Trojan.MulDrop8.61340

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKLM>\SOFTWARE\Classes\InnoSetupScriptFile\shell\open\command] '' = '"%ProgramFiles%\Inno Setup 5\Compil32.exe" "%1"'

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\7ZipSfx.000\setup.cmd
%ProgramFiles%\Inno Setup 5\Examples\is-BNVPH.tmp
%ProgramFiles%\Inno Setup 5\Examples\is-3UP2D.tmp
%ProgramFiles%\Inno Setup 5\Examples\is-AO098.tmp
%ProgramFiles%\Inno Setup 5\Examples\is-0AOS8.tmp
%ProgramFiles%\Inno Setup 5\Examples\is-RQNRT.tmp
%ProgramFiles%\Inno Setup 5\Examples\is-F7KS9.tmp
%ProgramFiles%\Inno Setup 5\Examples\is-7DSBQ.tmp
%ProgramFiles%\Inno Setup 5\Examples\is-D80E6.tmp
%ProgramFiles%\Inno Setup 5\Examples\is-VN1EG.tmp
%ProgramFiles%\Inno Setup 5\Examples\is-SH6FQ.tmp
%ProgramFiles%\Inno Setup 5\Examples\is-HBAMN.tmp
%ProgramFiles%\Inno Setup 5\Examples\is-UE0BB.tmp
%ProgramFiles%\Inno Setup 5\Examples\is-AFG6H.tmp
%ProgramFiles%\Inno Setup 5\Examples\is-AVT17.tmp
%ProgramFiles%\Inno Setup 5\Examples\is-J7PH7.tmp
%ProgramFiles%\Inno Setup 5\Examples\is-R3D22.tmp
%ProgramFiles%\Inno Setup 5\Examples\is-7RJD9.tmp
%ProgramFiles%\Inno Setup 5\Examples\is-NL6OP.tmp
%ProgramFiles%\Inno Setup 5\is-TM3MH.tmp
%ProgramFiles%\Inno Setup 5\Examples\is-RBVBC.tmp
%ProgramFiles%\Inno Setup 5\Examples\is-L3QRO.tmp
%ProgramFiles%\Inno Setup 5\Examples\is-OU11U.tmp
%ProgramFiles%\Inno Setup 5\Examples\is-GBN63.tmp
%TEMP%\$inst\2.tmp
%ProgramFiles%\Inno Setup 5\unins000.dat
%ProgramFiles%\Inno Setup 5\unins000.msg
%ALLUSERSPROFILE%\Start Menu\Programs\Inno Setup 5\Inno Setup Revision History.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\Inno Setup 5\Inno Setup FAQ.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\Inno Setup 5\Inno Setup Example Scripts.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\Inno Setup 5\Inno Setup Documentation.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\Inno Setup 5\Inno Setup Compiler.lnk
%ProgramFiles%\Inno Setup 5\is-CKS51.tmp
%ProgramFiles%\Inno Setup 5\is-FSJT7.tmp
%ProgramFiles%\Inno Setup 5\is-KV6IA.tmp
%ProgramFiles%\Inno Setup 5\is-I0TK8.tmp
%ProgramFiles%\Inno Setup 5\Examples\is-BJ8B4.tmp
%ProgramFiles%\Inno Setup 5\Examples\is-QMQ04.tmp
%ProgramFiles%\Inno Setup 5\Examples\MyDll\Delphi\is-B96N0.tmp
%ProgramFiles%\Inno Setup 5\Examples\MyDll\C\is-0FJNK.tmp
%ProgramFiles%\Inno Setup 5\Examples\MyDll\C\is-IA3KC.tmp
%ProgramFiles%\Inno Setup 5\Examples\MyDll\C\is-KGLUJ.tmp
%ProgramFiles%\Inno Setup 5\Examples\is-C8943.tmp
%ProgramFiles%\Inno Setup 5\Examples\is-BJ1L7.tmp
%TEMP%\$inst\temp_0.tmp
%ProgramFiles%\Inno Setup 5\is-56N4H.tmp
%ProgramFiles%\Inno Setup 5\is-3PVVV.tmp
%ProgramFiles%\Inno Setup 5\is-HPJ2N.tmp
%ProgramFiles%\Inno Setup 5\Languages\is-DNI46.tmp
%ProgramFiles%\Inno Setup 5\Languages\is-SP4IG.tmp
%ProgramFiles%\Inno Setup 5\Languages\is-NH5O7.tmp
%ProgramFiles%\Inno Setup 5\Languages\is-5FPKQ.tmp
%ProgramFiles%\Inno Setup 5\is-45ULP.tmp
%ProgramFiles%\Inno Setup 5\is-P9K1Q.tmp
%ProgramFiles%\Inno Setup 5\is-9SBE9.tmp
%ProgramFiles%\Inno Setup 5\is-GIR9Q.tmp
%ProgramFiles%\Inno Setup 5\is-6Q9BC.tmp
%ProgramFiles%\Inno Setup 5\is-BJO8B.tmp
%ProgramFiles%\Inno Setup 5\is-I2QOV.tmp
%ProgramFiles%\Inno Setup 5\is-LSJ65.tmp
%ProgramFiles%\Inno Setup 5\is-PPPV8.tmp
%TEMP%\is-594BA.tmp\ISPP.ico
%TEMP%\is-594BA.tmp\_isetup\_shfoldr.dll
%TEMP%\is-594BA.tmp\_isetup\_RegDLL.tmp
%TEMP%\is-T14OS.tmp\setup.tmp
%TEMP%\7ZipSfx.000\setup.exe
%TEMP%\7ZipSfx.000\lan.exe
%ProgramFiles%\Inno Setup 5\Languages\is-PMV3S.tmp
%ProgramFiles%\Inno Setup 5\Languages\is-E7M6H.tmp
%ProgramFiles%\Inno Setup 5\Languages\is-EA094.tmp
%ProgramFiles%\Inno Setup 5\Languages\is-DSC0C.tmp
%ProgramFiles%\Inno Setup 5\is-KAT90.tmp
%ProgramFiles%\Inno Setup 5\is-7FQFS.tmp
%ProgramFiles%\Inno Setup 5\is-JFKF9.tmp
%ProgramFiles%\Inno Setup 5\is-CAGIK.tmp
%ProgramFiles%\Inno Setup 5\is-04U9O.tmp
%ProgramFiles%\Inno Setup 5\is-65127.tmp
%ProgramFiles%\Inno Setup 5\is-N02IO.tmp
%ProgramFiles%\Inno Setup 5\is-DTI3T.tmp
%ProgramFiles%\Inno Setup 5\Languages\is-6QB50.tmp
%ProgramFiles%\Inno Setup 5\Languages\is-9ES5C.tmp
%ProgramFiles%\Inno Setup 5\Languages\is-SDLG8.tmp
%ProgramFiles%\Inno Setup 5\Languages\is-A30L1.tmp
%ProgramFiles%\Inno Setup 5\Languages\is-40OT1.tmp
%ProgramFiles%\Inno Setup 5\Languages\is-CG779.tmp
%ProgramFiles%\Inno Setup 5\Languages\is-3993C.tmp
%ProgramFiles%\Inno Setup 5\Languages\is-88S58.tmp
%ProgramFiles%\Inno Setup 5\Languages\is-KUIO2.tmp
%ProgramFiles%\Inno Setup 5\Languages\is-9OT8F.tmp
%ProgramFiles%\Inno Setup 5\Languages\is-MSSD0.tmp
%ProgramFiles%\Inno Setup 5\Languages\is-FCD7O.tmp
%ProgramFiles%\Inno Setup 5\is-VJALT.tmp
%ProgramFiles%\Inno Setup 5\Languages\Turkish-3-5.1.11.isl

Удаляет следующие файлы:

%TEMP%\is-594BA.tmp\ISPP.ico
%TEMP%\is-594BA.tmp\_isetup\_RegDLL.tmp
%TEMP%\is-594BA.tmp\_isetup\_shfoldr.dll
%TEMP%\is-T14OS.tmp\setup.tmp
%TEMP%\$inst\temp_0.tmp
%TEMP%\$inst\2.tmp

Перемещает следующие файлы:

%ProgramFiles%\Inno Setup 5\is-PPPV8.tmp в %ProgramFiles%\Inno Setup 5\unins000.exe
%ProgramFiles%\Inno Setup 5\Examples\is-RQNRT.tmp в %ProgramFiles%\Inno Setup 5\Examples\Readme-Dutch.txt
%ProgramFiles%\Inno Setup 5\Examples\is-F7KS9.tmp в %ProgramFiles%\Inno Setup 5\Examples\Readme.txt
%ProgramFiles%\Inno Setup 5\Examples\is-7DSBQ.tmp в %ProgramFiles%\Inno Setup 5\Examples\MyProg.chm
%ProgramFiles%\Inno Setup 5\Examples\is-D80E6.tmp в %ProgramFiles%\Inno Setup 5\Examples\MyProg-IA64.exe
%ProgramFiles%\Inno Setup 5\Examples\is-VN1EG.tmp в %ProgramFiles%\Inno Setup 5\Examples\MyProg-x64.exe
%ProgramFiles%\Inno Setup 5\Examples\is-SH6FQ.tmp в %ProgramFiles%\Inno Setup 5\Examples\MyProg.exe
%ProgramFiles%\Inno Setup 5\Examples\is-HBAMN.tmp в %ProgramFiles%\Inno Setup 5\Examples\Languages.iss
%ProgramFiles%\Inno Setup 5\Examples\is-UE0BB.tmp в %ProgramFiles%\Inno Setup 5\Examples\Components.iss
%ProgramFiles%\Inno Setup 5\Examples\is-AFG6H.tmp в %ProgramFiles%\Inno Setup 5\Examples\64BitTwoArch.iss
%ProgramFiles%\Inno Setup 5\Examples\is-AVT17.tmp в %ProgramFiles%\Inno Setup 5\Examples\64BitThreeArch.iss
%ProgramFiles%\Inno Setup 5\Examples\is-J7PH7.tmp в %ProgramFiles%\Inno Setup 5\Examples\64Bit.iss
%ProgramFiles%\Inno Setup 5\Examples\is-R3D22.tmp в %ProgramFiles%\Inno Setup 5\Examples\Example3.iss
%ProgramFiles%\Inno Setup 5\Examples\is-7RJD9.tmp в %ProgramFiles%\Inno Setup 5\Examples\Example2.iss
%ProgramFiles%\Inno Setup 5\Examples\is-NL6OP.tmp в %ProgramFiles%\Inno Setup 5\Examples\Example1.iss
%ProgramFiles%\Inno Setup 5\is-TM3MH.tmp в %ProgramFiles%\Inno Setup 5\isfaq.htm
%ProgramFiles%\Inno Setup 5\is-3PVVV.tmp в %ProgramFiles%\Inno Setup 5\islzma64.exe
%ProgramFiles%\Inno Setup 5\is-56N4H.tmp в %ProgramFiles%\Inno Setup 5\whatsnew.htm
%ProgramFiles%\Inno Setup 5\Examples\is-0AOS8.tmp в %ProgramFiles%\Inno Setup 5\Examples\Readme-German.txt
%ProgramFiles%\Inno Setup 5\Examples\is-AO098.tmp в %ProgramFiles%\Inno Setup 5\Examples\CodeExample1.iss
%ProgramFiles%\Inno Setup 5\is-FSJT7.tmp в %ProgramFiles%\Inno Setup 5\ISCC.exe
%ProgramFiles%\Inno Setup 5\is-I0TK8.tmp в %ProgramFiles%\Inno Setup 5\ISPP.chm
%ProgramFiles%\Inno Setup 5\Examples\is-BJ8B4.tmp в %ProgramFiles%\Inno Setup 5\Examples\ISPPExample1License.txt
%ProgramFiles%\Inno Setup 5\Examples\is-QMQ04.tmp в %ProgramFiles%\Inno Setup 5\Examples\ISPPExample1.iss
%ProgramFiles%\Inno Setup 5\Examples\MyDll\Delphi\is-B96N0.tmp в %ProgramFiles%\Inno Setup 5\Examples\MyDll\Delphi\MyDll.dpr
%ProgramFiles%\Inno Setup 5\Examples\MyDll\C\is-0FJNK.tmp в %ProgramFiles%\Inno Setup 5\Examples\MyDll\C\MyDll.dsp
%ProgramFiles%\Inno Setup 5\Examples\MyDll\C\is-IA3KC.tmp в %ProgramFiles%\Inno Setup 5\Examples\MyDll\C\MyDll.def
%ProgramFiles%\Inno Setup 5\Examples\is-C8943.tmp в %ProgramFiles%\Inno Setup 5\Examples\MyDll.dll
%ProgramFiles%\Inno Setup 5\Languages\is-SDLG8.tmp в %ProgramFiles%\Inno Setup 5\Languages\Slovenian.isl
%ProgramFiles%\Inno Setup 5\Examples\is-BJ1L7.tmp в %ProgramFiles%\Inno Setup 5\Examples\UninstallCodeExample1.iss
%ProgramFiles%\Inno Setup 5\Examples\is-GBN63.tmp в %ProgramFiles%\Inno Setup 5\Examples\CodePrepareToInstall.iss
%ProgramFiles%\Inno Setup 5\Examples\is-OU11U.tmp в %ProgramFiles%\Inno Setup 5\Examples\CodeAutomation2.iss
%ProgramFiles%\Inno Setup 5\Examples\is-L3QRO.tmp в %ProgramFiles%\Inno Setup 5\Examples\CodeAutomation.iss
%ProgramFiles%\Inno Setup 5\Examples\is-RBVBC.tmp в %ProgramFiles%\Inno Setup 5\Examples\CodeDll.iss
%ProgramFiles%\Inno Setup 5\Examples\is-BNVPH.tmp в %ProgramFiles%\Inno Setup 5\Examples\CodeClasses.iss
%ProgramFiles%\Inno Setup 5\Examples\is-3UP2D.tmp в %ProgramFiles%\Inno Setup 5\Examples\CodeDlg.iss
%ProgramFiles%\Inno Setup 5\is-HPJ2N.tmp в %ProgramFiles%\Inno Setup 5\islzma32.exe
%ProgramFiles%\Inno Setup 5\is-VJALT.tmp в %ProgramFiles%\Inno Setup 5\islzma.dll
%ProgramFiles%\Inno Setup 5\is-KAT90.tmp в %ProgramFiles%\Inno Setup 5\isbunzip.dll
%ProgramFiles%\Inno Setup 5\Languages\is-E7M6H.tmp в %ProgramFiles%\Inno Setup 5\Languages\Dutch.isl
%ProgramFiles%\Inno Setup 5\Languages\is-PMV3S.tmp в %ProgramFiles%\Inno Setup 5\Languages\Danish.isl
%ProgramFiles%\Inno Setup 5\Languages\is-DNI46.tmp в %ProgramFiles%\Inno Setup 5\Languages\Czech.isl
%ProgramFiles%\Inno Setup 5\Languages\is-SP4IG.tmp в %ProgramFiles%\Inno Setup 5\Languages\Catalan.isl
%ProgramFiles%\Inno Setup 5\Languages\is-NH5O7.tmp в %ProgramFiles%\Inno Setup 5\Languages\BrazilianPortuguese.isl
%ProgramFiles%\Inno Setup 5\Languages\is-5FPKQ.tmp в %ProgramFiles%\Inno Setup 5\Languages\Basque.isl
%ProgramFiles%\Inno Setup 5\is-45ULP.tmp в %ProgramFiles%\Inno Setup 5\Default.isl
%ProgramFiles%\Inno Setup 5\is-P9K1Q.tmp в %ProgramFiles%\Inno Setup 5\SetupLdr.e32
%ProgramFiles%\Inno Setup 5\is-9SBE9.tmp в %ProgramFiles%\Inno Setup 5\Setup.e32
%ProgramFiles%\Inno Setup 5\is-GIR9Q.tmp в %ProgramFiles%\Inno Setup 5\ISCmplr.dll
%ProgramFiles%\Inno Setup 5\is-6Q9BC.tmp в %ProgramFiles%\Inno Setup 5\isscint.dll
%ProgramFiles%\Inno Setup 5\is-BJO8B.tmp в %ProgramFiles%\Inno Setup 5\Compil32.exe
%ProgramFiles%\Inno Setup 5\is-I2QOV.tmp в %ProgramFiles%\Inno Setup 5\ISetup.chm
%ProgramFiles%\Inno Setup 5\is-LSJ65.tmp в %ProgramFiles%\Inno Setup 5\license.txt
%ProgramFiles%\Inno Setup 5\Languages\is-DSC0C.tmp в %ProgramFiles%\Inno Setup 5\Languages\Finnish.isl
%ProgramFiles%\Inno Setup 5\Languages\is-FCD7O.tmp в %ProgramFiles%\Inno Setup 5\Languages\German.isl
%ProgramFiles%\Inno Setup 5\Languages\is-EA094.tmp в %ProgramFiles%\Inno Setup 5\Languages\French.isl
%ProgramFiles%\Inno Setup 5\Languages\is-MSSD0.tmp в %ProgramFiles%\Inno Setup 5\Languages\Hebrew.isl
%ProgramFiles%\Inno Setup 5\is-7FQFS.tmp в %ProgramFiles%\Inno Setup 5\isbzip.dll
%ProgramFiles%\Inno Setup 5\Languages\is-9OT8F.tmp в %ProgramFiles%\Inno Setup 5\Languages\Hungarian.isl
%ProgramFiles%\Inno Setup 5\is-JFKF9.tmp в %ProgramFiles%\Inno Setup 5\isunzlib.dll
%ProgramFiles%\Inno Setup 5\is-CAGIK.tmp в %ProgramFiles%\Inno Setup 5\iszlib.dll
%ProgramFiles%\Inno Setup 5\is-04U9O.tmp в %ProgramFiles%\Inno Setup 5\WizModernSmallImage-IS.bmp
%ProgramFiles%\Inno Setup 5\is-65127.tmp в %ProgramFiles%\Inno Setup 5\WizModernSmallImage.bmp
%ProgramFiles%\Inno Setup 5\is-N02IO.tmp в %ProgramFiles%\Inno Setup 5\WizModernImage-IS.bmp
%ProgramFiles%\Inno Setup 5\is-DTI3T.tmp в %ProgramFiles%\Inno Setup 5\WizModernImage.bmp
%ProgramFiles%\Inno Setup 5\Examples\MyDll\C\is-KGLUJ.tmp в %ProgramFiles%\Inno Setup 5\Examples\MyDll\C\MyDll.c
%ProgramFiles%\Inno Setup 5\is-KV6IA.tmp в %ProgramFiles%\Inno Setup 5\ISPP.dll
%ProgramFiles%\Inno Setup 5\Languages\is-9ES5C.tmp в %ProgramFiles%\Inno Setup 5\Languages\Slovak.isl
%ProgramFiles%\Inno Setup 5\Languages\is-A30L1.tmp в %ProgramFiles%\Inno Setup 5\Languages\Russian.isl
%ProgramFiles%\Inno Setup 5\Languages\is-40OT1.tmp в %ProgramFiles%\Inno Setup 5\Languages\Portuguese.isl
%ProgramFiles%\Inno Setup 5\Languages\is-CG779.tmp в %ProgramFiles%\Inno Setup 5\Languages\Polish.isl
%ProgramFiles%\Inno Setup 5\Languages\is-3993C.tmp в %ProgramFiles%\Inno Setup 5\Languages\Norwegian.isl
%ProgramFiles%\Inno Setup 5\Languages\is-88S58.tmp в %ProgramFiles%\Inno Setup 5\Languages\Japanese.isl
%ProgramFiles%\Inno Setup 5\Languages\is-KUIO2.tmp в %ProgramFiles%\Inno Setup 5\Languages\Italian.isl
%ProgramFiles%\Inno Setup 5\Languages\is-6QB50.tmp в %ProgramFiles%\Inno Setup 5\Languages\Spanish.isl
%ProgramFiles%\Inno Setup 5\is-CKS51.tmp в %ProgramFiles%\Inno Setup 5\ISPPBuiltins.iss

Другое:

Создает и запускает на исполнение:

'%TEMP%\7ZipSfx.000\setup.exe' /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-
'%TEMP%\is-T14OS.tmp\setup.tmp' /SL5="$300DE,1412196,54272,%TEMP%\7ZipSfx.000\setup.exe" /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-
'%ProgramFiles%\Inno Setup 5\Compil32.exe' /ASSOC
'%TEMP%\7ZipSfx.000\lan.exe'

Запускает на исполнение:

'<SYSTEM32>\cmd.exe' /c ""%TEMP%\7ZipSfx.000\setup.cmd" "

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней