Trojan.MulDrop11.19254

Техническая информация

Для обеспечения автозапуска и распространения

Модифицирует следующие ключи реестра

[<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'run' = ''
[<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = ''
[<HKLM>\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon] 'shell' = 'Explorer.exe '
[<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'run' = '%WINDIR%\fCqYD\dawtqn.exe'
[<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%WINDIR%\fCqYD\dawtqn.exe'
[<HKLM>\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon] 'shell' = 'Explorer.exe %WINDIR%\fCqYD\dawtqn.exe'

Создает или изменяет следующие файлы

<SYSTEM32>\tasks\microsoft\windows\upnp\services

Создает следующие сервисы

[<HKLM>\System\CurrentControlSet\Services\Application Layre Gateway Saervice] 'ImagePath' = 'cmd.exe /c start %WINDIR%\boy.exe'

Изменения в файловой системе

Создает следующие файлы

%WINDIR%\fcqyd\tscl.html
%WINDIR%\fcqyd\libeay32.dll
%WINDIR%\fcqyd\libiconv-2.dll
%WINDIR%\fcqyd\libxml2.dll
%WINDIR%\fcqyd\pcla-0.dll
%WINDIR%\fcqyd\pcre-0.dll
%WINDIR%\fcqyd\pcrecpp-0.dll
%WINDIR%\fcqyd\pcreposix-0.dll
%WINDIR%\fcqyd\posh.dll
%WINDIR%\fcqyd\posh-0.dll
%WINDIR%\fcqyd\riar.dll
%WINDIR%\fcqyd\riar-2.dll
%WINDIR%\fcqyd\ssleay32.dll
%WINDIR%\fcqyd\tibe-1.dll
%WINDIR%\fcqyd\zlib1.dll
%WINDIR%\fcqyd\tibe-2.dll
%WINDIR%\fcqyd\trch.dll
%WINDIR%\fcqyd\trch-0.dll
%WINDIR%\fcqyd\trch-1.dll
%WINDIR%\fcqyd\trfo.dll
%WINDIR%\fcqyd\trfo-0.dll
%WINDIR%\fcqyd\trfo-2.dll
%WINDIR%\fcqyd\tucl.dll
%WINDIR%\fcqyd\tucl-1.dll
%WINDIR%\fcqyd\ucl.dll
%WINDIR%\fcqyd\xdvl-0.dll
%WINDIR%\fcqyd\zibe.dll
%WINDIR%\fcqyd\libcurl.dll
%WINDIR%\fcqyd\tibe.dll
%WINDIR%\fcqyd\iconv.dll
%WINDIR%\fcqyd\adfw-2.dll
%WINDIR%\ime\tps.exe
%WINDIR%\boy.exe
%WINDIR%\fcqyd\dawtqn.exe
%WINDIR%\end.bat
%WINDIR%\fcqyd\qdx.bat
%WINDIR%\fcqyd\chrome..exe
%WINDIR%\fcqyd\chrome..xml
%WINDIR%\fcqyd\chrome..fb
%WINDIR%\fcqyd\cstr.exe
%WINDIR%\fcqyd\cstr.fb
%WINDIR%\fcqyd\cstr.xml
%WINDIR%\fcqyd\adfw.dll
%WINDIR%\fcqyd\cnli-0.dll
%WINDIR%\fcqyd\exma.dll
%WINDIR%\fcqyd\cnli-1.dll
%WINDIR%\fcqyd\coli-0.dll
%WINDIR%\fcqyd\crli-0.dll
%WINDIR%\fcqyd\dmgd-1.dll
%WINDIR%\fcqyd\dmgd-4.dll
%WINDIR%\fcqyd\esco-0.dll
%WINDIR%\fcqyd\etch-0.dll
%WINDIR%\fcqyd\etchcore-0.x64.dll
%WINDIR%\fcqyd\etchcore-0.x86.dll
%WINDIR%\fcqyd\eteb-2.dll
%WINDIR%\fcqyd\etebcore-2.x64.dll
%WINDIR%\fcqyd\etebcore-2.x86.dll
%WINDIR%\fcqyd\exma-1.dll
%WINDIR%\fcqyd\tff

Удаляет следующие файлы

%WINDIR%\end.bat
%WINDIR%\fcqyd\qdx.bat

Самоудаляется.

Сетевая активность

UDP

DNS ASK ip.#322.net
DNS ASK ip##8.com
DNS ASK ip.###erov10.com

Другое

Ищет следующие окна

ClassName: '' WindowName: 'sys.exe'
ClassName: '#32770' WindowName: 'chrome..exe - Г“В¦Г“ГѓВіГЊГђГІВґГГЋГі'

Создает и запускает на исполнение

'%WINDIR%\fcqyd\dawtqn.exe'
'%WINDIR%\syswow64\cmd.exe' /c del "<Полный путь к файлу>"' (со скрытым окном)
'%WINDIR%\syswow64\cmd.exe' /c ""%WINDIR%\end.bat" "' (со скрытым окном)
'%WINDIR%\syswow64\sc.exe' Create "Application Layre Gateway Saervice" type= own type= interact start= demand DisplayName= "Can not be deledted" binPath= "cmd.exe /c start "%WINDIR%\boy.exe"' (со скрытым окном)
'%WINDIR%\syswow64\cmd.exe' /c ""%WINDIR%\fCqYD\qdx.bat" "' (со скрытым окном)

Запускает на исполнение

'<SYSTEM32>\rundll32.exe' <SYSTEM32>\FirewallControlPanel.dll,ShowNotificationDialog /configure /ETOnly 0 /OnProfiles 6 /OtherAllowed 0 /OtherBlocked 0 /OtherEdgeAllowed 0 /NewBlocked 2 "<Полный путь к файлу>"
'%WINDIR%\syswow64\cmd.exe' /c del "<Полный путь к файлу>"
'%WINDIR%\syswow64\cmd.exe' /c ""%WINDIR%\end.bat" "
'<SYSTEM32>\rundll32.exe' <SYSTEM32>\FirewallControlPanel.dll,ShowNotificationDialog /configure /ETOnly 0 /OnProfiles 6 /OtherAllowed 0 /OtherBlocked 0 /OtherEdgeAllowed 0 /NewBlocked 2 "%WINDIR%\fcqyd\dawtqn.exe"
'%WINDIR%\syswow64\netsh.exe' ipsec static add policy name=ipsec_ply
'%WINDIR%\syswow64\netsh.exe' ipsec static add filterlist name=deny_pt
'%WINDIR%\syswow64\netsh.exe' ipsec static add filterlist name=allow_pt
'%WINDIR%\syswow64\netsh.exe' ipsec static add filter filterlist=deny_pt srcaddr=any dstaddr=ME dstport=445 protocol=TCP
'%WINDIR%\syswow64\netsh.exe' ipsec static add filter filterlist=deny_pt srcaddr=any dstaddr=ME dstport=139 protocol=TCP
'%WINDIR%\syswow64\netsh.exe' ipsec static add filteraction name=deny action=block
'%WINDIR%\syswow64\netsh.exe' ipsec static add filteraction name=allow action=negotiate
'%WINDIR%\syswow64\netsh.exe' ipsec static add rule name=deny policy=ipsec_ply filterlist=deny_pt filteraction=deny
'%WINDIR%\syswow64\netsh.exe' ipsec static add rule name=allow policy=ipsec_ply filterlist=allow_pt filteraction=allow psk="(@=P#$bV4$"
'%WINDIR%\syswow64\sc.exe' Create "Application Layre Gateway Saervice" type= own type= interact start= demand DisplayName= "Can not be deledted" binPath= "cmd.exe /c start "%WINDIR%\boy.exe"
'%WINDIR%\syswow64\cmd.exe' /c ""%WINDIR%\fCqYD\qdx.bat" "
'%WINDIR%\syswow64\schtasks.exe' /create /TN "\Microsoft\Windows\UPnP\Services" /RU SYSTEM /TR "%WINDIR%\fCqYD\dawtqn.exe" /SC ONSTART