Trojan.MulDrop11.47372

Техническая информация

Вредоносные функции

Запускает на исполнение

'<SYSTEM32>\taskkill.exe' /IM IDMan.exe /f
'<SYSTEM32>\taskkill.exe' /IM IDMIntegrator64.exe /f
'<SYSTEM32>\taskkill.exe' /IM IDMGrHlp.exe /f
'<SYSTEM32>\taskkill.exe' /IM IEMonitor.exe /F
'<SYSTEM32>\taskkill.exe' /IM MediumILStart.exe /f

Изменения в файловой системе

Создает следующие файлы

%TEMP%\autb846.tmp
C:\gecici_proje_klasoru\grey.gif
%TEMP%\autb885.tmp
C:\gecici_proje_klasoru\klp.png
%TEMP%\autb886.tmp
C:\gecici_proje_klasoru\e.exe
%TEMP%\autb8d5.tmp
C:\gecici_proje_klasoru\idm_reset.exe
%TEMP%\autb8e6.tmp
C:\gecici_proje_klasoru\idm_trial.reg
%TEMP%\be12.tmp\idm_reset.bat
%HOMEPATH%\desktop\download free full programs\byemir candan - youtube.url
%HOMEPATH%\desktop\download free full programs\download free full programs.url
%HOMEPATH%\desktop\download free full programs\facebook grups.url
%HOMEPATH%\desktop\download free full programs\important note.txt

Удаляет следующие файлы

%TEMP%\autb846.tmp
%TEMP%\autb885.tmp
%TEMP%\autb886.tmp
%TEMP%\autb8d5.tmp
%TEMP%\autb8e6.tmp
%TEMP%\be12.tmp\idm_reset.bat
C:\gecici_proje_klasoru\e.exe
C:\gecici_proje_klasoru\grey.gif
C:\gecici_proje_klasoru\idm_reset.exe
C:\gecici_proje_klasoru\idm_trial.reg
C:\gecici_proje_klasoru\klp.png

Другое

Ищет следующие окна

ClassName: 'RegEdit_RegEdit' WindowName: ''
ClassName: '' WindowName: ''
ClassName: 'EDIT' WindowName: ''

Создает и запускает на исполнение

'C:\gecici_proje_klasoru\idm_reset.exe'
'C:\gecici_proje_klasoru\e.exe'
'%WINDIR%\syswow64\regedit.exe' /s "C:\gecici_proje_klasoru\idm_trial.reg"' (со скрытым окном)
'<SYSTEM32>\cmd.exe' /c "%TEMP%\BE12.tmp\idm_reset.bat C:\gecici_proje_klasoru\idm_reset.exe"' (со скрытым окном)
'%WINDIR%\syswow64\cmd.exe' /c ping -n 5 127.0.0.1' (со скрытым окном)

Запускает на исполнение

'%WINDIR%\syswow64\regedit.exe' /s "C:\gecici_proje_klasoru\idm_trial.reg"
'<SYSTEM32>\reg.exe' delete "HKLM\Software\Classes\Wow6432Node\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7}" /f
'<SYSTEM32>\reg.exe' delete "HKCU\Software\DownloadManager" /v "FName" /f
'<SYSTEM32>\reg.exe' delete "HKCU\Software\DownloadManager" /v "LName" /f
'<SYSTEM32>\reg.exe' delete "HKCU\Software\DownloadManager" /v "Email" /f
'<SYSTEM32>\reg.exe' delete "HKCU\Software\DownloadManager" /v "Serial" /f
'<SYSTEM32>\reg.exe' add "HKCU\Software\DownloadManager" /f
'<SYSTEM32>\reg.exe' delete "HKLM\Software\Internet Download Manager" /v "FName" /f
'<SYSTEM32>\reg.exe' delete "HKLM\Software\Internet Download Manager" /v "Email" /f
'%WINDIR%\syswow64\cmd.exe' /c ping -n 5 127.0.0.1
'<SYSTEM32>\reg.exe' delete "HKLM\Software\Internet Download Manager" /v "Serial" /f
'<SYSTEM32>\reg.exe' add "HKLM\Software\Internet Download Manager" /f
'<SYSTEM32>\reg.exe' delete "HKLM\Software\Wow6432Node\Internet Download Manager" /v "FName" /f
'<SYSTEM32>\reg.exe' delete "HKLM\Software\Wow6432Node\Internet Download Manager" /v "LName" /f
'<SYSTEM32>\reg.exe' delete "HKLM\Software\Wow6432Node\Internet Download Manager" /v "Email" /f
'<SYSTEM32>\reg.exe' delete "HKLM\Software\Wow6432Node\Internet Download Manager" /v "Serial" /f
'<SYSTEM32>\reg.exe' add "HKLM\Software\Wow6432Node\Internet Download Manager" /f
'<SYSTEM32>\reg.exe' delete "HKLM\Software\Classes\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7}" /f
'<SYSTEM32>\reg.exe' delete "HKLM\Software\Internet Download Manager" /v "LName" /f
'<SYSTEM32>\reg.exe' delete "HKCU\Software\Classes\Wow6432Node\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7}" /f
'<SYSTEM32>\reg.exe' delete "HKLM\Software\Classes\CLSID\{6DDF00DB-1234-46EC-8356-27E7B2051192}" /f
'<SYSTEM32>\cmd.exe' /c "%TEMP%\BE12.tmp\idm_reset.bat C:\gecici_proje_klasoru\idm_reset.exe"
'<SYSTEM32>\reg.exe' delete "HKCU\Software\Classes\CLSID\{7B8E9164-324D-4A2E-A46D-0165FB2000EC}" /f
'<SYSTEM32>\reg.exe' delete "HKCU\Software\Classes\Wow6432Node\CLSID\{7B8E9164-324D-4A2E-A46D-0165FB2000EC}" /f
'<SYSTEM32>\reg.exe' delete "HKLM\Software\Classes\CLSID\{7B8E9164-324D-4A2E-A46D-0165FB2000EC}" /f
'<SYSTEM32>\reg.exe' delete "HKLM\Software\Classes\Wow6432Node\CLSID\{7B8E9164-324D-4A2E-A46D-0165FB2000EC}" /f
'<SYSTEM32>\reg.exe' delete "HKCU\Software\Classes\CLSID\{6DDF00DB-1234-46EC-8356-27E7B2051192}" /f
'<SYSTEM32>\reg.exe' delete "HKCU\Software\Classes\Wow6432Node\CLSID\{6DDF00DB-1234-46EC-8356-27E7B2051192}" /f
'<SYSTEM32>\reg.exe' delete "HKLM\Software\Classes\Wow6432Node\CLSID\{6DDF00DB-1234-46EC-8356-27E7B2051192}" /f
'<SYSTEM32>\reg.exe' delete "HKLM\Software\Classes\Wow6432Node\CLSID\{5ED60779-4DE2-4E07-B862-974CA4FF2E9C}" /f
'<SYSTEM32>\reg.exe' delete "HKCU\Software\Classes\CLSID\{D5B91409-A8CA-4973-9A0B-59F713D25671}" /f
'<SYSTEM32>\reg.exe' delete "HKCU\Software\Classes\Wow6432Node\CLSID\{D5B91409-A8CA-4973-9A0B-59F713D25671}" /f
'<SYSTEM32>\reg.exe' delete "HKLM\Software\Classes\CLSID\{D5B91409-A8CA-4973-9A0B-59F713D25671}" /f
'<SYSTEM32>\reg.exe' delete "HKLM\Software\Classes\Wow6432Node\CLSID\{D5B91409-A8CA-4973-9A0B-59F713D25671}" /f
'<SYSTEM32>\reg.exe' delete "HKCU\Software\Classes\CLSID\{5ED60779-4DE2-4E07-B862-974CA4FF2E9C}" /f
'<SYSTEM32>\reg.exe' delete "HKCU\Software\Classes\Wow6432Node\CLSID\{5ED60779-4DE2-4E07-B862-974CA4FF2E9C}" /f
'<SYSTEM32>\reg.exe' delete "HKLM\Software\Classes\CLSID\{5ED60779-4DE2-4E07-B862-974CA4FF2E9C}" /f
'<SYSTEM32>\reg.exe' delete "HKCU\Software\Classes\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7}" /f
'%WINDIR%\syswow64\ping.exe' -n 5 127.0.0.1