Trojan.MulDrop3.41873

Техническая информация

Для обеспечения автозапуска и распространения:

Создает или изменяет следующие файлы:

%ALLUSERSPROFILE%\Start Menu\Programs\Startup\certfirefox.exe
%ALLUSERSPROFILE%\Start Menu\Programs\Startup\ConfiguracionProxy.exe

Вредоносные функции:

Создает и запускает на исполнение:

%TEMP%\certfirefox.exe
%TEMP%\certutil2.exe -A -n McAfee Public CA v1 -t ",," -d "%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default" -i pepe.cer
%TEMP%\ConfiguracionProxy.exe
%TEMP%\certutil.exe -addstore root pepe.cer

Запускает на исполнение:

<SYSTEM32>\reg.exe query "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3" /v 2001
<SYSTEM32>\find.exe "0x0"
<SYSTEM32>\reg.exe query "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3" /v 2004
<SYSTEM32>\reg.exe query "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3" /v 1a10
<SYSTEM32>\cmd.exe /c ""%TEMP%\certfirefox.bat" > NUL"
<SYSTEM32>\reg.exe add "HKLM\SOFTWARE\Network Associates\ePolicy Orchestrator\Agent\CustomProps" /v CustomProps2 /t REG_SZ /d "CHANGE CERT OK =P" /f
<SYSTEM32>\find.exe "0x1"
<SYSTEM32>\reg.exe query "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3" /v {A8A88C49-5EB2-4990-A1A2-0876022C854F}
<SYSTEM32>\cmd.exe /c ""%TEMP%\ConfiguracionProxy.bat" > NUL"
<SYSTEM32>\reg.exe add "HKLM\SOFTWARE\Network Associates\ePolicy Orchestrator\Agent\CustomProps" /v CustomProps1 /t REG_SZ /d "COPY CERT OK =P" /f
<SYSTEM32>\cmd.exe /c ""%TEMP%\Script-Registry.bat" > NUL"
%WINDIR%\regedit.exe /s modifica.reg
<SYSTEM32>\find.exe /i "1A3761592352350c7a5f20172f1e1a190e2b017313371312141a152A"
<SYSTEM32>\reg.exe query "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3" /v {AEBA21FA-782A-4A90-978D-B72164C80120}
<SYSTEM32>\reg.exe delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\Range1" /f

Изменяет следующие настройки браузера Windows Internet Explorer:

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1A03' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1A02' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1A00' = '00020000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1A06' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1A05' = '00000001'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1A04' = '00000003'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1809' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1805' = '00000001'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1804' = '00000001'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1803' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1808' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1807' = '00000001'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1806' = '00000001'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1A10' = '00000001'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '{AEBA21FA-782A-4A90-978D-B72164C80120}' = ''
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '2000' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '2300' = '00000001'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] 'LowIcon' = 'inetcpl.cpl#005425'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] 'PMDisplayName' = 'Internet [Protected Mode]'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '{A8A88C49-5EB2-4990-A1A2-0876022C854F}' = ''
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '2201' = '00000003'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '2100' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1E05' = '00020000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1C00' = '00010000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '2200' = '00000003'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '2102' = '00000003'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '2101' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1802' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1004' = '00000003'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1001' = '00000001'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] 'Flags' = '00000001'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1206' = '00000003'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1201' = '00000003'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1200' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] 'RecommendedLevel' = '00011000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] 'Description' = 'This zone contains all Web sites you haven't placed in other zones'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] 'DisplayName' = 'Internet'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '' = ''
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] 'MinLevel' = '00011000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] 'CurrentLevel' = '00011500'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] 'Icon' = 'inetcpl.cpl#001313'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1207' = '00000003'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1607' = '00000003'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1606' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1605' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1800' = '00000001'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1609' = '00000001'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1608' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1604' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1405' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1402' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1400' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1601' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1407' = '00000001'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1406' = '00000003'

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\ssl3.dll
%TEMP%\ssl3.lib
%TEMP%\Instalar.bat
%TEMP%\softokn3.dll
%TEMP%\nssckbi.dll
%TEMP%\smime3.dll
%TEMP%\smime3.lib
%TEMP%\libplds4.dll
%TEMP%\certutil2.exe
%TEMP%\certfirefox.bat
%TEMP%\libplc4.lib
%TEMP%\libnspr4.dll
%TEMP%\libnspr4.lib
%TEMP%\libplc4.dll
%TEMP%\modifica.reg
%TEMP%\certadm.dll
%TEMP%\certutil.exe
C:\ran-sript.txt
%TEMP%\ConfiguracionProxy.exe
%TEMP%\certfirefox.exe
%TEMP%\Script-Registry.bat
%TEMP%\libplds4.lib
%TEMP%\nss3.dll
%TEMP%\nss3.lib
%WINDIR%\certutil.log
%TEMP%\pepe.cer
%TEMP%\pepe.pem
%TEMP%\ConfiguracionProxy.bat

Удаляет следующие файлы:

%TEMP%\Instalar.bat
%TEMP%\libnspr4.dll
%TEMP%\libnspr4.lib
%TEMP%\softokn3.dll
%TEMP%\ssl3.dll
%TEMP%\ssl3.lib
%TEMP%\libplc4.dll
%TEMP%\Script-Registry.bat
%TEMP%\ConfiguracionProxy.exe
%TEMP%\certfirefox.exe
%TEMP%\libplc4.lib
%TEMP%\libplds4.dll
%TEMP%\certutil2.exe
%TEMP%\certutil.exe
%TEMP%\pepe.cer
%TEMP%\pepe.pem
%TEMP%\ConfiguracionProxy.bat
%TEMP%\modifica.reg
%TEMP%\certadm.dll
%TEMP%\certfirefox.bat
%TEMP%\nssckbi.dll
%TEMP%\smime3.dll
%TEMP%\smime3.lib
%TEMP%\libplds4.lib
%TEMP%\nss3.dll
%TEMP%\nss3.lib

Другое:

Ищет следующие окна:

ClassName: 'RegEdit_RegEdit' WindowName: ''

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней