Trojan.MulDrop4.745

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] 'WinSideBySideSetupCleanup 646036' = 'rundll32 sxs.dll,SxspRunDllDeleteDirectory %WINDIR%\WinSxS\InstallTemp\646036'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Adparatus' = '"%PROGRAM_FILES%\Adparatus\Adparatus.exe"'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] 'WinSideBySideSetupCleanup 640049' = 'rundll32 sxs.dll,SxspRunDllDeleteDirectory %WINDIR%\WinSxS\InstallTemp\640049'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] 'WinSideBySideSetupCleanup 634843' = 'rundll32 sxs.dll,SxspRunDllDeleteDirectory %WINDIR%\WinSxS\InstallTemp\634843'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] 'WinSideBySideSetupCleanup 636171' = 'rundll32 sxs.dll,SxspRunDllDeleteDirectory %WINDIR%\WinSxS\InstallTemp\636171'

Вредоносные функции:

Создает и запускает на исполнение:

%PROGRAM_FILES%\Adparatus\Adparatus.exe /set

Запускает на исполнение:

<SYSTEM32>\msiexec.exe /i "%TEMP%\Microsoft_VC80_CRT_x86.msi" /norestart /quiet
<SYSTEM32>\msiexec.exe -Embedding C7B612D0C11C3117BAAD27B7D0DC5122
<SYSTEM32>\msiexec.exe /i "%TEMP%\msxml4sys32.msi" /norestart /quiet
<SYSTEM32>\msiexec.exe /i "%TEMP%\msxml4sxs32.msi" /norestart /quiet
<SYSTEM32>\msiexec.exe /V

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\Microsoft_VC80_CRT_x86.msi
%PROGRAM_FILES%\Adparatus\Adparatus.dll
%WINDIR%\Installer\23df3.msi
%WINDIR%\Installer\MSIA.tmp
%WINDIR%\Installer\MSI9.tmp
<SYSTEM32>\msxml4r.dll
<SYSTEM32>\msxml4.dll
%PROGRAM_FILES%\Adparatus\Adparatus.exe
%PROGRAM_FILES%\Adparatus\AdparatusResources.dll
%PROGRAM_FILES%\Adparatus\Adparatus.ico
C:\Config.Msi\23df6.rbs
%HOMEPATH%\Start Menu\Programs\Adparatus\Uninstall Adparatus.lnk
%HOMEPATH%\Start Menu\Programs\Adparatus\About Adparatus.lnk
%PROGRAM_FILES%\Adparatus\Uninstall.exe
%TEMP%\nsx2.tmp\inetc.dll
%TEMP%\nsx2.tmp\Math.dll
%PROGRAM_FILES%\Adparatus\FF\2594\components\Adparatus2594.dll
%PROGRAM_FILES%\Adparatus\FF\2594\install.rdf
%PROGRAM_FILES%\Adparatus\FF\2594\components\MSWBCtl2594.dll
%HOMEPATH%\Start Menu\Programs\Adparatus\Adparatus Support.lnk
%PROGRAM_FILES%\Adparatus\Support.url
C:\Config.Msi\23df1.rbs
%WINDIR%\WinSxS\InstallTemp\634843\msxml4.dll
C:\Config.Msi\23dec.rbs
%WINDIR%\WinSxS\InstallTemp\634843\msxml4.Manifest
%WINDIR%\WinSxS\InstallTemp\636171\msxml4r.dll
%WINDIR%\WinSxS\InstallTemp\634843\msxml4.cat
%TEMP%\msxml4sxs32.msi
%TEMP%\nsx2.tmp\System.dll
%WINDIR%\Installer\23de9.msi
%WINDIR%\Installer\MSI3.tmp
%WINDIR%\WinSxS\InstallTemp\636171\msxml4r.Manifest
%WINDIR%\WinSxS\InstallTemp\646036\Manifests\x86_Microsoft.MSXML2R_6bd6b9abf345378f_4.1.0.0_x-ww_29c3ad6a.Manifest
%WINDIR%\WinSxS\InstallTemp\646036\Manifests\x86_Microsoft.MSXML2R_6bd6b9abf345378f_4.1.0.0_x-ww_29c3ad6a.cat
%TEMP%\msxml4sys32.msi
%WINDIR%\Installer\MSI6.tmp
%WINDIR%\Installer\23dee.msi
%WINDIR%\WinSxS\InstallTemp\640049\x86_Microsoft.MSXML2_6bd6b9abf345378f_4.20.9818.0_x-ww_8ff50c5d\msxml4.dll
%WINDIR%\WinSxS\InstallTemp\636171\msxml4r.cat
%WINDIR%\WinSxS\InstallTemp\640049\Manifests\x86_Microsoft.MSXML2_6bd6b9abf345378f_4.20.9818.0_x-ww_8ff50c5d.cat
%WINDIR%\WinSxS\InstallTemp\646036\x86_Microsoft.MSXML2R_6bd6b9abf345378f_4.1.0.0_x-ww_29c3ad6a\msxml4r.dll
%WINDIR%\WinSxS\InstallTemp\640049\Manifests\x86_Microsoft.MSXML2_6bd6b9abf345378f_4.20.9818.0_x-ww_8ff50c5d.Manifest