Skins\res\btn_tipclose_normal.png
%ProgramFiles%\XMNetSpeeder\Skins\res\btn_tipclose_hover.png
%ProgramFiles%\XMNetSpeeder\Skins\res\btn_tipactive_normal.png
%ProgramFiles%\XMNetSpeeder\Skins\res\btn_tipactive_hover.png
%ProgramFiles%\XMNetSpeeder\Skins\res\btn_sure_hover.png
%ProgramFiles%\XMNetSpeeder\Skins\res\btn_suer_normal.png
%ProgramFiles%\XMNetSpeeder\Skins\res\btn_stop_normal.png
%ProgramFiles%\XMNetSpeeder\Skins\res\btn_stop_hover.png
%ProgramFiles%\XMNetSpeeder\Skins\res\btn_start_normal.png
%ProgramFiles%\XMNetSpeeder\Skins\res\btn_start_hover.png
%ProgramFiles%\XMNetSpeeder\Skins\res\pgs_empty.png
%TEMP%\nsz4.tmp\ns5.tmp

Удаляет следующие файлы:

%ProgramFiles%\XMNetSpeeder\server_update.7z
%TEMP%\nsp2.tmp\nsCommon.dll
%TEMP%\nsp2.tmp\nsis7z.dll
%TEMP%\nsp2.tmp\nsProcess.dll
%TEMP%\nsp2.tmp\System.dll

Другое:

Ищет следующие окна:

ClassName: '#32770' WindowName: ''
ClassName: '' WindowName: 'Hardware Installation'

Создает и запускает на исполнение:

'%ProgramFiles%\XMNetSpeeder\bin\tap-windows.exe' /S /SELECT_UTILITIES=1
'%ProgramFiles%\XMNetSpeeder\XMNetSpeeder.exe' 1
'%TEMP%\nsz4.tmp\ns5.tmp' "%ProgramFiles%\TAP-Windows\bin\tapinstall.exe" hwids tap0901
'%ProgramFiles%\TAP-Windows\bin\tapinstall.exe' hwids tap0901