Trojan.MulDrop8.30497

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32] 'midimapper' = 'midimap.dll'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32] 'VIDC.HFYU' = 'huffyuv.dll'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32] 'msacm.l3acm' = '<SYSTEM32>\l3codeca.acm'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32] 'vidc.iv50' = 'ir50_32.dll'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32] 'msacm.iac2' = '<SYSTEM32>\iac25_32.ax'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32] 'msacm.sl_anet' = 'sl_anet.acm'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32] 'msacm.msaudio1' = 'msaud32.acm'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32] 'vidc.M261' = 'msh261.drv'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32] 'vidc.M263' = 'msh263.drv'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32] 'msacm.msg723' = 'msg723.acm'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32] 'wavemapper' = 'msacm32.drv'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32] 'vidc.yvyu' = 'msyuv.dll'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32] 'vidc.yvu9' = 'tsbyuv.dll'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32] 'vidc.yuy2' = 'msyuv.dll'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32] 'vidc.uyvy' = 'msyuv.dll'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32] 'vidc.msvc' = 'msvidc32.dll'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32] 'vidc.mrle' = 'msrle32.dll'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32] 'vidc.iyuv' = 'iyuv_32.dll'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32] 'vidc.iv41' = 'ir41_32.ax'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32] 'vidc.iv32' = 'ir32_32.dll'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32] 'vidc.iv31' = 'ir32_32.dll'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32] 'vidc.I420' = 'msh263.drv'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32] 'vidc.cvid' = 'iccvid.dll'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32] 'msacm.trspch' = 'tssoft32.acm'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32] 'msacm.msgsm610' = 'msgsm32.acm'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32] 'msacm.msg711' = 'msg711.acm'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32] 'msacm.msadpcm' = 'msadp32.acm'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32] 'msacm.imaadpcm' = 'imaadp32.acm'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] 'GrpConv' = 'grpconv -o'
[<HKLM>\SOFTWARE\Classes\MSProgramGroup\Shell\Open\Command] '' = '<SYSTEM32>\grpconv.exe %1'

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\nsr2.tmp\UAC.dll
%TEMP%\nsr2.tmp\sib.dat
%TEMP%\nsr2.tmp\setup\setup.exe
%TEMP%\nsr2.tmp\NActions.dll
%TEMP%\is-06I2A.tmp\setup.tmp
%TEMP%\is-SBO9V.tmp\_isetup\_shfoldr.dll
C:\is-F6VPO.tmp
C:\is-282GT.tmp
C:\is-IQADU.tmp
%ALLUSERSPROFILE%\Start Menu\Programs\(Default)\Uninstall Green Video Fix.lnk
%WINDIR%\inf\SET7.tmp
<SYSTEM32>\SET8.tmp

Удаляет следующие файлы:

C:\huffyuv x32.bat
C:\huffyuv.dll
C:\huffyuv.inf
%TEMP%\is-SBO9V.tmp\_isetup\_shfoldr.dll

Перемещает следующие файлы:

C:\is-F6VPO.tmp в C:\huffyuv x32.bat
C:\is-282GT.tmp в C:\huffyuv.dll
C:\is-IQADU.tmp в C:\huffyuv.inf
%WINDIR%\inf\SET7.tmp в %WINDIR%\inf\HUFFYUV.INF
<SYSTEM32>\SET8.tmp в <SYSTEM32>\HUFFYUV.DLL

Другое:

Создает и запускает на исполнение:

'%TEMP%\nsr2.tmp\setup\setup.exe' /SILENT
'%TEMP%\is-06I2A.tmp\setup.tmp' /SL5="$300DE,89517,54272,%TEMP%\nsr2.tmp\setup\setup.exe" /SILENT

Запускает на исполнение:

'<SYSTEM32>\cmd.exe' /C ""C:\huffyuv x32.bat""
'<SYSTEM32>\rundll32.exe' setupapi.dll,InstallHinfSection DefaultInstall 0 C:\huffyuv.inf
'<SYSTEM32>\runonce.exe' -r
'<SYSTEM32>\grpconv.exe' -o