Trojan.MulDrop11.28466

Техническая информация

Для обеспечения автозапуска и распространения

Модифицирует следующие ключи реестра

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'fed4b5d3a4b910357c54d3c276368aeb' = '"%TEMP%\menu.exe" ..'
[<HKLM>\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'fed4b5d3a4b910357c54d3c276368aeb' = '"%TEMP%\menu.exe" ..'

Создает или изменяет следующие файлы

%APPDATA%\microsoft\windows\start menu\programs\startup\fed4b5d3a4b910357c54d3c276368aeb.exe

Вредоносные функции

Запускает на исполнение

'%WINDIR%\syswow64\netsh.exe' firewall add allowedprogram "%TEMP%\menu.exe" "menu.exe" ENABLE

Изменения в файловой системе

Создает следующие файлы

%TEMP%\idman621build16.exe
%TEMP%\idm_setup_temp\idm78.tmp
%TEMP%\idm_setup_temp\idm77.tmp
%TEMP%\idm_setup_temp\idm76.tmp
%TEMP%\idm_setup_temp\idm75.tmp
%TEMP%\idm_setup_temp\idm74.tmp
%TEMP%\idm_setup_temp\idm73.tmp
%TEMP%\idm_setup_temp\idm72.tmp
%TEMP%\idm_setup_temp\idm71.tmp
%TEMP%\idm_setup_temp\idm70.tmp
%TEMP%\idm_setup_temp\idm69.tmp
%TEMP%\idm_setup_temp\idm68.tmp
%TEMP%\idm_setup_temp\idm66.tmp
%TEMP%\idm_setup_temp\idm80.tmp
%TEMP%\idm_setup_temp\idm65.tmp
%TEMP%\idm_setup_temp\idm64.tmp
%TEMP%\idm_setup_temp\idm63.tmp
%TEMP%\idm_setup_temp\idm62.tmp
%TEMP%\idm_setup_temp\idm61.tmp
%TEMP%\idm_setup_temp\idm60.tmp
%TEMP%\idm_setup_temp\idm59.tmp
%TEMP%\idm_setup_temp\idm58.tmp
%TEMP%\idm_setup_temp\idm57.tmp
%TEMP%\idm_setup_temp\idm56.tmp
%TEMP%\idm_setup_temp\idm67.tmp
%TEMP%\idm_setup_temp\idm39.tmp
%TEMP%\idm_setup_temp\idm81.tmp
%TEMP%\idm_setup_temp\idm106.tmp
%TEMP%\idm_setup_temp\idm105.tmp
%TEMP%\idm_setup_temp\idm104.tmp
%TEMP%\idm_setup_temp\idm103.tmp
%TEMP%\idm_setup_temp\idm102.tmp
%TEMP%\idm_setup_temp\idm101.tmp
%TEMP%\idm_setup_temp\idm100.tmp
%TEMP%\idm_setup_temp\idm99.tmp
%TEMP%\idm_setup_temp\idm98.tmp
%TEMP%\idm_setup_temp\idm97.tmp
%TEMP%\idm_setup_temp\idm96.tmp
%TEMP%\idm_setup_temp\idm55.tmp
%TEMP%\idm_setup_temp\idm79.tmp
%TEMP%\idm_setup_temp\idm93.tmp
%TEMP%\idm_setup_temp\idm92.tmp
%TEMP%\idm_setup_temp\idm91.tmp
%TEMP%\idm_setup_temp\idm90.tmp
%TEMP%\idm_setup_temp\idm89.tmp
%TEMP%\idm_setup_temp\idm88.tmp
%TEMP%\idm_setup_temp\idm87.tmp
%TEMP%\idm_setup_temp\idm86.tmp
%TEMP%\idm_setup_temp\idm85.tmp
%TEMP%\idm_setup_temp\idm84.tmp
%TEMP%\idm_setup_temp\idm83.tmp
%TEMP%\idm_setup_temp\idm94.tmp
%TEMP%\idm_setup_temp\idm82.tmp
%TEMP%\idm_setup_temp\idm54.tmp
%TEMP%\idm_setup_temp\idm53.tmp
%TEMP%\idm_setup_temp\idm52.tmp
%TEMP%\idm_setup_temp\idm11.tmp
%TEMP%\idm_setup_temp\idm22.tmp
%TEMP%\idm_setup_temp\idm21.tmp
%TEMP%\idm_setup_temp\idm20.tmp
%TEMP%\idm_setup_temp\idm19.tmp
%TEMP%\idm_setup_temp\idm18.tmp
%TEMP%\idm_setup_temp\idm17.tmp
%TEMP%\idm_setup_temp\idm16.tmp
%TEMP%\idm_setup_temp\idm15.tmp
%TEMP%\idm_setup_temp\idm14.tmp
%TEMP%\idm_setup_temp\idm13.tmp
%TEMP%\clean.exe
%TEMP%\idm_setup_temp\idm24.tmp
%TEMP%\idm_setup_temp\idm10.tmp
%TEMP%\idm_setup_temp\idm9.tmp
%TEMP%\idm_setup_temp\idm8.tmp
%TEMP%\idm_setup_temp\idm7.tmp
%TEMP%\idm_setup_temp\idm6.tmp
%TEMP%\idm_setup_temp\idm5.tmp
%TEMP%\idm_setup_temp\idm4.tmp
%TEMP%\idm_setup_temp\idm3.tmp
%TEMP%\idm_setup_temp\idm2.tmp
%TEMP%\idm_setup_temp\idm1.tmp
%TEMP%\idm_setup_temp\idm0.tmp
%TEMP%\idm_setup_temp\idm12.tmp
%TEMP%\idm_setup_temp\idm95.tmp
%TEMP%\idm_setup_temp\idm25.tmp
%TEMP%\idm_setup_temp\idm28.tmp
%TEMP%\idm_setup_temp\idm26.tmp
%TEMP%\idm_setup_temp\idm51.tmp
%TEMP%\idm_setup_temp\idm50.tmp
%TEMP%\idm_setup_temp\idm49.tmp
%TEMP%\idm_setup_temp\idm48.tmp
%TEMP%\idm_setup_temp\idm47.tmp
%TEMP%\idm_setup_temp\idm46.tmp
%TEMP%\idm_setup_temp\idm45.tmp
%TEMP%\idm_setup_temp\idm44.tmp
%TEMP%\idm_setup_temp\idm43.tmp
%TEMP%\idm_setup_temp\idm42.tmp
%TEMP%\idm_setup_temp\idm27.tmp
%TEMP%\idm_setup_temp\idm41.tmp
%TEMP%\idm_setup_temp\idm23.tmp
%TEMP%\idm_setup_temp\idm38.tmp
%TEMP%\idm_setup_temp\idm37.tmp
%TEMP%\idm_setup_temp\idm36.tmp
%TEMP%\idm_setup_temp\idm35.tmp
%TEMP%\idm_setup_temp\idm34.tmp
%TEMP%\idm_setup_temp\idm33.tmp
%TEMP%\idm_setup_temp\idm32.tmp
%TEMP%\idm_setup_temp\idm31.tmp
%TEMP%\idm_setup_temp\idm30.tmp
%TEMP%\idm_setup_temp\idm29.tmp
%TEMP%\idm_setup_temp\idm40.tmp
%TEMP%\menu.exe

Сетевая активность

TCP

Запросы HTTP GET

http://pa###bin.com/raw/Q1rU6eCt

UDP

DNS ASK pa###bin.com
DNS ASK mi####m.no-ip.biz

Другое

Создает и запускает на исполнение

'%TEMP%\idman621build16.exe'
'%TEMP%\idm_setup_temp\idm1.tmp' -d "%TEMP%\IDM_Setup_Temp\"
'%TEMP%\clean.exe'
'%TEMP%\menu.exe'
'%WINDIR%\syswow64\netsh.exe' firewall add allowedprogram "%TEMP%\menu.exe" "menu.exe" ENABLE' (со скрытым окном)