Trojan.MulDrop8.60252

Техническая информация

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\ext2.tmp
<DRIVERS>\ser2d680.rra
%ProgramFiles%\InstallShield Installation Information\{87676F02-F8C8-4776-855A-EDEB7A2183C5}\Setup.ini
%ProgramFiles%\InstallShield Installation Information\{87676F02-F8C8-4776-855A-EDEB7A2183C5}\setud4ea.rra
%ProgramFiles%\InstallShield Installation Information\{87676F02-F8C8-4776-855A-EDEB7A2183C5}\Setud48c.rra
%ProgramFiles%\InstallShield Installation Information\{87676F02-F8C8-4776-855A-EDEB7A2183C5}\Setud40f.rra
%ProgramFiles%\InstallShield Installation Information\{87676F02-F8C8-4776-855A-EDEB7A2183C5}\datad344.rra
%ProgramFiles%\InstallShield Installation Information\{87676F02-F8C8-4776-855A-EDEB7A2183C5}\datad2d6.rra
%ProgramFiles%\InstallShield Installation Information\{87676F02-F8C8-4776-855A-EDEB7A2183C5}\layod288.rra
%TEMP%\{87676f02-f8c8-4776-855a-edeb7a2183c5}\_IsRba3e.rra
%TEMP%\{87676f02-f8c8-4776-855a-edeb7a2183c5}\defab953.rra
%TEMP%\{87676f02-f8c8-4776-855a-edeb7a2183c5}\isrtb83a.rra
%TEMP%\{87676f02-f8c8-4776-855a-edeb7a2183c5}\valub701.rra
%TEMP%\{87676f02-f8c8-4776-855a-edeb7a2183c5}\setub4cf.rra
%CommonProgramFiles%\InstallShield\IScript\IScra07c.rra
%WINDIR%\inf\SERWd77a.rra
%CommonProgramFiles%\InstallShield\engine\6\Intel 32\iuse9929.rra
%CommonProgramFiles%\InstallShield\engine\6\Intel 32\ctor911a.rra
%CommonProgramFiles%\InstallShield\engine\6\Intel 32\core8fb3.rra
%TEMP%\8071.rra
%CommonProgramFiles%\InstallShield\engine\6\Intel 32\temp.000
%TEMP%\pft3~tmp\Disk1\layout.bin
%TEMP%\pft3~tmp\Disk1\setup.inx
%TEMP%\pft3~tmp\Disk1\Setup.ini
%TEMP%\pft3~tmp\Disk1\Setup.exe
%TEMP%\pft3~tmp\Disk1\data2.cab
%TEMP%\pft3~tmp\Disk1\data1.cab
%TEMP%\pft3~tmp\Disk1\data1.hdr
%TEMP%\pft3~tmp\Disk1\ikernel.ex_
%TEMP%\pft3~tmp\pftw1.pkg
%TEMP%\plf1.tmp
%CommonProgramFiles%\InstallShield\engine\6\Intel 32\obje965a.rra
%ProgramFiles%\IBM USB Driver\Dremd845.rra

Удаляет следующие файлы:

%TEMP%\ext2.tmp
%TEMP%\pft3~tmp\pftw1.pkg

Перемещает следующие файлы:

%CommonProgramFiles%\InstallShield\engine\6\Intel 32\temp.000 в %CommonProgramFiles%\InstallShield\engine\6\Intel 32\IKernel.exe
<DRIVERS>\ser2d680.rra в <DRIVERS>\ser2pl.sys
%ProgramFiles%\InstallShield Installation Information\{87676F02-F8C8-4776-855A-EDEB7A2183C5}\setud4ea.rra в %ProgramFiles%\InstallShield Installation Information\{87676F02-F8C8-4776-855A-EDEB7A2183C5}\setup.inx
%ProgramFiles%\InstallShield Installation Information\{87676F02-F8C8-4776-855A-EDEB7A2183C5}\Setud48c.rra в %ProgramFiles%\InstallShield Installation Information\{87676F02-F8C8-4776-855A-EDEB7A2183C5}\Setup.ini
%ProgramFiles%\InstallShield Installation Information\{87676F02-F8C8-4776-855A-EDEB7A2183C5}\Setud40f.rra в %ProgramFiles%\InstallShield Installation Information\{87676F02-F8C8-4776-855A-EDEB7A2183C5}\Setup.exe
%ProgramFiles%\InstallShield Installation Information\{87676F02-F8C8-4776-855A-EDEB7A2183C5}\datad344.rra в %ProgramFiles%\InstallShield Installation Information\{87676F02-F8C8-4776-855A-EDEB7A2183C5}\data1.cab
%ProgramFiles%\InstallShield Installation Information\{87676F02-F8C8-4776-855A-EDEB7A2183C5}\datad2d6.rra в %ProgramFiles%\InstallShield Installation Information\{87676F02-F8C8-4776-855A-EDEB7A2183C5}\data1.hdr
%ProgramFiles%\InstallShield Installation Information\{87676F02-F8C8-4776-855A-EDEB7A2183C5}\layod288.rra в %ProgramFiles%\InstallShield Installation Information\{87676F02-F8C8-4776-855A-EDEB7A2183C5}\layout.bin
%TEMP%\{87676f02-f8c8-4776-855a-edeb7a2183c5}\_IsRba3e.rra в %TEMP%\{87676f02-f8c8-4776-855a-edeb7a2183c5}\_IsRes.dll
%TEMP%\{87676f02-f8c8-4776-855a-edeb7a2183c5}\defab953.rra в %TEMP%\{87676f02-f8c8-4776-855a-edeb7a2183c5}\default.pal
%TEMP%\{87676f02-f8c8-4776-855a-edeb7a2183c5}\isrtb83a.rra в %TEMP%\{87676f02-f8c8-4776-855a-edeb7a2183c5}\isrt.dll
%TEMP%\{87676f02-f8c8-4776-855a-edeb7a2183c5}\valub701.rra в %TEMP%\{87676f02-f8c8-4776-855a-edeb7a2183c5}\value.shl
%TEMP%\{87676f02-f8c8-4776-855a-edeb7a2183c5}\setub4cf.rra в %TEMP%\{87676f02-f8c8-4776-855a-edeb7a2183c5}\setup.inx
%CommonProgramFiles%\InstallShield\IScript\IScra07c.rra в %CommonProgramFiles%\InstallShield\IScript\IScript.dll
%CommonProgramFiles%\InstallShield\engine\6\Intel 32\iuse9929.rra в %CommonProgramFiles%\InstallShield\engine\6\Intel 32\iuser.dll
%CommonProgramFiles%\InstallShield\engine\6\Intel 32\obje965a.rra в %CommonProgramFiles%\InstallShield\engine\6\Intel 32\objectps.dll
%CommonProgramFiles%\InstallShield\engine\6\Intel 32\ctor911a.rra в %CommonProgramFiles%\InstallShield\engine\6\Intel 32\ctor.dll
%CommonProgramFiles%\InstallShield\engine\6\Intel 32\core8fb3.rra в %CommonProgramFiles%\InstallShield\engine\6\Intel 32\corecomp.ini
%WINDIR%\inf\SERWd77a.rra в %WINDIR%\inf\SERWPL.INF
%ProgramFiles%\IBM USB Driver\Dremd845.rra в %ProgramFiles%\IBM USB Driver\Dremover98_2k.exe

Другое:

Создает и запускает на исполнение:

'%TEMP%\pft3~tmp\Disk1\Setup.exe'
'%CommonProgramFiles%\InstallShield\engine\6\Intel 32\IKernel.exe' -RegServer
'%CommonProgramFiles%\InstallShield\engine\6\Intel 32\IKernel.exe' 32\IKernel.exe -Embedding
'%CommonProgramFiles%\InstallShield\engine\6\Intel 32\IKernel.exe' /REGSERVER