Trojan.MulDrop8.31128

Техническая информация

Для обеспечения автозапуска и распространения:

Создает следующие сервисы:

[<HKLM>\SYSTEM\ControlSet001\Services\RSUSBVSTOR] 'ImagePath' = 'System32\Drivers\RTSUVSTOR.sys'

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\7zS02B254D1\package.exe
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-20
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-20
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-19
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-19
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-18
%ProgramFiles%\Realtek\Realtek USB 2.0 Reader Driver\Disp866c.rra
<DRIVERS>\RtsU85ef.rra
<DRIVERS>\disk85c0.rra
%ProgramFiles%\Realtek\Realtek USB 2.0 Reader Driver\SDRT8572.rra
%ProgramFiles%\Realtek\Realtek USB 2.0 Reader Driver\rtsu82e2.rra
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-21-2052111302-484763869-725345543-1003
%ProgramFiles%\Realtek\Realtek USB 2.0 Reader Driver\RtsU82a3.rra
%ProgramFiles%\Realtek\Realtek USB 2.0 Reader Driver\rtsu8255.rra
%ProgramFiles%\Realtek\Realtek USB 2.0 Reader Driver\revc8217.rra
%ProgramFiles%\Realtek\Realtek USB 2.0 Reader Driver\disk81f7.rra
%ProgramFiles%\Realtek\Realtek USB 2.0 Reader Driver\disk81d8.rra
%ProgramFiles%\Realtek\Realtek USB 2.0 Reader Driver\Remo81b9.rra
%ProgramFiles%\Realtek\Realtek USB 2.0 Reader Driver\Inst819a.rra
%ProgramFiles%\Realtek\Realtek USB 2.0 Reader Driver\Enab816b.rra
%ProgramFiles%\Realtek\Realtek USB 2.0 Reader Driver\Disa814b.rra
%ProgramFiles%\Realtek\Realtek USB 2.0 Reader Driver\addf811d.rra
%TEMP%\{50E94E2E-7419-49A7-8734-CAE535451175}\{62BBB2F0-E220-4821-A564-730807D2C34D}\_IsR768d.rra
%ProgramFiles%\Realtek\Realtek USB 2.0 Reader Driver\rtsu8284.rra
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-21-2052111302-484763869-725345543-1003
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_.DEFAULT
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SECURITY
<SYSTEM32>\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\oem3.CAT
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\OBJECTS.MAP
%ProgramFiles%\InstallShield Installation Information\{62BBB2F0-E220-4821-A564-730807D2C34D}\setup.ini
%ProgramFiles%\InstallShield Installation Information\{62BBB2F0-E220-4821-A564-730807D2C34D}\setuab98.rra
%ProgramFiles%\InstallShield Installation Information\{62BBB2F0-E220-4821-A564-730807D2C34D}\setuab69.rra
%ProgramFiles%\InstallShield Installation Information\{62BBB2F0-E220-4821-A564-730807D2C34D}\ISSeab2a.rra
%ProgramFiles%\InstallShield Installation Information\{62BBB2F0-E220-4821-A564-730807D2C34D}\_Setaaec.rra
%ProgramFiles%\InstallShield Installation Information\{62BBB2F0-E220-4821-A564-730807D2C34D}\setuaa8e.rra
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\OBJECTS.DATA
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING2.MAP
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING1.MAP
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING.VER
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\INDEX.MAP
%ProgramFiles%\InstallShield Installation Information\{62BBB2F0-E220-4821-A564-730807D2C34D}\dataa994.rra
%ProgramFiles%\InstallShield Installation Information\{62BBB2F0-E220-4821-A564-730807D2C34D}\dataa975.rra
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\INDEX.BTR
%ProgramFiles%\InstallShield Installation Information\{62BBB2F0-E220-4821-A564-730807D2C34D}\layoa955.rra
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\$WinMgmt.CFG
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\domain.txt
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\ComDb.Dat
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SAM
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SYSTEM
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SOFTWARE
%TEMP%\{50E94E2E-7419-49A7-8734-CAE535451175}\{62BBB2F0-E220-4821-A564-730807D2C34D}\defa765f.rra
%WINDIR%\inf\oem3.inf
%TEMP%\{50E94E2E-7419-49A7-8734-CAE535451175}\{62BBB2F0-E220-4821-A564-730807D2C34D}\isrt7610.rra
%TEMP%\{50E94E2E-7419-49A7-8734-CAE535451175}\{62BBB2F0-E220-4821-A564-730807D2C34D}\DIFx75c2.rra
C:\Drivers\Realtek USB 2.0 Reader Driver\DriverBin_32bit\rtsuvstor.inf
C:\Drivers\Realtek USB 2.0 Reader Driver\DriverBin_32bit\rtsuvstor.cat
C:\Drivers\Realtek USB 2.0 Reader Driver\DriverBin_32bit\revcon.exe
C:\Drivers\Realtek USB 2.0 Reader Driver\DriverBin_32bit\diskperf.sys
C:\Drivers\Realtek USB 2.0 Reader Driver\DriverBin_32bit\diskperf.inf
C:\Drivers\Realtek USB 2.0 Reader Driver\DisplayIcon.ICO
C:\Drivers\Realtek USB 2.0 Reader Driver\data2.cab
C:\Drivers\Realtek USB 2.0 Reader Driver\data1.hdr
C:\Drivers\Realtek USB 2.0 Reader Driver\data1.cab
C:\Drivers\Realtek USB 2.0 Reader Driver\APBin_64bit\Remove.reg
C:\Drivers\Realtek USB 2.0 Reader Driver\DriverBin_32bit\RtsUVStor.sys
C:\Drivers\Realtek USB 2.0 Reader Driver\APBin_64bit\Install.reg
C:\Drivers\Realtek USB 2.0 Reader Driver\APBin_64bit\Disable64.bat
C:\Drivers\Realtek USB 2.0 Reader Driver\APBin_64bit\addfilter64.exe
C:\Drivers\Realtek USB 2.0 Reader Driver\APBin_32bit\Remove.reg
C:\Drivers\Realtek USB 2.0 Reader Driver\APBin_32bit\Install.reg
C:\Drivers\Realtek USB 2.0 Reader Driver\APBin_32bit\Enable.bat
C:\Drivers\Realtek USB 2.0 Reader Driver\APBin_32bit\Disable.bat
C:\Drivers\Realtek USB 2.0 Reader Driver\APBin_32bit\addfilter.exe
%TEMP%\pft3.tmp\pftw1.pkg
%TEMP%\plf1.tmp
%TEMP%\ext2.tmp
C:\Drivers\Realtek USB 2.0 Reader Driver\APBin_64bit\Enable64.bat
C:\Drivers\Realtek USB 2.0 Reader Driver\DriverBin_32bit\rtsuvstorIcon.dll
C:\Drivers\Realtek USB 2.0 Reader Driver\DriverBin_32bit\SDRTCPRM.dll
C:\Drivers\Realtek USB 2.0 Reader Driver\DriverBin_64bit\diskperf64.cat
%TEMP%\{50E94E2E-7419-49A7-8734-CAE535451175}\{62BBB2F0-E220-4821-A564-730807D2C34D}\Font7593.rra
%TEMP%\{50E94E2E-7419-49A7-8734-CAE535451175}\dotn7565.rra
%TEMP%\{50E94E2E-7419-49A7-8734-CAE535451175}\core7536.rra
%TEMP%\{50E94E2E-7419-49A7-8734-CAE535451175}\{62BBB2F0-E220-4821-A564-730807D2C34D}\setu74d8.rra
%TEMP%\7209.rra
%TEMP%\{01AEB2BD-9CE0-4D98-9AFC-35556CEAF708}\setup.ini
%TEMP%\{01AEB2BD-9CE0-4D98-9AFC-35556CEAF708}\_Setup.dll
C:\Drivers\Realtek USB 2.0 Reader Driver\_Setup.dll
C:\Drivers\Realtek USB 2.0 Reader Driver\usetup.iss
C:\Drivers\Realtek USB 2.0 Reader Driver\setup.iss
C:\Drivers\Realtek USB 2.0 Reader Driver\setup.inx
C:\Drivers\Realtek USB 2.0 Reader Driver\setup.ini
C:\Drivers\Realtek USB 2.0 Reader Driver\setup.exe
C:\Drivers\Realtek USB 2.0 Reader Driver\ReadMe.txt
C:\Drivers\Realtek USB 2.0 Reader Driver\layout.bin
C:\Drivers\Realtek USB 2.0 Reader Driver\ISSetup.dll
C:\Drivers\Realtek USB 2.0 Reader Driver\DriverBin_64bit\rtsuvstorIcon.dll
C:\Drivers\Realtek USB 2.0 Reader Driver\DriverBin_64bit\rtsuvstor.sys
C:\Drivers\Realtek USB 2.0 Reader Driver\DriverBin_64bit\rtsuvstor.inf
C:\Drivers\Realtek USB 2.0 Reader Driver\DriverBin_64bit\rtsuvstor.cat
C:\Drivers\Realtek USB 2.0 Reader Driver\DriverBin_64bit\revcon.exe
C:\Drivers\Realtek USB 2.0 Reader Driver\DriverBin_64bit\diskperf64.sys
C:\Drivers\Realtek USB 2.0 Reader Driver\DriverBin_64bit\diskperf64.inf
%TEMP%\{50E94E2E-7419-49A7-8734-CAE535451175}\{62BBB2F0-E220-4821-A564-730807D2C34D}\Stri75f1.rra
%WINDIR%\inf\oem3.PNF

Присваивает атрибут 'скрытый' для следующих файлов:

<SYSTEM32>\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\oem3.CAT

Удаляет следующие файлы:

%TEMP%\ext2.tmp
%TEMP%\pft3.tmp\pftw1.pkg

Перемещает следующие файлы:

%TEMP%\{50E94E2E-7419-49A7-8734-CAE535451175}\{62BBB2F0-E220-4821-A564-730807D2C34D}\setu74d8.rra в %TEMP%\{50E94E2E-7419-49A7-8734-CAE535451175}\{62BBB2F0-E220-4821-A564-730807D2C34D}\setup.inx
%ProgramFiles%\InstallShield Installation Information\{62BBB2F0-E220-4821-A564-730807D2C34D}\ISSeab2a.rra в %ProgramFiles%\InstallShield Installation Information\{62BBB2F0-E220-4821-A564-730807D2C34D}\ISSetup.dll
%ProgramFiles%\InstallShield Installation Information\{62BBB2F0-E220-4821-A564-730807D2C34D}\_Setaaec.rra в %ProgramFiles%\InstallShield Installation Information\{62BBB2F0-E220-4821-A564-730807D2C34D}\_Setup.dll
%ProgramFiles%\InstallShield Installation Information\{62BBB2F0-E220-4821-A564-730807D2C34D}\setuaa8e.rra в %ProgramFiles%\InstallShield Installation Information\{62BBB2F0-E220-4821-A564-730807D2C34D}\setup.exe
%ProgramFiles%\InstallShield Installation Information\{62BBB2F0-E220-4821-A564-730807D2C34D}\dataa994.rra в %ProgramFiles%\InstallShield Installation Information\{62BBB2F0-E220-4821-A564-730807D2C34D}\data1.cab
%ProgramFiles%\InstallShield Installation Information\{62BBB2F0-E220-4821-A564-730807D2C34D}\dataa975.rra в %ProgramFiles%\InstallShield Installation Information\{62BBB2F0-E220-4821-A564-730807D2C34D}\data1.hdr
%ProgramFiles%\InstallShield Installation Information\{62BBB2F0-E220-4821-A564-730807D2C34D}\layoa955.rra в %ProgramFiles%\InstallShield Installation Information\{62BBB2F0-E220-4821-A564-730807D2C34D}\layout.bin
%ProgramFiles%\Realtek\Realtek USB 2.0 Reader Driver\Disp866c.rra в %ProgramFiles%\Realtek\Realtek USB 2.0 Reader Driver\DisplayIcon.ico
<DRIVERS>\RtsU85ef.rra в <DRIVERS>\RtsUVStor.sys
<DRIVERS>\disk85c0.rra в <DRIVERS>\diskperf.sys
%ProgramFiles%\Realtek\Realtek USB 2.0 Reader Driver\SDRT8572.rra в %ProgramFiles%\Realtek\Realtek USB 2.0 Reader Driver\SDRTCPRM.dll
%ProgramFiles%\Realtek\Realtek USB 2.0 Reader Driver\rtsu82e2.rra в %ProgramFiles%\Realtek\Realtek USB 2.0 Reader Driver\rtsuvstorIcon.dll
%ProgramFiles%\Realtek\Realtek USB 2.0 Reader Driver\RtsU82a3.rra в %ProgramFiles%\Realtek\Realtek USB 2.0 Reader Driver\RtsUVStor.sys
%ProgramFiles%\Realtek\Realtek USB 2.0 Reader Driver\rtsu8284.rra в %ProgramFiles%\Realtek\Realtek USB 2.0 Reader Driver\rtsuvstor.inf
%ProgramFiles%\Realtek\Realtek USB 2.0 Reader Driver\rtsu8255.rra в %ProgramFiles%\Realtek\Realtek USB 2.0 Reader Driver\rtsuvstor.cat
%ProgramFiles%\InstallShield Installation Information\{62BBB2F0-E220-4821-A564-730807D2C34D}\setuab69.rra в %ProgramFiles%\InstallShield Installation Information\{62BBB2F0-E220-4821-A564-730807D2C34D}\setup.inx
%ProgramFiles%\Realtek\Realtek USB 2.0 Reader Driver\revc8217.rra в %ProgramFiles%\Realtek\Realtek USB 2.0 Reader Driver\revcon.exe
%ProgramFiles%\Realtek\Realtek USB 2.0 Reader Driver\disk81d8.rra в %ProgramFiles%\Realtek\Realtek USB 2.0 Reader Driver\diskperf.inf
%ProgramFiles%\Realtek\Realtek USB 2.0 Reader Driver\Remo81b9.rra в %ProgramFiles%\Realtek\Realtek USB 2.0 Reader Driver\Remove.reg
%ProgramFiles%\Realtek\Realtek USB 2.0 Reader Driver\Inst819a.rra в %ProgramFiles%\Realtek\Realtek USB 2.0 Reader Driver\Install.reg
%ProgramFiles%\Realtek\Realtek USB 2.0 Reader Driver\Enab816b.rra в %ProgramFiles%\Realtek\Realtek USB 2.0 Reader Driver\Enable.bat
%ProgramFiles%\Realtek\Realtek USB 2.0 Reader Driver\Disa814b.rra в %ProgramFiles%\Realtek\Realtek USB 2.0 Reader Driver\Disable.bat
%ProgramFiles%\Realtek\Realtek USB 2.0 Reader Driver\addf811d.rra в %ProgramFiles%\Realtek\Realtek USB 2.0 Reader Driver\addfilter.exe
%TEMP%\{50E94E2E-7419-49A7-8734-CAE535451175}\{62BBB2F0-E220-4821-A564-730807D2C34D}\_IsR768d.rra в %TEMP%\{50E94E2E-7419-49A7-8734-CAE535451175}\{62BBB2F0-E220-4821-A564-730807D2C34D}\_IsRes.dll
%TEMP%\{50E94E2E-7419-49A7-8734-CAE535451175}\{62BBB2F0-E220-4821-A564-730807D2C34D}\defa765f.rra в %TEMP%\{50E94E2E-7419-49A7-8734-CAE535451175}\{62BBB2F0-E220-4821-A564-730807D2C34D}\default.pal
%TEMP%\{50E94E2E-7419-49A7-8734-CAE535451175}\{62BBB2F0-E220-4821-A564-730807D2C34D}\isrt7610.rra в %TEMP%\{50E94E2E-7419-49A7-8734-CAE535451175}\{62BBB2F0-E220-4821-A564-730807D2C34D}\isrt.dll
%TEMP%\{50E94E2E-7419-49A7-8734-CAE535451175}\{62BBB2F0-E220-4821-A564-730807D2C34D}\Stri75f1.rra в %TEMP%\{50E94E2E-7419-49A7-8734-CAE535451175}\{62BBB2F0-E220-4821-A564-730807D2C34D}\StringTable-0009-English.ips
%TEMP%\{50E94E2E-7419-49A7-8734-CAE535451175}\{62BBB2F0-E220-4821-A564-730807D2C34D}\DIFx75c2.rra в %TEMP%\{50E94E2E-7419-49A7-8734-CAE535451175}\{62BBB2F0-E220-4821-A564-730807D2C34D}\DIFxData.ini
%TEMP%\{50E94E2E-7419-49A7-8734-CAE535451175}\{62BBB2F0-E220-4821-A564-730807D2C34D}\Font7593.rra в %TEMP%\{50E94E2E-7419-49A7-8734-CAE535451175}\{62BBB2F0-E220-4821-A564-730807D2C34D}\FontData.ini
%TEMP%\{50E94E2E-7419-49A7-8734-CAE535451175}\dotn7565.rra в %TEMP%\{50E94E2E-7419-49A7-8734-CAE535451175}\dotnetinstaller.exe
%TEMP%\{50E94E2E-7419-49A7-8734-CAE535451175}\core7536.rra в %TEMP%\{50E94E2E-7419-49A7-8734-CAE535451175}\corecomp.ini
%ProgramFiles%\Realtek\Realtek USB 2.0 Reader Driver\disk81f7.rra в %ProgramFiles%\Realtek\Realtek USB 2.0 Reader Driver\diskperf.sys
%ProgramFiles%\InstallShield Installation Information\{62BBB2F0-E220-4821-A564-730807D2C34D}\setuab98.rra в %ProgramFiles%\InstallShield Installation Information\{62BBB2F0-E220-4821-A564-730807D2C34D}\setup.ini

Другое:

Создает и запускает на исполнение:

'%TEMP%\7zS02B254D1\package.exe'
'C:\Drivers\Realtek USB 2.0 Reader Driver\setup.exe'
'%ProgramFiles%\Realtek\Realtek USB 2.0 Reader Driver\revcon.exe' rescan USB\VID_0BDA&PID_0139
'%ProgramFiles%\Realtek\Realtek USB 2.0 Reader Driver\revcon.exe' rescan USB\VID_0BDA&PID_0129
'%ProgramFiles%\Realtek\Realtek USB 2.0 Reader Driver\revcon.exe' RS_dp_add RTSUVSTOR.inf
'%ProgramFiles%\Realtek\Realtek USB 2.0 Reader Driver\revcon.exe' RS_update RTSUVSTOR.inf USB\VID_0BDA&PID_0139

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней