Trojan.MulDrop8.30160

Техническая информация

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\7zS85B51232\APBin\config.ini
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-21-2052111302-484763869-725345543-1003
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-21-2052111302-484763869-725345543-1003
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-20
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-20
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-19
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-19
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-18
%ProgramFiles%\InstallShield Installation Information\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\pkgc5bf1.rra
%ProgramFiles%\InstallShield Installation Information\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\uset5be1.rra
%ProgramFiles%\Realtek\Realtek Card Reader\revc5bb2.rra
%ProgramFiles%\Realtek\Realtek Card Reader\revc5b84.rra
%ProgramFiles%\Realtek\Realtek Card Reader\Disp5b45.rra
<DRIVERS>\RtsU5ae7.rra
%ProgramFiles%\Realtek\Realtek Card Reader\SDRT5aa9.rra
%ProgramFiles%\Realtek\Realtek Card Reader\rtsu5a6a.rra
%ProgramFiles%\Realtek\Realtek Card Reader\RtsU5a2c.rra
%ProgramFiles%\Realtek\Realtek Card Reader\RtsU5a0d.rra
%ProgramFiles%\Realtek\Realtek Card Reader\RsCR573e.rra
%ProgramFiles%\Realtek\Realtek Card Reader\SetE570f.rra
%ProgramFiles%\Realtek\Realtek Card Reader\SDRT56f0.rra
%ProgramFiles%\Realtek\Realtek Card Reader\Rmb56a2.rra
%ProgramFiles%\Realtek\Realtek Card Reader\conf5682.rra
%TEMP%\{A2126CE7-5953-414F-9C2A-BD358825B8FF}\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\_IsR42fa.rra
%TEMP%\{A2126CE7-5953-414F-9C2A-BD358825B8FF}\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\isrt425e.rra
%TEMP%\{A2126CE7-5953-414F-9C2A-BD358825B8FF}\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\defa42bc.rra
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_.DEFAULT
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SECURITY
%WINDIR%\inf\oem3.inf
<SYSTEM32>\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\oem3.CAT
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\OBJECTS.MAP
%ProgramFiles%\InstallShield Installation Information\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\setup.ini
%ProgramFiles%\InstallShield Installation Information\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\setu7e2f.rra
%ProgramFiles%\InstallShield Installation Information\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\setu7de0.rra
%ProgramFiles%\InstallShield Installation Information\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\ISSe7d73.rra
%ProgramFiles%\InstallShield Installation Information\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\_Set7d44.rra
%ProgramFiles%\InstallShield Installation Information\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\setu7cd7.rra
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\OBJECTS.DATA
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING2.MAP
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING.VER
%TEMP%\7zS85B51232\ISSetup.dll
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\INDEX.MAP
%ProgramFiles%\InstallShield Installation Information\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\data7b02.rra
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\INDEX.BTR
%ProgramFiles%\InstallShield Installation Information\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\data7ad3.rra
%ProgramFiles%\InstallShield Installation Information\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\layo7aa4.rra
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\$WinMgmt.CFG
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\domain.txt
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\ComDb.Dat
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SAM
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SYSTEM
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SOFTWARE
%TEMP%\{A2126CE7-5953-414F-9C2A-BD358825B8FF}\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\Stri422f.rra
%TEMP%\{A2126CE7-5953-414F-9C2A-BD358825B8FF}\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\VASD41f1.rra
%TEMP%\{A2126CE7-5953-414F-9C2A-BD358825B8FF}\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\DIFx41d1.rra
%TEMP%\7zS85B51232\setup.isn
%TEMP%\7zS85B51232\setup.inx
%TEMP%\7zS85B51232\setup.ini
%TEMP%\7zS85B51232\SChinese.ini
%TEMP%\7zS85B51232\Russian.ini
%TEMP%\7zS85B51232\readme.txt
%TEMP%\7zS85B51232\pkgconf.ini
%TEMP%\7zS85B51232\layout.bin
%TEMP%\7zS85B51232\Korean.ini
%TEMP%\7zS85B51232\Japanese.ini
%TEMP%\7zS85B51232\German.ini
%TEMP%\7zS85B51232\French.ini
%TEMP%\7zS85B51232\English.ini
%TEMP%\7zS85B51232\DrvBin64\rtsuvstor64.cat
%TEMP%\7zS85B51232\DrvBin64\RtsUVStor.inf
%TEMP%\7zS85B51232\DrvBin32\rtsuvstor32.cat
%TEMP%\7zS85B51232\DrvBin32\RtsUVStor.inf
%TEMP%\7zS85B51232\data2.cab
%TEMP%\7zS85B51232\data1.hdr
%TEMP%\7zS85B51232\data1.cab
%TEMP%\7zS85B51232\AsusSetup.ini
%TEMP%\7zS85B51232\AsusSetup.exe.manifest
%TEMP%\7zS85B51232\Spanish.ini
%TEMP%\7zS85B51232\TChinese.ini
%TEMP%\7zS85B51232\setup.iss
%TEMP%\7zS85B51232\u2setup.iss
%TEMP%\{A2126CE7-5953-414F-9C2A-BD358825B8FF}\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\Font41a3.rra
%TEMP%\7zS85B51232\u3setup.iss
%TEMP%\{A2126CE7-5953-414F-9C2A-BD358825B8FF}\dotn4164.rra
%TEMP%\{A2126CE7-5953-414F-9C2A-BD358825B8FF}\core4126.rra
%TEMP%\{A2126CE7-5953-414F-9C2A-BD358825B8FF}\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\Hide40b8.rra
%TEMP%\{A2126CE7-5953-414F-9C2A-BD358825B8FF}\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\setu404b.rra
%TEMP%\3d6c.rra
%TEMP%\{9E86E245-37E3-46B4-B5D7-418F17733AC7}\setup.ini
%TEMP%\{9E86E245-37E3-46B4-B5D7-418F17733AC7}\_Setup.dll
%TEMP%\7zS85B51232\_Setup.dll
%TEMP%\7zS85B51232\Utility\revcon64.exe
%TEMP%\7zS85B51232\Utility\revcon32.exe
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING1.MAP
%WINDIR%\inf\oem3.PNF
%TEMP%\7zS85B51232\DrvBin64\RtsUVStor.sys
%TEMP%\7zS85B51232\DrvBin64\RsCRIcon.dll
%TEMP%\7zS85B51232\DrvBin32\SDRTCPRM.dll
%TEMP%\7zS85B51232\DrvBin32\RtsUVStor.sys
%TEMP%\7zS85B51232\DrvBin32\RsCRIcon.dll
%TEMP%\7zS85B51232\AsusSetup.exe
%TEMP%\7zS85B51232\APBin\SetEHCIKey.exe
%TEMP%\7zS85B51232\APBin\SDRTCPRM.dll
%TEMP%\7zS85B51232\APBin\Rmb.exe
%TEMP%\7zS85B51232\Utility\Display.ico
%TEMP%\7zS85B51232\usetup.iss
%TEMP%\7zS85B51232\setup.exe
<SYSTEM32>\sda\SDRTe66e.rra

Присваивает атрибут 'скрытый' для следующих файлов:

<SYSTEM32>\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\oem3.CAT

Удаляет следующие файлы:

%ProgramFiles%\Realtek\Realtek Card Reader\SDRTCPRM.dll

Перемещает следующие файлы:

%TEMP%\{A2126CE7-5953-414F-9C2A-BD358825B8FF}\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\setu404b.rra в %TEMP%\{A2126CE7-5953-414F-9C2A-BD358825B8FF}\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\setup.inx
%ProgramFiles%\Realtek\Realtek Card Reader\rtsu5a6a.rra в %ProgramFiles%\Realtek\Realtek Card Reader\rtsuvstor32.cat
<DRIVERS>\RtsU5ae7.rra в <DRIVERS>\RtsUVStor.sys
%ProgramFiles%\Realtek\Realtek Card Reader\Disp5b45.rra в %ProgramFiles%\Realtek\Realtek Card Reader\Display.ico
%ProgramFiles%\Realtek\Realtek Card Reader\revc5b84.rra в %ProgramFiles%\Realtek\Realtek Card Reader\revcon32.exe
%ProgramFiles%\Realtek\Realtek Card Reader\revc5bb2.rra в %ProgramFiles%\Realtek\Realtek Card Reader\revcon64.exe
%ProgramFiles%\InstallShield Installation Information\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\uset5be1.rra в %ProgramFiles%\InstallShield Installation Information\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\usetup.iss
%ProgramFiles%\InstallShield Installation Information\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\layo7aa4.rra в %ProgramFiles%\InstallShield Installation Information\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\layout.bin
%TEMP%\{A2126CE7-5953-414F-9C2A-BD358825B8FF}\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\isrt425e.rra в %TEMP%\{A2126CE7-5953-414F-9C2A-BD358825B8FF}\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\isrt.dll
%ProgramFiles%\InstallShield Installation Information\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\data7ad3.rra в %ProgramFiles%\InstallShield Installation Information\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\data1.hdr
%ProgramFiles%\InstallShield Installation Information\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\data7b02.rra в %ProgramFiles%\InstallShield Installation Information\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\data1.cab
%ProgramFiles%\InstallShield Installation Information\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\setu7cd7.rra в %ProgramFiles%\InstallShield Installation Information\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\setup.exe
%ProgramFiles%\InstallShield Installation Information\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\_Set7d44.rra в %ProgramFiles%\InstallShield Installation Information\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\_Setup.dll
%ProgramFiles%\InstallShield Installation Information\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\ISSe7d73.rra в %ProgramFiles%\InstallShield Installation Information\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\ISSetup.dll
%ProgramFiles%\InstallShield Installation Information\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\setu7de0.rra в %ProgramFiles%\InstallShield Installation Information\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\setup.inx
%ProgramFiles%\Realtek\Realtek Card Reader\RtsU5a2c.rra в %ProgramFiles%\Realtek\Realtek Card Reader\RtsUVStor.sys
%ProgramFiles%\Realtek\Realtek Card Reader\RtsU5a0d.rra в %ProgramFiles%\Realtek\Realtek Card Reader\RtsUVStor.inf
%ProgramFiles%\Realtek\Realtek Card Reader\RsCR573e.rra в %ProgramFiles%\Realtek\Realtek Card Reader\RsCRIcon.dll
%ProgramFiles%\Realtek\Realtek Card Reader\SetE570f.rra в %ProgramFiles%\Realtek\Realtek Card Reader\SetEHCIKey.exe
%ProgramFiles%\Realtek\Realtek Card Reader\SDRT56f0.rra в %ProgramFiles%\Realtek\Realtek Card Reader\SDRTCPRM.dll
%ProgramFiles%\Realtek\Realtek Card Reader\Rmb56a2.rra в %ProgramFiles%\Realtek\Realtek Card Reader\Rmb.exe
%ProgramFiles%\Realtek\Realtek Card Reader\conf5682.rra в %ProgramFiles%\Realtek\Realtek Card Reader\config.ini
%TEMP%\{A2126CE7-5953-414F-9C2A-BD358825B8FF}\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\_IsR42fa.rra в %TEMP%\{A2126CE7-5953-414F-9C2A-BD358825B8FF}\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\_IsRes.dll
%TEMP%\{A2126CE7-5953-414F-9C2A-BD358825B8FF}\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\defa42bc.rra в %TEMP%\{A2126CE7-5953-414F-9C2A-BD358825B8FF}\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\default.pal
%ProgramFiles%\InstallShield Installation Information\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\pkgc5bf1.rra в %ProgramFiles%\InstallShield Installation Information\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\pkgconf.ini
%TEMP%\{A2126CE7-5953-414F-9C2A-BD358825B8FF}\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\Stri422f.rra в %TEMP%\{A2126CE7-5953-414F-9C2A-BD358825B8FF}\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\StringTable-0009-English.ips
%TEMP%\{A2126CE7-5953-414F-9C2A-BD358825B8FF}\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\VASD41f1.rra в %TEMP%\{A2126CE7-5953-414F-9C2A-BD358825B8FF}\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\VASData.ini
%TEMP%\{A2126CE7-5953-414F-9C2A-BD358825B8FF}\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\DIFx41d1.rra в %TEMP%\{A2126CE7-5953-414F-9C2A-BD358825B8FF}\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\DIFxData.ini
%TEMP%\{A2126CE7-5953-414F-9C2A-BD358825B8FF}\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\Font41a3.rra в %TEMP%\{A2126CE7-5953-414F-9C2A-BD358825B8FF}\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\FontData.ini
%TEMP%\{A2126CE7-5953-414F-9C2A-BD358825B8FF}\dotn4164.rra в %TEMP%\{A2126CE7-5953-414F-9C2A-BD358825B8FF}\dotnetinstaller.exe
%TEMP%\{A2126CE7-5953-414F-9C2A-BD358825B8FF}\core4126.rra в %TEMP%\{A2126CE7-5953-414F-9C2A-BD358825B8FF}\corecomp.ini
%TEMP%\{A2126CE7-5953-414F-9C2A-BD358825B8FF}\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\Hide40b8.rra в %TEMP%\{A2126CE7-5953-414F-9C2A-BD358825B8FF}\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\HideSetupWizard.dll
%ProgramFiles%\InstallShield Installation Information\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\setu7e2f.rra в %ProgramFiles%\InstallShield Installation Information\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}\setup.ini
<SYSTEM32>\sda\SDRTe66e.rra в <SYSTEM32>\sda\SDRTCPRM.dll

Подменяет следующие файлы:

%ProgramFiles%\Realtek\Realtek Card Reader\SDRTCPRM.dll

Другое:

Создает и запускает на исполнение:

'%TEMP%\7zS85B51232\setup.exe'
'%ProgramFiles%\Realtek\Realtek Card Reader\revcon32.exe' RS_dp_add RtsUVStor.inf

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней