Trojan.MulDrop11.17955

Добавлен в вирусную базу Dr.Web: 2019-10-01

Описание добавлено: 2019-10-03

Техническая информация

Для обеспечения автозапуска и распространения

Модифицирует следующие ключи реестра

[<HKLM>\SOFTWARE\Microsoft\Internet Explorer\Plugins\Extension\.crt] 'Location' = '%ProgramFiles%\Internet Explorer\PLUGINS\NpLod32.dll'
[<HKLM>\SOFTWARE\Microsoft\Internet Explorer\Plugins\Extension\.lod] 'Location' = '%ProgramFiles%\Internet Explorer\PLUGINS\NpLod32.dll'

Изменения в файловой системе

Создает следующие файлы

%TEMP%\ext2.tmp
%ProgramFiles%\installshield installation information\{766afa80-7a03-11d4-aee0-00609793647c}\set14.tmp
%ProgramFiles%\installshield installation information\{766afa80-7a03-11d4-aee0-00609793647c}\setup.ini
%ALLUSERSPROFILE%\start menu\programs\В»Г§Г Г¬В№Г¶В·Вє\lod-player.lnk
%ALLUSERSPROFILE%\desktop\В»Г§Г Г¬В№Г¶В·Вє lod-player.lnk
%ProgramFiles%\cyberlec\lod15.tmp
%ProgramFiles%\cyberlec\cyb16.tmp
%ProgramFiles%\cyberlec\upv17.tmp
<SYSTEM32>\aim18.tmp
<SYSTEM32>\ibi19.tmp
%TEMP%\4.tmp
<SYSTEM32>\ibi1a.tmp
<SYSTEM32>\mvo1c.tmp
<SYSTEM32>\tnt1d.tmp
<SYSTEM32>\tnt1e.tmp
<SYSTEM32>\tph1f.tmp
<SYSTEM32>\vad20.tmp
<SYSTEM32>\vcl21.tmp
<SYSTEM32>\vcp22.tmp
<SYSTEM32>\vct23.tmp
<SYSTEM32>\vfo24.tmp
%ProgramFiles%\installshield installation information\{766afa80-7a03-11d4-aee0-00609793647c}\set12.tmp
%ProgramFiles%\installshield installation information\{766afa80-7a03-11d4-aee0-00609793647c}\set13.tmp
%ProgramFiles%\installshield installation information\{766afa80-7a03-11d4-aee0-00609793647c}\dat11.tmp
%ProgramFiles%\installshield installation information\{766afa80-7a03-11d4-aee0-00609793647c}\dat10.tmp
%ProgramFiles%\installshield installation information\{766afa80-7a03-11d4-aee0-00609793647c}\layf.tmp
%TEMP%\pft3~tmp\pftw1.pkg
%TEMP%\pft3~tmp\disk1\setup.exe
%TEMP%\pft3~tmp\disk1\ikernel.ex_
%TEMP%\pft3~tmp\disk1\data2.cab
%TEMP%\pft3~tmp\disk1\setup.inx
%TEMP%\pft3~tmp\disk1\layout.bin
%TEMP%\pft3~tmp\disk1\data1.hdr
%TEMP%\pft3~tmp\disk1\data1.cab
%TEMP%\pft3~tmp\disk1\setup.ini
%ProgramFiles%\В»Г§Г Г¬В№Г¶В·Вє\npl25.tmp
<SYSTEM32>\msv1b.tmp
%CommonProgramFiles%\installshield\engine\6\intel 32\temp.000
%CommonProgramFiles%\installshield\engine\6\intel 32\cto6.tmp
%CommonProgramFiles%\installshield\engine\6\intel 32\obj7.tmp
%CommonProgramFiles%\installshield\engine\6\intel 32\ius8.tmp
%CommonProgramFiles%\installshield\iscript\isc9.tmp
%TEMP%\{766afa80-7a03-11d4-aee0-00609793647c}\seta.tmp
%TEMP%\{766afa80-7a03-11d4-aee0-00609793647c}\valb.tmp
%TEMP%\{766afa80-7a03-11d4-aee0-00609793647c}\isrc.tmp
%TEMP%\{766afa80-7a03-11d4-aee0-00609793647c}\defd.tmp
%TEMP%\{766afa80-7a03-11d4-aee0-00609793647c}\_ise.tmp
%TEMP%\plf1.tmp
%CommonProgramFiles%\installshield\engine\6\intel 32\cor5.tmp
%ProgramFiles%\internet explorer\plugins\npl26.tmp

Удаляет следующие файлы

%TEMP%\ext2.tmp
%TEMP%\pft3~tmp\pftw1.pkg

Перемещает следующие файлы

%CommonProgramFiles%\installshield\engine\6\intel 32\temp.000 в %CommonProgramFiles%\installshield\engine\6\intel 32\ikernel.exe
%ProgramFiles%\cyberlec\upv17.tmp в %ProgramFiles%\cyberlec\upvers.exe
<SYSTEM32>\aim18.tmp в <SYSTEM32>\aim32wss.dll
<SYSTEM32>\ibi19.tmp в <SYSTEM32>\ibidccm.drv
<SYSTEM32>\ibi1a.tmp в <SYSTEM32>\ibidcom.vxd
<SYSTEM32>\msv1b.tmp в <SYSTEM32>\msv2all.vxp
<SYSTEM32>\mvo1c.tmp в <SYSTEM32>\mvoice.vxp
<SYSTEM32>\tnt1e.tmp в <SYSTEM32>\tnt32net.dll
%ProgramFiles%\В»Г§Г Г¬В№Г¶В·Вє\npl25.tmp в %ProgramFiles%\В»Г§Г Г¬В№Г¶В·Вє\nplod32.dll
<SYSTEM32>\tph1f.tmp в <SYSTEM32>\tphook.dll
<SYSTEM32>\vad20.tmp в <SYSTEM32>\vadagc.vxp
<SYSTEM32>\vcl21.tmp в <SYSTEM32>\vclos32.dll
<SYSTEM32>\vcp22.tmp в <SYSTEM32>\vcp32api.dll
<SYSTEM32>\vct23.tmp в <SYSTEM32>\vct32150.dll
<SYSTEM32>\vfo24.tmp в <SYSTEM32>\vfonts.vxp
%ProgramFiles%\cyberlec\cyb16.tmp в %ProgramFiles%\cyberlec\cyber.exe
<SYSTEM32>\tnt1d.tmp в <SYSTEM32>\tnt32260.dll
%ProgramFiles%\cyberlec\lod15.tmp в %ProgramFiles%\cyberlec\lod-player.exe
%TEMP%\{766afa80-7a03-11d4-aee0-00609793647c}\valb.tmp в %TEMP%\{766afa80-7a03-11d4-aee0-00609793647c}\value.shl
%CommonProgramFiles%\installshield\engine\6\intel 32\cor5.tmp в %CommonProgramFiles%\installshield\engine\6\intel 32\corecomp.ini
%CommonProgramFiles%\installshield\engine\6\intel 32\cto6.tmp в %CommonProgramFiles%\installshield\engine\6\intel 32\ctor.dll
%CommonProgramFiles%\installshield\engine\6\intel 32\obj7.tmp в %CommonProgramFiles%\installshield\engine\6\intel 32\objectps.dll
%CommonProgramFiles%\installshield\engine\6\intel 32\ius8.tmp в %CommonProgramFiles%\installshield\engine\6\intel 32\iuser.dll
%CommonProgramFiles%\installshield\iscript\isc9.tmp в %CommonProgramFiles%\installshield\iscript\iscript.dll
%TEMP%\{766afa80-7a03-11d4-aee0-00609793647c}\seta.tmp в %TEMP%\{766afa80-7a03-11d4-aee0-00609793647c}\setup.inx
%TEMP%\{766afa80-7a03-11d4-aee0-00609793647c}\isrc.tmp в %TEMP%\{766afa80-7a03-11d4-aee0-00609793647c}\isrt.dll
%ProgramFiles%\installshield installation information\{766afa80-7a03-11d4-aee0-00609793647c}\set13.tmp в %ProgramFiles%\installshield installation information\{766afa80-7a03-11d4-aee0-00609793647c}\setup.ini
%TEMP%\{766afa80-7a03-11d4-aee0-00609793647c}\defd.tmp в %TEMP%\{766afa80-7a03-11d4-aee0-00609793647c}\default.pal
%TEMP%\{766afa80-7a03-11d4-aee0-00609793647c}\_ise.tmp в %TEMP%\{766afa80-7a03-11d4-aee0-00609793647c}\_isres.dll
%ProgramFiles%\installshield installation information\{766afa80-7a03-11d4-aee0-00609793647c}\layf.tmp в %ProgramFiles%\installshield installation information\{766afa80-7a03-11d4-aee0-00609793647c}\layout.bin
%ProgramFiles%\installshield installation information\{766afa80-7a03-11d4-aee0-00609793647c}\dat10.tmp в %ProgramFiles%\installshield installation information\{766afa80-7a03-11d4-aee0-00609793647c}\data1.hdr
%ProgramFiles%\installshield installation information\{766afa80-7a03-11d4-aee0-00609793647c}\dat11.tmp в %ProgramFiles%\installshield installation information\{766afa80-7a03-11d4-aee0-00609793647c}\data1.cab
%ProgramFiles%\installshield installation information\{766afa80-7a03-11d4-aee0-00609793647c}\set12.tmp в %ProgramFiles%\installshield installation information\{766afa80-7a03-11d4-aee0-00609793647c}\setup.exe
%ProgramFiles%\installshield installation information\{766afa80-7a03-11d4-aee0-00609793647c}\set14.tmp в %ProgramFiles%\installshield installation information\{766afa80-7a03-11d4-aee0-00609793647c}\setup.inx
%ProgramFiles%\internet explorer\plugins\npl26.tmp в %ProgramFiles%\internet explorer\plugins\nplod32.dll

Другое

Создает и запускает на исполнение

'%TEMP%\pft3~tmp\disk1\setup.exe'
'%CommonProgramFiles%\installshield\engine\6\intel 32\ikernel.exe' -RegServer
'%CommonProgramFiles%\installshield\engine\6\intel 32\ikernel.exe' 32\IKernel.exe -Embedding
'%CommonProgramFiles%\installshield\engine\6\intel 32\ikernel.exe' /REGSERVER

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней