Trojan.MulDrop8.58538

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKLM>\SOFTWARE\Classes\FlashBack Movie\shell\open\command] '' = '"%ProgramFiles%\Blueberry Software\FlashBack Pro 5\FlashBack Player.exe" "%1"'

Вредоносные функции:

Запускает на исполнение:

'<SYSTEM32>\taskkill.exe' /IM FlashBack Player.exe /F
'<SYSTEM32>\taskkill.exe' /IM FlashBack Recorder.exe /F

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\7ZipSfx.000\BBFlashback\TNCTR - Turkish Network Community.url
%ProgramFiles%\Blueberry Software\FlashBack Pro 5\MicroPlayerLangs\en\Watermark.bmp
%ProgramFiles%\Blueberry Software\FlashBack Pro 5\SWFControlBars\AS2toolbars.flp
%ProgramFiles%\Blueberry Software\FlashBack Pro 5\SWFControlBars\AS3toolbars.flp
%ProgramFiles%\Blueberry Software\FlashBack Pro 5\SWFControlBars\DefaultControlBar.fla
%ProgramFiles%\Blueberry Software\FlashBack Pro 5\SWFControlBars\DefaultControlBar.swf
%ProgramFiles%\Blueberry Software\FlashBack Pro 5\SWFControlBars\DefaultControlBarCoolWhite.fla
%ProgramFiles%\Blueberry Software\FlashBack Pro 5\SWFControlBars\DefaultControlBarCoolWhite.swf
%ProgramFiles%\Blueberry Software\FlashBack Pro 5\SWFControlBars\DefaultControlBarCoolWhiteSingle.fla
%ProgramFiles%\Blueberry Software\FlashBack Pro 5\SWFControlBars\DefaultControlBarCoolWhiteSingle.swf
%ProgramFiles%\Blueberry Software\FlashBack Pro 5\MicroPlayerLangs\en\Help.gif
%ProgramFiles%\Blueberry Software\FlashBack Pro 5\MicroPlayerLangs\en\resources.txt
%ProgramFiles%\Blueberry Software\FlashBack Pro 5\SWFControlBars\DefaultControlBarMediaPlayer.fla
%ProgramFiles%\Blueberry Software\FlashBack Pro 5\SWFControlBars\DefaultControlBarMediaPlayerSingle.swf
%ProgramFiles%\Blueberry Software\FlashBack Pro 5\SWFControlBars\DefaultControlBarSingle.fla
%ProgramFiles%\Blueberry Software\FlashBack Pro 5\SWFControlBars\DefaultControlBarSingle.swf
%ProgramFiles%\Blueberry Software\FlashBack Pro 5\SWFControlBars\DefaultControlBar3.fla
%ProgramFiles%\Blueberry Software\FlashBack Pro 5\SWFControlBars\DefaultControlBar3.swf
%ProgramFiles%\Blueberry Software\FlashBack Pro 5\SWFControlBars\DefaultControlBarCoolWhite3.fla
%ProgramFiles%\Blueberry Software\FlashBack Pro 5\SWFControlBars\DefaultControlBarCoolWhite3.swf
%ProgramFiles%\Blueberry Software\FlashBack Pro 5\SWFControlBars\DefaultControlBarMediaPlayer3.fla
%ProgramFiles%\Blueberry Software\FlashBack Pro 5\SWFControlBars\DefaultControlBarMediaPlayer3.swf
%ProgramFiles%\Blueberry Software\FlashBack Pro 5\SWFControlBars\DefaultControlBarMediaPlayer.swf
%ProgramFiles%\Blueberry Software\FlashBack Pro 5\SWFControlBars\DefaultControlBarMediaPlayerSingle.fla
%ProgramFiles%\Blueberry Software\FlashBack Pro 5\SWFControlBars\AS2\common.as
%ProgramFiles%\Blueberry Software\FlashBack Pro 5\SWFControlBars\description.txt
%ProgramFiles%\Blueberry Software\FlashBack Pro 5\DefaultTextBoxStyles\Postit.xml
%ProgramFiles%\Blueberry Software\FlashBack Pro 5\Custom\RightMouseDown1.png
%ProgramFiles%\Blueberry Software\FlashBack Pro 5\Custom\RightMouseDown2.png
%ProgramFiles%\Blueberry Software\FlashBack Pro 5\Custom\RightMouseDown3.png
%ProgramFiles%\Blueberry Software\FlashBack Pro 5\Custom\RightMouseUp1.png
%ProgramFiles%\Blueberry Software\FlashBack Pro 5\Custom\RightMouseUp2.png
%ProgramFiles%\Blueberry Software\FlashBack Pro 5\Custom\RightMouseUp3.png
%ProgramFiles%\Blueberry Software\FlashBack Pro 5\Custom\WheelMouseDown1.bmp
%ProgramFiles%\Blueberry Software\FlashBack Pro 5\Custom\WheelMouseDown2.bmp
%ProgramFiles%\Blueberry Software\FlashBack Pro 5\DefaultTextBoxStyles\Purple - dark.xml
%ProgramFiles%\Blueberry Software\FlashBack Pro 5\Custom\RightMouseDblClk2.png
%ProgramFiles%\Blueberry Software\FlashBack Pro 5\DefaultTextBoxStyles\Purple - light.xml
%ProgramFiles%\Blueberry Software\FlashBack Pro 5\Custom\WheelMouseDown3.bmp
%ProgramFiles%\Blueberry Software\FlashBack Pro 5\DefaultTextBoxStyles\Blue - dark.xml
%ProgramFiles%\Blueberry Software\FlashBack Pro 5\DefaultTextBoxStyles\Blue - light.xml
%ProgramFiles%\Blueberry Software\FlashBack Pro 5\DefaultTextBoxStyles\Green - dark.xml
%ProgramFiles%\Blueberry Software\FlashBack Pro 5\DefaultTextBoxStyles\Green - light.xml
%ProgramFiles%\Blueberry Software\FlashBack Pro 5\DefaultTextBoxStyles\Grey - dark.xml
%ProgramFiles%\Blueberry Software\FlashBack Pro 5\DefaultTextBoxStyles\Grey - light.xml
%ProgramFiles%\Blueberry Software\FlashBack Pro 5\DefaultTextBoxStyles\Longhorn.xml
%ProgramFiles%\Blueberry Software\FlashBack Pro 5\DefaultTextBoxStyles\Orange.xml
%ProgramFiles%\Blueberry Software\FlashBack Pro 5\Custom\WheelMouseUp1.bmp
%ProgramFiles%\Blueberry Software\FlashBack Pro 5\Custom\WheelMouseUp2.bmp
%ProgramFiles%\Blueberry Software\FlashBack Pro 5\Custom\WheelMouseUp3.bmp
%ProgramFiles%\Blueberry Software\FlashBack Pro 5\LogSysUploadCenterClient.dll
%ProgramFiles%\Blueberry Software\FlashBack Pro 5\SWFControlBars\AS2\commonMultiple.as
%ProgramFiles%\Blueberry Software\FlashBack Pro 5\FBO\Blueberry.S3FileTransfer.dll
%ProgramFiles%\Blueberry Software\FlashBack Pro 5\FBO\default.ExportToFLV.xml
%ProgramFiles%\Blueberry Software\FlashBack Pro 5\FBO\FTSClient.dll
%ProgramFiles%\Blueberry Software\FlashBack Pro 5\FBO\FTSUploadAgent.exe
%ProgramFiles%\Blueberry Software\FlashBack Pro 5\FBO\FTSUploadAgent.exe.config
%ProgramFiles%\Blueberry Software\FlashBack Pro 5\FBO\LogSys.Client.NET35.dll
%ALLUSERSPROFILE%\Start Menu\Programs\Blueberry Software\FlashBack Pro 5\FlashBack Pro 5 Player.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\Blueberry Software\FlashBack Pro 5\FlashBack Pro 5 Recorder.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\Blueberry Software\FlashBack Pro 5\FlashBack Pro 5 Batch Export.lnk
%ProgramFiles%\Blueberry Software\FlashBack Pro 5\FBO\Blueberry.Logger.dll
%ALLUSERSPROFILE%\Start Menu\Programs\Blueberry Software\FlashBack Pro 5\FlashBack Pro 5 Help.lnk
%ProgramFiles%\Blueberry Software\FlashBack Pro 5\FBO\Blueberry.TDFHandler.dll
%ALLUSERSPROFILE%\Start Menu\Programs\Blueberry Software\FlashBack Pro 5\Support\Enable Logging Autorun.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\Blueberry Software\FlashBack Pro 5\Uninstall FlashBack Pro 5.lnk
%TEMP%\nsx3.tmp\System.dll
%ALLUSERSPROFILE%\Application Data\LogSys\LogSys Server.xml
%APPDATA%\LogSys\LogSys Server.xml
%TEMP%\nsx3.tmp\nsExec.dll
%TEMP%\nsx3.tmp\ns4.tmp
%APPDATA%\Blueberry\FlashBack5 Profiles.xml
%APPDATA%\Blueberry\FlashBack5 File Copy.xml
%ALLUSERSPROFILE%\Start Menu\Programs\Blueberry Software\FlashBack Pro 5\Support\Report Problem to Blueberry.lnk
%ProgramFiles%\Blueberry Software\FlashBack Pro 5\FBO\AWSSDK.dll
%ALLUSERSPROFILE%\Start Menu\Programs\Blueberry Software\FlashBack Pro 5\Support\Help on Problem Reporting.lnk
%ProgramFiles%\Blueberry Software\FlashBack Pro 5\API\TestApp\FBAPITestApp.exe
%ProgramFiles%\Blueberry Software\FlashBack Pro 5\API\TestApp\MainUnit.dfm
%ProgramFiles%\Blueberry Software\FlashBack Pro 5\SWFControlBars\AS2\expiring_checking.as
%ProgramFiles%\Blueberry Software\FlashBack Pro 5\SWFControlBars\AS2\password_checking.as
%ProgramFiles%\Blueberry Software\FlashBack Pro 5\SWFControlBars\AS3\ButtonElement.as
%ProgramFiles%\Blueberry Software\FlashBack Pro 5\SWFControlBars\AS3\Common.as
%ProgramFiles%\Blueberry Software\FlashBack Pro 5\SWFControlBars\AS3\CommonMultiple.as
%ProgramFiles%\Blueberry Software\FlashBack Pro 5\SWFControlBars\AS3\CommonSingle.as
%ProgramFiles%\Blueberry Software\FlashBack Pro 5\SWFControlBars\AS3\Element.as
%ProgramFiles%\Blueberry Software\FlashBack Pro 5\SWFControlBars\AS3\Elements.as
%ProgramFiles%\Blueberry Software\FlashBack Pro 5\SWFControlBars\AS3\Flashvars.as
%ProgramFiles%\Blueberry Software\FlashBack Pro 5\UploadProfiles\default.ExportToFLV.xml
%ProgramFiles%\Blueberry Software\FlashBack Pro 5\UploadProfiles\DefConfig.exe
%ProgramFiles%\Blueberry Software\FlashBack Pro 5\SWFControlBars\AS2\flashvars.as
%ProgramFiles%\Blueberry Software\FlashBack Pro 5\UploadProfiles\FileCopyPublisher.dll
%ProgramFiles%\Blueberry Software\FlashBack Pro 5\UploadProfiles\PublishConfigurator.dll
%ProgramFiles%\Blueberry Software\FlashBack Pro 5\UploadProfiles\YouTubePublisher.dll
%ProgramFiles%\Blueberry Software\FlashBack Pro 5\API\FBAPI.txt
%ProgramFiles%\Blueberry Software\FlashBack Pro 5\API\FBAPIWrap\FBAPIWrap.h
%ProgramFiles%\Blueberry Software\FlashBack Pro 5\API\FBAPIWrap\FBAPIWrap.cpp
%ProgramFiles%\Blueberry Software\FlashBack Pro 5\API\TestApp\FBAPITestApp.bpr
%ProgramFiles%\Blueberry Software\FlashBack Pro 5\API\TestApp\FBAPITestApp.cpp
%ProgramFiles%\Blueberry Software\FlashBack Pro 5\API\TestApp\MainUnit.h
%ProgramFiles%\Blueberry Software\FlashBack Pro 5\API\TestApp\MainUnit.cpp
%ProgramFiles%\Blueberry Software\FlashBack Pro 5\Custom\RightMouseDblClk1.png
%ProgramFiles%\Blueberry Software\FlashBack Pro 5\UploadProfiles\FtpPublisher.dll
%ProgramFiles%\Blueberry Software\FlashBack Pro 5\Custom\RightMouseDblClk3.png
%ProgramFiles%\Blueberry Software\FlashBack Pro 5\Custom\MiddleMouseUp3.png
%ProgramFiles%\Blueberry Software\FlashBack Pro 5\Custom\MiddleMouseUp2.png
%ProgramFiles%\Blueberry Software\FlashBack Pro 5\Custom\MiddleMouseUp1.png
%ProgramFiles%\Blueberry Software\FlashBack Pro 5\avcodec-52.dll
%ProgramFiles%\Blueberry Software\FlashBack Pro 5\avformat-52.dll
%ProgramFiles%\Blueberry Software\FlashBack Pro 5\avutil-50.dll
%ProgramFiles%\Blueberry Software\FlashBack Pro 5\avcore-0.dll
%ProgramFiles%\Blueberry Software\FlashBack Pro 5\swscale-0.dll
%ProgramFiles%\Blueberry Software\FlashBack Pro 5\libx264-128.dll
%ProgramFiles%\Blueberry Software\FlashBack Pro 5\BBBR-FlashBack Pro 5.xml
%ProgramFiles%\Blueberry Software\FlashBack Pro 5\dbghelp.dll
%ProgramFiles%\Blueberry Software\FlashBack Pro 5\welslayer.cfg
%ProgramFiles%\Blueberry Software\FlashBack Pro 5\OpenH264Lib.dll
%ProgramFiles%\Blueberry Software\FlashBack Pro 5\ActiveBand.bpl
%ProgramFiles%\Blueberry Software\FlashBack Pro 5\FBFields.xml
%ProgramFiles%\Blueberry Software\FlashBack Pro 5\CheckForUpdate.dll
%ProgramFiles%\Blueberry Software\FlashBack Pro 5\FLVScreenVideo.dll
%ProgramFiles%\Blueberry Software\FlashBack Pro 5\lame_enc.dll
%ProgramFiles%\Blueberry Software\FlashBack Pro 5\twolame.dll
%ProgramFiles%\Blueberry Software\FlashBack Pro 5\LibAVEncoder.dll
%ProgramFiles%\Blueberry Software\FlashBack Pro 5\libmfxaudiosw32.dll
%ProgramFiles%\Blueberry Software\FlashBack Pro 5\GDI2MpegConverter.exe
%ProgramFiles%\Blueberry Software\FlashBack Pro 5\LOGSYSINFO.HLP
%ProgramFiles%\Blueberry Software\FlashBack Pro 5\FBQTLibrary.dll
%ProgramFiles%\Blueberry Software\FlashBack Pro 5\FlashBackDriverInstaller.exe
%ProgramFiles%\Blueberry Software\FlashBack Pro 5\FlashBackInstall.dll
%ProgramFiles%\Blueberry Software\FlashBack Pro 5\welsenc.cfg
%ProgramFiles%\Blueberry Software\FlashBack Pro 5\vclie170.bpl
%ProgramFiles%\Blueberry Software\FlashBack Pro 5\LogSysInstaller.dll
%TEMP%\7ZipSfx.000\BBFlashback\Data.exe
%TEMP%\nsx2.tmp
%TEMP%\nsx3.tmp\links.ini
%TEMP%\nsx3.tmp\spltmp.bmp
%TEMP%\nsx3.tmp\RemPendingFileOp.dll
%TEMP%\nsx3.tmp\UserInfo.dll
%TEMP%\nsx3.tmp\version.dll
%ProgramFiles%\Blueberry Software\FlashBack Pro 5\install.log
%ProgramFiles%\Blueberry Software\FlashBack Pro 5\bcbie170.bpl
%ProgramFiles%\Blueberry Software\FlashBack Pro 5\borlndmm.dll
%TEMP%\7ZipSfx.000\BBFlashback\setup.exe
%ProgramFiles%\Blueberry Software\FlashBack Pro 5\cc32120mt.dll
%ProgramFiles%\Blueberry Software\FlashBack Pro 5\dsnap170.bpl
%ProgramFiles%\Blueberry Software\FlashBack Pro 5\inet170.bpl
%ProgramFiles%\Blueberry Software\FlashBack Pro 5\rtl170.bpl
%ProgramFiles%\Blueberry Software\FlashBack Pro 5\soaprtl170.bpl
%ProgramFiles%\Blueberry Software\FlashBack Pro 5\vcl170.bpl
%ProgramFiles%\Blueberry Software\FlashBack Pro 5\vclactnband170.bpl
%ProgramFiles%\Blueberry Software\FlashBack Pro 5\vclimg170.bpl
%ProgramFiles%\Blueberry Software\FlashBack Pro 5\vclx170.bpl
%ProgramFiles%\Blueberry Software\FlashBack Pro 5\XECompat.bpl
%ProgramFiles%\Blueberry Software\FlashBack Pro 5\xmlrtl170.bpl
%ProgramFiles%\Blueberry Software\FlashBack Pro 5\dbrtl170.bpl
%APPDATA%\Blueberry\FlashBack5 File Copy.Export.xml
%ProgramFiles%\Blueberry Software\FlashBack Pro 5\SWFControlBars\AS2\commonSingle.as
%ProgramFiles%\Blueberry Software\FlashBack Pro 5\LogSysServer.exe
%ProgramFiles%\Blueberry Software\FlashBack Pro 5\review.xsl
%ProgramFiles%\Blueberry Software\FlashBack Pro 5\FlashBack Player.dbg
%ProgramFiles%\Blueberry Software\FlashBack Pro 5\FlashBack Player.exe
%ProgramFiles%\Blueberry Software\FlashBack Pro 5\FlashBack Recorder.dbg
%ProgramFiles%\Blueberry Software\FlashBack Pro 5\FlashBack Recorder.exe
%ProgramFiles%\Blueberry Software\FlashBack Pro 5\Custom\custom.cfg
%ProgramFiles%\Blueberry Software\FlashBack Pro 5\Custom\LeftMouseDblClk1.png
%ProgramFiles%\Blueberry Software\FlashBack Pro 5\Custom\LeftMouseDblClk2.png
%ProgramFiles%\Blueberry Software\FlashBack Pro 5\Custom\LeftMouseDblClk3.png
%CommonProgramFiles%\Blueberry Software\ActiveBand.ocx
%ProgramFiles%\Blueberry Software\FlashBack Pro 5\Custom\LeftMouseDown1.png
%ProgramFiles%\Blueberry Software\FlashBack Pro 5\FlashBack Batch Export.exe
%ProgramFiles%\Blueberry Software\FlashBack Pro 5\Custom\LeftMouseDown3.png
%ProgramFiles%\Blueberry Software\FlashBack Pro 5\Custom\LeftMouseUp2.png
%ProgramFiles%\Blueberry Software\FlashBack Pro 5\Custom\LeftMouseUp3.png
%ProgramFiles%\Blueberry Software\FlashBack Pro 5\Custom\MiddleMouseDblClk1.png
%ProgramFiles%\Blueberry Software\FlashBack Pro 5\Custom\MiddleMouseDblClk2.png
%ProgramFiles%\Blueberry Software\FlashBack Pro 5\Custom\MiddleMouseDblClk3.png
%ProgramFiles%\Blueberry Software\FlashBack Pro 5\Custom\MiddleMouseDown1.png
%ProgramFiles%\Blueberry Software\FlashBack Pro 5\Custom\MiddleMouseDown2.png
%ProgramFiles%\Blueberry Software\FlashBack Pro 5\Custom\MiddleMouseDown3.png
%ProgramFiles%\Blueberry Software\FlashBack Pro 5\Custom\LeftMouseDown2.png
%ProgramFiles%\Blueberry Software\FlashBack Pro 5\SSEUtils.dll
%ProgramFiles%\Blueberry Software\FlashBack Pro 5\Custom\LeftMouseUp1.png
%ProgramFiles%\Blueberry Software\FlashBack Pro 5\FlashBack Pro 5 Help.chm
%CommonProgramFiles%\Blueberry Software\QSTools.dll
%CommonProgramFiles%\Blueberry Software\FBExplorerAddOn.log
%ProgramFiles%\Blueberry Software\FlashBack Pro 5\FBPLAYERAPI.dll
%ProgramFiles%\Blueberry Software\FlashBack Pro 5\FBAPI.dll
%ProgramFiles%\Blueberry Software\FlashBack Pro 5\FBCmd.exe
%ProgramFiles%\Blueberry Software\FlashBack Pro 5\Free FlashBack Player.exe
%ProgramFiles%\Blueberry Software\FlashBack Pro 5\BBIPP.dll
%ProgramFiles%\Blueberry Software\FlashBack Pro 5\libiomp5md.dll
%ProgramFiles%\Blueberry Software\FlashBack Pro 5\PredefinedGallery.dat
%ProgramFiles%\Blueberry Software\FlashBack Pro 5\Video2FLV.dll
%ProgramFiles%\Blueberry Software\FlashBack Pro 5\VideoPlayers.txt
%ProgramFiles%\Blueberry Software\FlashBack Pro 5\RecorderChecker.exe
%ProgramFiles%\Blueberry Software\FlashBack Pro 5\VistaCoreSoundAPIWrap.dll
%ProgramFiles%\Blueberry Software\FlashBack Pro 5\WebCam.dll
%ProgramFiles%\Blueberry Software\FlashBack Pro 5\WMIIntDll.dll
%ProgramFiles%\Blueberry Software\FlashBack Pro 5\WMVExport.dll
%ProgramFiles%\Blueberry Software\FlashBack Pro 5\Licence.rtf
%ProgramFiles%\Blueberry Software\FlashBack Pro 5\Readme.htm
%ProgramFiles%\Blueberry Software\FlashBack Pro 5\uninstall.exe
%CommonProgramFiles%\Blueberry Software\BandLoader.dll
%CommonProgramFiles%\Blueberry Software\BBFileTransfer.dll
%CommonProgramFiles%\Blueberry Software\bbmemdumpflt.ax
%CommonProgramFiles%\Blueberry Software\bbppnt.dll
%ProgramFiles%\Blueberry Software\FlashBack Pro 5\VistaCoreSoundAPIWrap.pdb
%CommonProgramFiles%\Blueberry Software\FBExplorerAddon.dll
%ProgramFiles%\Blueberry Software\FlashBack Pro 5\mpglib.dll
%APPDATA%\Blueberry\FlashBack5 File Copy.Upload.xml

Другое:

Ищет следующие окна:

ClassName: 'LOGSYSSERVER' WindowName: 'LogSys Server'

Создает и запускает на исполнение:

'%TEMP%\7ZipSfx.000\BBFlashback\setup.exe' /S
'%TEMP%\nsx3.tmp\ns4.tmp' %ProgramFiles%\Blueberry Software\FlashBack Pro 5\UploadProfiles\DefConfig.exe -add "File Copy" "%ProgramFiles%\Blueberry Software\FlashBack Pro 5\UploadProfiles\FileCopyPublisher.dll" "FlashBa...
'%ProgramFiles%\Blueberry Software\FlashBack Pro 5\UploadProfiles\DefConfig.exe' -add "File Copy" "%ProgramFiles%\Blueberry Software\FlashBack Pro 5\UploadProfiles\FileCopyPublisher.dll" "FlashBack5"

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней