Trojan.MulDrop8.32524

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKLM>\SOFTWARE\Classes\BurnAwareOpen\shell\open\command] '' = '"%ProgramFiles%\BurnAware Professional\burnaware.exe"'

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\7zS1.tmp\x.bat
%ProgramFiles%\BurnAware Professional\is-BRL41.tmp
%ProgramFiles%\BurnAware Professional\is-6P6OK.tmp
%ProgramFiles%\BurnAware Professional\is-5T7PP.tmp
%ProgramFiles%\BurnAware Professional\is-3512P.tmp
%ProgramFiles%\BurnAware Professional\is-8PC02.tmp
%ProgramFiles%\BurnAware Professional\is-6Q93P.tmp
%ProgramFiles%\BurnAware Professional\is-I03CH.tmp
%ProgramFiles%\BurnAware Professional\is-M1Q7I.tmp
%ProgramFiles%\BurnAware Professional\is-TOLR0.tmp
%ProgramFiles%\BurnAware Professional\is-V6MPC.tmp
%ProgramFiles%\BurnAware Professional\is-KSM3I.tmp
%ProgramFiles%\BurnAware Professional\is-QJVHM.tmp
%ProgramFiles%\BurnAware Professional\is-HQN0I.tmp
%ALLUSERSPROFILE%\Start Menu\Programs\BurnAware Professional\BurnAware Professional.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\BurnAware Professional\Help.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\BurnAware Professional\Uninstall BurnAware Professional.lnk
%ALLUSERSPROFILE%\Desktop\BurnAware Professional.lnk
%ProgramFiles%\BurnAware Professional\is-7N4QI.tmp
%APPDATA%\Microsoft\Internet Explorer\Quick Launch\BurnAware Professional.lnk
%ProgramFiles%\BurnAware Professional\is-D4O9H.tmp
%ProgramFiles%\BurnAware Professional\is-4BJV5.tmp
%TEMP%\7zS1.tmp\hidcon.exe
%TEMP%\7zS1.tmp\Setup.exe
%TEMP%\7zS1.tmp\Tornado.exe
%TEMP%\is-78S69.tmp\Setup.tmp
%TEMP%\is-H339Q.tmp\_isetup\_RegDLL.tmp
%TEMP%\is-H339Q.tmp\_isetup\_shfoldr.dll
%ProgramFiles%\BurnAware Professional\is-1FAPH.tmp
%ProgramFiles%\BurnAware Professional\is-F4DID.tmp
%ProgramFiles%\BurnAware Professional\is-9NM1T.tmp
%ProgramFiles%\BurnAware Professional\is-04DFP.tmp
%ProgramFiles%\BurnAware Professional\is-OABMC.tmp
%ProgramFiles%\BurnAware Professional\is-OGNTJ.tmp
%ProgramFiles%\BurnAware Professional\is-TA70T.tmp
%ProgramFiles%\BurnAware Professional\is-DGKDL.tmp
%ProgramFiles%\BurnAware Professional\is-PO8QM.tmp
%ProgramFiles%\BurnAware Professional\is-HPDU2.tmp
%ProgramFiles%\BurnAware Professional\is-LGAQ6.tmp
%ProgramFiles%\BurnAware Professional\is-H05H5.tmp
%ProgramFiles%\BurnAware Professional\unins000.dat

Удаляет следующие файлы:

%TEMP%\is-H339Q.tmp\_isetup\_RegDLL.tmp
%TEMP%\is-H339Q.tmp\_isetup\_shfoldr.dll
%TEMP%\is-78S69.tmp\Setup.tmp

Перемещает следующие файлы:

%ProgramFiles%\BurnAware Professional\is-1FAPH.tmp в %ProgramFiles%\BurnAware Professional\unins000.exe
%ProgramFiles%\BurnAware Professional\is-QJVHM.tmp в %ProgramFiles%\BurnAware Professional\FFF.NFO
%ProgramFiles%\BurnAware Professional\is-KSM3I.tmp в %ProgramFiles%\BurnAware Professional\burnaware.bin
%ProgramFiles%\BurnAware Professional\is-V6MPC.tmp в %ProgramFiles%\BurnAware Professional\burnaware.dll
%ProgramFiles%\BurnAware Professional\is-TOLR0.tmp в %ProgramFiles%\BurnAware Professional\NMSDVDXU.dll
%ProgramFiles%\BurnAware Professional\is-M1Q7I.tmp в %ProgramFiles%\BurnAware Professional\FoxSDKU32w.dll
%ProgramFiles%\BurnAware Professional\is-I03CH.tmp в %ProgramFiles%\BurnAware Professional\tags.dll
%ProgramFiles%\BurnAware Professional\is-6Q93P.tmp в %ProgramFiles%\BurnAware Professional\basswma.dll
%ProgramFiles%\BurnAware Professional\is-8PC02.tmp в %ProgramFiles%\BurnAware Professional\bassflac.dll
%ProgramFiles%\BurnAware Professional\is-3512P.tmp в %ProgramFiles%\BurnAware Professional\bass.dll
%ProgramFiles%\BurnAware Professional\is-5T7PP.tmp в %ProgramFiles%\BurnAware Professional\tvqdec.dll
%ProgramFiles%\BurnAware Professional\is-6P6OK.tmp в %ProgramFiles%\BurnAware Professional\FoxWmaPluginU32.dll
%ProgramFiles%\BurnAware Professional\is-BRL41.tmp в %ProgramFiles%\BurnAware Professional\FoxPlayerU32.dll
%ProgramFiles%\BurnAware Professional\is-HQN0I.tmp в %ProgramFiles%\BurnAware Professional\install.bat
%ProgramFiles%\BurnAware Professional\is-7N4QI.tmp в %ProgramFiles%\BurnAware Professional\burnaware.chm
%ProgramFiles%\BurnAware Professional\is-H05H5.tmp в %ProgramFiles%\BurnAware Professional\BurnAware.exe
%ProgramFiles%\BurnAware Professional\is-4BJV5.tmp в %ProgramFiles%\BurnAware Professional\DataRecovery.exe
%ProgramFiles%\BurnAware Professional\is-LGAQ6.tmp в %ProgramFiles%\BurnAware Professional\CopyDisc.exe
%ProgramFiles%\BurnAware Professional\is-HPDU2.tmp в %ProgramFiles%\BurnAware Professional\MakeISO.exe
%ProgramFiles%\BurnAware Professional\is-PO8QM.tmp в %ProgramFiles%\BurnAware Professional\CopyImage.exe
%ProgramFiles%\BurnAware Professional\is-DGKDL.tmp в %ProgramFiles%\BurnAware Professional\EraseDisc.exe
%ProgramFiles%\BurnAware Professional\is-TA70T.tmp в %ProgramFiles%\BurnAware Professional\MP3Disc.exe
%ProgramFiles%\BurnAware Professional\is-OGNTJ.tmp в %ProgramFiles%\BurnAware Professional\DiscInfo.exe
%ProgramFiles%\BurnAware Professional\is-OABMC.tmp в %ProgramFiles%\BurnAware Professional\DataDisc.exe
%ProgramFiles%\BurnAware Professional\is-04DFP.tmp в %ProgramFiles%\BurnAware Professional\DVDVideo.exe
%ProgramFiles%\BurnAware Professional\is-9NM1T.tmp в %ProgramFiles%\BurnAware Professional\BurnImage.exe
%ProgramFiles%\BurnAware Professional\is-F4DID.tmp в %ProgramFiles%\BurnAware Professional\AudioCD.exe
%ProgramFiles%\BurnAware Professional\is-D4O9H.tmp в %ProgramFiles%\BurnAware Professional\MultiBurn.exe
%ProgramFiles%\BurnAware Professional\burnaware.dll в %ProgramFiles%\BurnAware Professional\burnaware.fff

Подменяет следующие файлы:

%ProgramFiles%\BurnAware Professional\burnaware.dll

Другое:

Создает и запускает на исполнение:

'%TEMP%\7zS1.tmp\hidcon.exe' x.bat
'%TEMP%\7zS1.tmp\Setup.exe' /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-
'%TEMP%\is-78S69.tmp\Setup.tmp' /SL5="$400DE,6260326,54272,%TEMP%\7zS1.tmp\Setup.exe" /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-

Запускает на исполнение:

'<SYSTEM32>\cmd.exe' /c x.bat
'<SYSTEM32>\regsvr32.exe' /s "%ProgramFiles%\BurnAware Professional\NMSDVDXU.dll"
'<SYSTEM32>\cmd.exe' /C ""%ProgramFiles%\BurnAware Professional\install.bat""