Trojan.MulDrop11.41103

Техническая информация

Вредоносные функции

Запускает на исполнение

'<SYSTEM32>\taskkill.exe' /F /IM IDMan.exe
'<SYSTEM32>\taskkill.exe' /F /IM IEMonitor.exe

Изменения в файловой системе

Создает следующие файлы

%TEMP%\autdb92.tmp
%ProgramFiles(x86)%\internet download manager\toolbar\windows_10\windows_10-small_hot.bmp
%ProgramFiles(x86)%\internet download manager\toolbar\windows_10\windows_10-small_disabled.bmp
%ProgramFiles(x86)%\internet download manager\toolbar\windows_10\windows_10-large_normal.bmp
%ProgramFiles(x86)%\internet download manager\toolbar\windows_10\windows_10-large_hot.bmp
%ProgramFiles(x86)%\internet download manager\toolbar\windows_10\windows_10-large_disabled.bmp
%TEMP%\dup2patcher.dll
%TEMP%\nsb1540.tmp\nact.dll
%TEMP%\idman v6.36.7+ patch\idman v6.36.7+ patch.exe
%TEMP%\nsb1540.tmp\uac.dll
%TEMP%\f803.tmp\cleaner.bat
C:\gecici_proje_klasoru\tolbar.exe
%TEMP%\autdc34.tmp
C:\gecici_proje_klasoru\l.reg
%TEMP%\autdc33.tmp
C:\gecici_proje_klasoru\idman_v6.36.7+_patch_sib.exe
%TEMP%\autdbf3.tmp
C:\gecici_proje_klasoru\e.exe
%TEMP%\autdbd3.tmp
C:\gecici_proje_klasoru\cleaner.exe
%TEMP%\autdbc2.tmp
C:\gecici_proje_klasoru\k.png
%TEMP%\autdbb2.tmp
C:\gecici_proje_klasoru\grey.gif
%ProgramFiles(x86)%\internet download manager\toolbar\windows_10\windows_10-small_normal.bmp
%ProgramFiles(x86)%\internet download manager\toolbar\windows_10.tbi

Присваивает атрибут 'скрытый' для следующих файлов

C:\gecici_proje_klasoru\cleaner.exe
C:\gecici_proje_klasoru\idman_v6.36.7+_patch_sib.exe
C:\gecici_proje_klasoru\tolbar.exe
C:\gecici_proje_klasoru\e.exe
C:\gecici_proje_klasoru\k.png

Удаляет следующие файлы

%TEMP%\autdb92.tmp
%TEMP%\autdbb2.tmp
%TEMP%\autdbc2.tmp
%TEMP%\autdbd3.tmp
%TEMP%\autdbf3.tmp
%TEMP%\autdc33.tmp
%TEMP%\autdc34.tmp
%TEMP%\f803.tmp\cleaner.bat
%TEMP%\nsb1540.tmp\nact.dll
%TEMP%\nsb1540.tmp\uac.dll

Другое

Ищет следующие окна

ClassName: '' WindowName: ''
ClassName: 'RegEdit_RegEdit' WindowName: ''
ClassName: 'EDIT' WindowName: ''

Создает и запускает на исполнение

'C:\gecici_proje_klasoru\cleaner.exe'
'C:\gecici_proje_klasoru\idman_v6.36.7+_patch_sib.exe' /S
'%TEMP%\idman v6.36.7+ patch\idman v6.36.7+ patch.exe'
'C:\gecici_proje_klasoru\tolbar.exe'
'<SYSTEM32>\cmd.exe' /c "%TEMP%\F803.tmp\Cleaner.Bat C:\gecici_proje_klasoru\Cleaner.exe"' (со скрытым окном)
'%WINDIR%\syswow64\regedit.exe' /s "C:\gecici_proje_klasoru\L.reg"' (со скрытым окном)

Запускает на исполнение

'<SYSTEM32>\cmd.exe' /c "%TEMP%\F803.tmp\Cleaner.Bat C:\gecici_proje_klasoru\Cleaner.exe"
'<SYSTEM32>\reg.exe' DELETE HKCU\Software\Classes\CLSID\{D5B91409-A8CA-4973-9A0B-59F713D25671} /f
'<SYSTEM32>\reg.exe' DELETE HKLM\Software\Classes\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7} /f
'<SYSTEM32>\reg.exe' DELETE HKLM\Software\Classes\CLSID\{6DDF00DB-1234-46EC-8356-27E7B2051192} /f
'<SYSTEM32>\reg.exe' DELETE HKLM\Software\Classes\CLSID\{D5B91409-A8CA-4973-9A0B-59F713D25671} /f
'<SYSTEM32>\reg.exe' DELETE "HKEY_LOCAL_MACHINE\SOFTWARE\Internet Download Manager" /f
'<SYSTEM32>\reg.exe' DELETE "HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Internet Download Manager" /f
'<SYSTEM32>\reg.exe' DELETE HKEY_CURRENT_USER\Software\DownloadManager /v LName /f
'%WINDIR%\syswow64\ctfmon.exe'
'<SYSTEM32>\reg.exe' DELETE HKEY_CURRENT_USER\Software\DownloadManager /v Email /f
'<SYSTEM32>\reg.exe' DELETE HKEY_CURRENT_USER\Software\DownloadManager /v Serial /f
'<SYSTEM32>\reg.exe' DELETE HKEY_USERS\S-1-5-21-2754736582-2265559669-3571272114-1001\Software\DownloadManager /v FName /f
'<SYSTEM32>\reg.exe' DELETE HKEY_USERS\S-1-5-21-2754736582-2265559669-3571272114-1001\Software\DownloadManager /v LName /f
'<SYSTEM32>\reg.exe' DELETE HKEY_USERS\S-1-5-21-2754736582-2265559669-3571272114-1001\Software\DownloadManager /v Email /f
'<SYSTEM32>\reg.exe' DELETE HKEY_USERS\S-1-5-21-2754736582-2265559669-3571272114-1001\Software\DownloadManager /v Serial /f
'<SYSTEM32>\reg.exe' DELETE HKCU\Software\Classes\CLSID\{6DDF00DB-1234-46EC-8356-27E7B2051192} /f
'<SYSTEM32>\reg.exe' DELETE HKEY_CURRENT_USER\Software\DownloadManager /v FName /f
'<SYSTEM32>\reg.exe' DELETE HKCU\Software\Classes\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7} /f
'<SYSTEM32>\reg.exe' DELETE HKCU\Software\Classes\Wow6432Node\CLSID\{5ED60779-4DE2-4E07-B862-974CA4FF2E9C} /f
'<SYSTEM32>\attrib.exe' +r +h +s "\gecici_proje_klasoru\Cleaner.exe"
'<SYSTEM32>\attrib.exe' +r +h +s "\gecici_proje_klasoru\IDMan_v6.36.7+_Patch_sib.exe"
'<SYSTEM32>\attrib.exe' +r +h +s "\gecici_proje_klasoru\tolbar.exe"
'<SYSTEM32>\attrib.exe' +r +h +s "\gecici_proje_klasoru\E.exe"
'<SYSTEM32>\attrib.exe' +r +h +s "\gecici_proje_klasoru\K.png"
'<SYSTEM32>\reg.exe' DELETE HKCU\Software\Classes\Wow6432Node\CLSID\{7B8E9164-324D-4A2E-A46D-0165FB2000EC} /f
'<SYSTEM32>\reg.exe' DELETE HKCU\Software\Classes\CLSID\{7B8E9164-324D-4A2E-A46D-0165FB2000EC} /f
'<SYSTEM32>\reg.exe' DELETE HKCU\Software\DownloadManager /v scansk /f
'<SYSTEM32>\reg.exe' DELETE HKCU\Software\Classes\CLSID\{5ED60779-4DE2-4E07-B862-974CA4FF2E9C} /f
'<SYSTEM32>\reg.exe' DELETE HKLM\Software\Classes\Wow6432Node\CLSID\{7B8E9164-324D-4A2E-A46D-0165FB2000EC} /f
'<SYSTEM32>\reg.exe' DELETE HKLM\Software\Classes\Wow6432Node\CLSID\{5ED60779-4DE2-4E07-B862-974CA4FF2E9C} /f
'<SYSTEM32>\reg.exe' DELETE HKLM\Software\Classes\CLSID\{7B8E9164-324D-4A2E-A46D-0165FB2000EC} /f
'<SYSTEM32>\reg.exe' DELETE HKLM\Software\Classes\CLSID\{5ED60779-4DE2-4E07-B862-974CA4FF2E9C} /f
'<SYSTEM32>\reg.exe' DELETE HKCU\Software\DownloadManager /v CheckUpdtVM /f
'<SYSTEM32>\reg.exe' DELETE HKCU\Software\DownloadManager /v tvfrdt /f
'%WINDIR%\syswow64\regedit.exe' /s "C:\gecici_proje_klasoru\L.reg"