Trojan.MulDrop8.33532

Техническая информация

Для обеспечения автозапуска и распространения:

Создает или изменяет следующие файлы:

%ALLUSERSPROFILE%\Start Menu\Programs\Startup\WinAP.lnk

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\ext2.tmp
%ProgramFiles%\Gigabyte Technology Corporation\Gigabyte Wireless LAN\ZDTRb0d7.rra
%ProgramFiles%\Gigabyte Technology Corporation\Gigabyte Wireless LAN\ZD12b0a8.rra
%ProgramFiles%\Gigabyte Technology Corporation\Gigabyte Wireless LAN\InsDb089.rra
%ProgramFiles%\InstallShield Installation Information\{51C0BF97-FDBC-4401-872A-1D5724C30AF1}\Setup.ini
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\OBJECTS.DATA
%ProgramFiles%\InstallShield Installation Information\{51C0BF97-FDBC-4401-872A-1D5724C30AF1}\setuaf22.rra
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING2.MAP
%ProgramFiles%\Gigabyte Technology Corporation\Gigabyte Wireless LAN\UNICb0f7.rra
%ProgramFiles%\InstallShield Installation Information\{51C0BF97-FDBC-4401-872A-1D5724C30AF1}\Setuaef3.rra
%ProgramFiles%\InstallShield Installation Information\{51C0BF97-FDBC-4401-872A-1D5724C30AF1}\Setuaee3.rra
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING.VER
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\INDEX.MAP
%ProgramFiles%\InstallShield Installation Information\{51C0BF97-FDBC-4401-872A-1D5724C30AF1}\dataae86.rra
%ProgramFiles%\InstallShield Installation Information\{51C0BF97-FDBC-4401-872A-1D5724C30AF1}\dataae76.rra
%ProgramFiles%\InstallShield Installation Information\{51C0BF97-FDBC-4401-872A-1D5724C30AF1}\layoae57.rra
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\INDEX.BTR
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING1.MAP
%ProgramFiles%\Gigabyte Technology Corporation\Gigabyte Wireless LAN\InsDrvTemp_USB\WA01b3a6.rra
%ALLUSERSPROFILE%\Start Menu\Programs\Gigabyte WLAN (GN-WLBZ series)\WinAP.lnk
%ProgramFiles%\Gigabyte Technology Corporation\Gigabyte Wireless LAN\ZDMLb1c2.rra
%ProgramFiles%\Gigabyte Technology Corporation\Gigabyte Wireless LAN\InsDrvTemp_USB\ZD1Ub4b0.rra
%ProgramFiles%\Gigabyte Technology Corporation\Gigabyte Wireless LAN\InsDrvTemp_USB\ZD12b490.rra
%ProgramFiles%\Gigabyte Technology Corporation\Gigabyte Wireless LAN\InsDrvTemp_USB\ZD1Ub462.rra
%ProgramFiles%\Gigabyte Technology Corporation\Gigabyte Wireless LAN\InsDrvTemp_USB\ZD1Ub452.rra
%ProgramFiles%\Gigabyte Technology Corporation\Gigabyte Wireless LAN\InsDrvTemp_USB\ZD1Ub423.rra
<SYSTEM32>\ZDNDb404.rra
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\OBJECTS.MAP
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\$WinMgmt.CFG
<SYSTEM32>\ZDN5b3c5.rra
%ProgramFiles%\Gigabyte Technology Corporation\Gigabyte Wireless LAN\InsDrvTemp_USB\WS01b387.rra
%ProgramFiles%\Gigabyte Technology Corporation\Gigabyte Wireless LAN\InsDrvTemp_USB\ZD12b368.rra
%ProgramFiles%\Gigabyte Technology Corporation\Gigabyte Wireless LAN\GDisb339.rra
%ProgramFiles%\Gigabyte Technology Corporation\Gigabyte Wireless LAN\RmDeb2eb.rra
%ProgramFiles%\Gigabyte Technology Corporation\Gigabyte Wireless LAN\ZDWib23f.rra
%ProgramFiles%\Gigabyte Technology Corporation\Gigabyte Wireless LAN\ZyDeb21f.rra
%ProgramFiles%\Gigabyte Technology Corporation\Gigabyte Wireless LAN\ZyDeb200.rra
%ProgramFiles%\Gigabyte Technology Corporation\Gigabyte Wireless LAN\ZDCob145.rra
%ProgramFiles%\Gigabyte Technology Corporation\Gigabyte Wireless LAN\ZDMLb174.rra
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\domain.txt
%CommonProgramFiles%\InstallShield\Engine\6\Intel 32\iuse7bec.rra
%CommonProgramFiles%\InstallShield\Engine\6\Intel 32\core796c.rra
%TEMP%\7593.rra
%CommonProgramFiles%\InstallShield\Engine\6\Intel 32\temp.000
%TEMP%\IEC4.tmp
%TEMP%\pft3.tmp\Disk1\layout.bin
%TEMP%\pft3.tmp\Disk1\Setup.inx
%TEMP%\pft3.tmp\Disk1\Setup.ini
%CommonProgramFiles%\InstallShield\Engine\6\Intel 32\ctor79ba.rra
%TEMP%\pft3.tmp\Disk1\Setup.exe
%TEMP%\pft3.tmp\Disk1\data1.cab
%TEMP%\pft3.tmp\Disk1\data1.hdr
%TEMP%\pft3.tmp\Disk1\ikernel.ex_
%TEMP%\pft3.tmp\Disk1\setup.bmp
%TEMP%\pft3.tmp\Disk1\setupXX.bmp
%TEMP%\pft3.tmp\pftw1.pkg
%TEMP%\plf1.tmp
%TEMP%\pft3.tmp\Disk1\data2.cab
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-19
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SAM
%CommonProgramFiles%\InstallShield\IScript\iscr7dc1.rra
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SYSTEM
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SOFTWARE
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SECURITY
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_.DEFAULT
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-21-2052111302-484763869-725345543-1003
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-21-2052111302-484763869-725345543-1003
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-20
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\ComDb.Dat
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-20
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-19
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-18
%TEMP%\{51C0BF97-FDBC-4401-872A-1D5724C30AF1}\_IsR8850.rra
%TEMP%\{51C0BF97-FDBC-4401-872A-1D5724C30AF1}\defa87d3.rra
%TEMP%\{51C0BF97-FDBC-4401-872A-1D5724C30AF1}\isrt8756.rra
%TEMP%\{51C0BF97-FDBC-4401-872A-1D5724C30AF1}\valu86d9.rra
%TEMP%\{51C0BF97-FDBC-4401-872A-1D5724C30AF1}\setu83eb.rra
%CommonProgramFiles%\InstallShield\Engine\6\Intel 32\obje7b7f.rra
%ALLUSERSPROFILE%\Start Menu\Programs\Gigabyte WLAN (GN-WLBZ series)\Uninstall Gigabyte Wireless LAN Package.lnk

Удаляет следующие файлы:

%TEMP%\ext2.tmp
%TEMP%\pft3.tmp\pftw1.pkg
%TEMP%\IEC4.tmp
%ProgramFiles%\Gigabyte Technology Corporation\Gigabyte Wireless LAN\ZyDelReg.exe
%ProgramFiles%\Gigabyte Technology Corporation\Gigabyte Wireless LAN\InsDrvTemp_USB\ZD1UNT.CAT

Перемещает следующие файлы:

%CommonProgramFiles%\InstallShield\Engine\6\Intel 32\temp.000 в %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\IKernel.exe
%ProgramFiles%\Gigabyte Technology Corporation\Gigabyte Wireless LAN\UNICb0f7.rra в %ProgramFiles%\Gigabyte Technology Corporation\Gigabyte Wireless LAN\UNICOWS.DLL
%ProgramFiles%\Gigabyte Technology Corporation\Gigabyte Wireless LAN\ZDCob145.rra в %ProgramFiles%\Gigabyte Technology Corporation\Gigabyte Wireless LAN\ZDConfig.INI
%ProgramFiles%\Gigabyte Technology Corporation\Gigabyte Wireless LAN\ZDMLb174.rra в %ProgramFiles%\Gigabyte Technology Corporation\Gigabyte Wireless LAN\ZDMLa.INI
%ProgramFiles%\Gigabyte Technology Corporation\Gigabyte Wireless LAN\ZDMLb1c2.rra в %ProgramFiles%\Gigabyte Technology Corporation\Gigabyte Wireless LAN\ZDMLu.INI
%ProgramFiles%\Gigabyte Technology Corporation\Gigabyte Wireless LAN\ZyDeb21f.rra в %ProgramFiles%\Gigabyte Technology Corporation\Gigabyte Wireless LAN\ZyDelReg.exe
%ProgramFiles%\Gigabyte Technology Corporation\Gigabyte Wireless LAN\ZDWib23f.rra в %ProgramFiles%\Gigabyte Technology Corporation\Gigabyte Wireless LAN\ZDWinAP.exe
%ProgramFiles%\Gigabyte Technology Corporation\Gigabyte Wireless LAN\RmDeb2eb.rra в %ProgramFiles%\Gigabyte Technology Corporation\Gigabyte Wireless LAN\RmDevice.exe
%ProgramFiles%\Gigabyte Technology Corporation\Gigabyte Wireless LAN\GDisb339.rra в %ProgramFiles%\Gigabyte Technology Corporation\Gigabyte Wireless LAN\GDiskRm.exe
<SYSTEM32>\ZDN5b3c5.rra в <SYSTEM32>\ZDN50.dll
<SYSTEM32>\ZDNDb404.rra в <SYSTEM32>\ZDNDIS5.sys
%ProgramFiles%\Gigabyte Technology Corporation\Gigabyte Wireless LAN\InsDrvTemp_USB\WS01b387.rra в %ProgramFiles%\Gigabyte Technology Corporation\Gigabyte Wireless LAN\InsDrvTemp_USB\WS01UPh.bin
%ProgramFiles%\Gigabyte Technology Corporation\Gigabyte Wireless LAN\InsDrvTemp_USB\ZD1Ub452.rra в %ProgramFiles%\Gigabyte Technology Corporation\Gigabyte Wireless LAN\InsDrvTemp_USB\ZD1U2K.SYS
%ProgramFiles%\Gigabyte Technology Corporation\Gigabyte Wireless LAN\InsDrvTemp_USB\ZD1Ub462.rra в %ProgramFiles%\Gigabyte Technology Corporation\Gigabyte Wireless LAN\InsDrvTemp_USB\ZD1UXP.SYS
%ProgramFiles%\Gigabyte Technology Corporation\Gigabyte Wireless LAN\InsDrvTemp_USB\ZD12b490.rra в %ProgramFiles%\Gigabyte Technology Corporation\Gigabyte Wireless LAN\InsDrvTemp_USB\ZD1201U.INF
%ProgramFiles%\Gigabyte Technology Corporation\Gigabyte Wireless LAN\InsDrvTemp_USB\ZD1Ub4b0.rra в %ProgramFiles%\Gigabyte Technology Corporation\Gigabyte Wireless LAN\InsDrvTemp_USB\ZD1UNT.CAT
%ProgramFiles%\Gigabyte Technology Corporation\Gigabyte Wireless LAN\ZDTRb0d7.rra в %ProgramFiles%\Gigabyte Technology Corporation\Gigabyte Wireless LAN\ZDTRLib.DLL
%ProgramFiles%\Gigabyte Technology Corporation\Gigabyte Wireless LAN\InsDrvTemp_USB\WA01b3a6.rra в %ProgramFiles%\Gigabyte Technology Corporation\Gigabyte Wireless LAN\InsDrvTemp_USB\WA01UPH.b
%ProgramFiles%\Gigabyte Technology Corporation\Gigabyte Wireless LAN\ZD12b0a8.rra в %ProgramFiles%\Gigabyte Technology Corporation\Gigabyte Wireless LAN\ZD12APP.dll
%ProgramFiles%\InstallShield Installation Information\{51C0BF97-FDBC-4401-872A-1D5724C30AF1}\setuaf22.rra в %ProgramFiles%\InstallShield Installation Information\{51C0BF97-FDBC-4401-872A-1D5724C30AF1}\setup.inx
%CommonProgramFiles%\InstallShield\Engine\6\Intel 32\core796c.rra в %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\corecomp.ini
%CommonProgramFiles%\InstallShield\Engine\6\Intel 32\ctor79ba.rra в %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\ctor.dll
%CommonProgramFiles%\InstallShield\Engine\6\Intel 32\obje7b7f.rra в %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\objectps.dll
%CommonProgramFiles%\InstallShield\Engine\6\Intel 32\iuse7bec.rra в %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\iuser.dll
%CommonProgramFiles%\InstallShield\IScript\iscr7dc1.rra в %CommonProgramFiles%\InstallShield\IScript\iscript.dll
%TEMP%\{51C0BF97-FDBC-4401-872A-1D5724C30AF1}\setu83eb.rra в %TEMP%\{51C0BF97-FDBC-4401-872A-1D5724C30AF1}\setup.inx
%TEMP%\{51C0BF97-FDBC-4401-872A-1D5724C30AF1}\valu86d9.rra в %TEMP%\{51C0BF97-FDBC-4401-872A-1D5724C30AF1}\value.shl
%TEMP%\{51C0BF97-FDBC-4401-872A-1D5724C30AF1}\isrt8756.rra в %TEMP%\{51C0BF97-FDBC-4401-872A-1D5724C30AF1}\isrt.dll
%TEMP%\{51C0BF97-FDBC-4401-872A-1D5724C30AF1}\defa87d3.rra в %TEMP%\{51C0BF97-FDBC-4401-872A-1D5724C30AF1}\default.pal
%TEMP%\{51C0BF97-FDBC-4401-872A-1D5724C30AF1}\_IsR8850.rra в %TEMP%\{51C0BF97-FDBC-4401-872A-1D5724C30AF1}\_IsRes.dll
%ProgramFiles%\InstallShield Installation Information\{51C0BF97-FDBC-4401-872A-1D5724C30AF1}\layoae57.rra в %ProgramFiles%\InstallShield Installation Information\{51C0BF97-FDBC-4401-872A-1D5724C30AF1}\layout.bin
%ProgramFiles%\InstallShield Installation Information\{51C0BF97-FDBC-4401-872A-1D5724C30AF1}\dataae76.rra в %ProgramFiles%\InstallShield Installation Information\{51C0BF97-FDBC-4401-872A-1D5724C30AF1}\data1.hdr
%ProgramFiles%\InstallShield Installation Information\{51C0BF97-FDBC-4401-872A-1D5724C30AF1}\dataae86.rra в %ProgramFiles%\InstallShield Installation Information\{51C0BF97-FDBC-4401-872A-1D5724C30AF1}\data1.cab
%ProgramFiles%\InstallShield Installation Information\{51C0BF97-FDBC-4401-872A-1D5724C30AF1}\Setuaee3.rra в %ProgramFiles%\InstallShield Installation Information\{51C0BF97-FDBC-4401-872A-1D5724C30AF1}\Setup.exe
%ProgramFiles%\InstallShield Installation Information\{51C0BF97-FDBC-4401-872A-1D5724C30AF1}\Setuaef3.rra в %ProgramFiles%\InstallShield Installation Information\{51C0BF97-FDBC-4401-872A-1D5724C30AF1}\Setup.ini
%ProgramFiles%\Gigabyte Technology Corporation\Gigabyte Wireless LAN\InsDb089.rra в %ProgramFiles%\Gigabyte Technology Corporation\Gigabyte Wireless LAN\InsDrvZD.dll
%ProgramFiles%\Gigabyte Technology Corporation\Gigabyte Wireless LAN\InsDrvTemp_USB\ZD12b368.rra в %ProgramFiles%\Gigabyte Technology Corporation\Gigabyte Wireless LAN\InsDrvTemp_USB\ZD1201U.SYS

Подменяет следующие файлы:

%ProgramFiles%\Gigabyte Technology Corporation\Gigabyte Wireless LAN\ZyDelReg.exe
%ProgramFiles%\Gigabyte Technology Corporation\Gigabyte Wireless LAN\InsDrvTemp_USB\ZD1UNT.CAT

Другое:

Ищет следующие окна:

ClassName: '' WindowName: 'Gigabyte 802.11b Wireless LAN Monitor'
ClassName: '' WindowName: 'ZyDAS Wireless LAN Configuration Tool '

Создает и запускает на исполнение:

'%TEMP%\pft3.tmp\Disk1\Setup.exe'
'%CommonProgramFiles%\InstallShield\Engine\6\Intel 32\IKernel.exe' -RegServer
'%CommonProgramFiles%\InstallShield\Engine\6\Intel 32\IKernel.exe' 32\IKernel.exe -Embedding
'%CommonProgramFiles%\InstallShield\Engine\6\Intel 32\IKernel.exe' /REGSERVER
'%ProgramFiles%\Gigabyte Technology Corporation\Gigabyte Wireless LAN\ZDWinAP.exe'

Запускает на исполнение:

'<SYSTEM32>\rundll32.exe' "%ProgramFiles%\Gigabyte Technology Corporation\Gigabyte Wireless LAN\InsDrvZD.DLL",ZDInsInf "%ProgramFiles%\Gigabyte Technology Corporation\Gigabyte Wireless LAN\InsDrvTemp_USB\ZD1201U.INF"

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней