Trojan.MulDrop13.38251

Техническая информация

Вредоносные функции

Запускает на исполнение

'%WINDIR%\syswow64\taskkill.exe' /f /im QwestTouchPointAgent.exe /im CenturyLinkTouchPointAgent.exe /im QwestInstaller.exe /im QwestInstallerApp.exe /im CenturyLinkInstaller.exe /im CenturyLinkInstallerApp.exe

Изменения в файловой системе

Создает следующие файлы

%TEMP%\rarsfx0\centurylinkinstallersetup.exe
%TEMP%\{97fcd698-34de-411f-8549-fdfb3ed79d90}\{c96ff998-45bd-411e-9253-b7f2660fe280}\_ise72d.tmp
%TEMP%\{97fcd698-34de-411f-8549-fdfb3ed79d90}\{c96ff998-45bd-411e-9253-b7f2660fe280}\defe72c.tmp
%TEMP%\{97fcd698-34de-411f-8549-fdfb3ed79d90}\{c96ff998-45bd-411e-9253-b7f2660fe280}\isre70c.tmp
%TEMP%\{97fcd698-34de-411f-8549-fdfb3ed79d90}\{c96ff998-45bd-411e-9253-b7f2660fe280}\stre70b.tmp
%TEMP%\{97fcd698-34de-411f-8549-fdfb3ed79d90}\isbe6fa.tmp
%TEMP%\{97fcd698-34de-411f-8549-fdfb3ed79d90}\dote6f9.tmp
%TEMP%\{97fcd698-34de-411f-8549-fdfb3ed79d90}\core6e9.tmp
%TEMP%\{97fcd698-34de-411f-8549-fdfb3ed79d90}\{c96ff998-45bd-411e-9253-b7f2660fe280}\dife6d8.tmp
%TEMP%\{97fcd698-34de-411f-8549-fdfb3ed79d90}\{c96ff998-45bd-411e-9253-b7f2660fe280}\fone6d7.tmp
%TEMP%\{97fcd698-34de-411f-8549-fdfb3ed79d90}\{c96ff998-45bd-411e-9253-b7f2660fe280}\sete6c6.tmp
%TEMP%\e687.tmp
%TEMP%\{9112cd99-cf54-4f52-b12d-178dd4ecd6db}\0x0409.ini
%TEMP%\{9112cd99-cf54-4f52-b12d-178dd4ecd6db}\setup.ini
%TEMP%\{9112cd99-cf54-4f52-b12d-178dd4ecd6db}\disk1\setup.iss
%TEMP%\{9112cd99-cf54-4f52-b12d-178dd4ecd6db}\disk1\setup.inx
%TEMP%\{9112cd99-cf54-4f52-b12d-178dd4ecd6db}\disk1\setup.ini
%TEMP%\{9112cd99-cf54-4f52-b12d-178dd4ecd6db}\disk1\setup.exe
%TEMP%\{9112cd99-cf54-4f52-b12d-178dd4ecd6db}\disk1\md5sum.exe
%TEMP%\{9112cd99-cf54-4f52-b12d-178dd4ecd6db}\disk1\license.rtf
%TEMP%\{9112cd99-cf54-4f52-b12d-178dd4ecd6db}\disk1\layout.bin
%TEMP%\{9112cd99-cf54-4f52-b12d-178dd4ecd6db}\disk1\issetup.dll
%TEMP%\{9112cd99-cf54-4f52-b12d-178dd4ecd6db}\disk1\data1.hdr
%TEMP%\{9112cd99-cf54-4f52-b12d-178dd4ecd6db}\disk1\data1.cab
%TEMP%\{9112cd99-cf54-4f52-b12d-178dd4ecd6db}\disk1\0x0409.ini
%TEMP%\rarsfx0\config.ini
%TEMP%\{97fcd698-34de-411f-8549-fdfb3ed79d90}\{c96ff998-45bd-411e-9253-b7f2660fe280}\_ise72e.tmp
%WINDIR%\centurylinkinstallersetup.log

Перемещает следующие файлы

%TEMP%\{97fcd698-34de-411f-8549-fdfb3ed79d90}\{c96ff998-45bd-411e-9253-b7f2660fe280}\sete6c6.tmp в %TEMP%\{97fcd698-34de-411f-8549-fdfb3ed79d90}\{c96ff998-45bd-411e-9253-b7f2660fe280}\setup.inx
%TEMP%\{97fcd698-34de-411f-8549-fdfb3ed79d90}\{c96ff998-45bd-411e-9253-b7f2660fe280}\fone6d7.tmp в %TEMP%\{97fcd698-34de-411f-8549-fdfb3ed79d90}\{c96ff998-45bd-411e-9253-b7f2660fe280}\fontdata.ini
%TEMP%\{97fcd698-34de-411f-8549-fdfb3ed79d90}\{c96ff998-45bd-411e-9253-b7f2660fe280}\dife6d8.tmp в %TEMP%\{97fcd698-34de-411f-8549-fdfb3ed79d90}\{c96ff998-45bd-411e-9253-b7f2660fe280}\difxdata.ini
%TEMP%\{97fcd698-34de-411f-8549-fdfb3ed79d90}\core6e9.tmp в %TEMP%\{97fcd698-34de-411f-8549-fdfb3ed79d90}\corecomp.ini
%TEMP%\{97fcd698-34de-411f-8549-fdfb3ed79d90}\dote6f9.tmp в %TEMP%\{97fcd698-34de-411f-8549-fdfb3ed79d90}\dotnetinstaller.exe
%TEMP%\{97fcd698-34de-411f-8549-fdfb3ed79d90}\isbe6fa.tmp в %TEMP%\{97fcd698-34de-411f-8549-fdfb3ed79d90}\isbew64.exe
%TEMP%\{97fcd698-34de-411f-8549-fdfb3ed79d90}\{c96ff998-45bd-411e-9253-b7f2660fe280}\stre70b.tmp в %TEMP%\{97fcd698-34de-411f-8549-fdfb3ed79d90}\{c96ff998-45bd-411e-9253-b7f2660fe280}\stringtable_0x0409.ips
%TEMP%\{97fcd698-34de-411f-8549-fdfb3ed79d90}\{c96ff998-45bd-411e-9253-b7f2660fe280}\isre70c.tmp в %TEMP%\{97fcd698-34de-411f-8549-fdfb3ed79d90}\{c96ff998-45bd-411e-9253-b7f2660fe280}\isrt.dll
%TEMP%\{97fcd698-34de-411f-8549-fdfb3ed79d90}\{c96ff998-45bd-411e-9253-b7f2660fe280}\defe72c.tmp в %TEMP%\{97fcd698-34de-411f-8549-fdfb3ed79d90}\{c96ff998-45bd-411e-9253-b7f2660fe280}\default.pal
%TEMP%\{97fcd698-34de-411f-8549-fdfb3ed79d90}\{c96ff998-45bd-411e-9253-b7f2660fe280}\_ise72d.tmp в %TEMP%\{97fcd698-34de-411f-8549-fdfb3ed79d90}\{c96ff998-45bd-411e-9253-b7f2660fe280}\_isuser_0x0409.dll
%TEMP%\{97fcd698-34de-411f-8549-fdfb3ed79d90}\{c96ff998-45bd-411e-9253-b7f2660fe280}\_ise72e.tmp в %TEMP%\{97fcd698-34de-411f-8549-fdfb3ed79d90}\{c96ff998-45bd-411e-9253-b7f2660fe280}\_isres_0x0409.dll

Другое

Ищет следующие окна

ClassName: 'EDIT' WindowName: ''
ClassName: '' WindowName: ''

Создает и запускает на исполнение

'%TEMP%\rarsfx0\centurylinkinstallersetup.exe'
'%TEMP%\{97fcd698-34de-411f-8549-fdfb3ed79d90}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{D76691C6-ECFA-466D-BF81-6A7DB624C594}
'%TEMP%\{97fcd698-34de-411f-8549-fdfb3ed79d90}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{903EBFED-96F4-42A2-BC40-CF699BBD1F23}
'%TEMP%\{97fcd698-34de-411f-8549-fdfb3ed79d90}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{C9D0569A-9E26-40DE-B639-AE45A77E65D4}
'%TEMP%\{97fcd698-34de-411f-8549-fdfb3ed79d90}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{312EC1BE-4BAE-4951-B170-C751EB2CEC1C}
'%TEMP%\{97fcd698-34de-411f-8549-fdfb3ed79d90}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{6A072BF4-03CF-4FB0-AC4E-8DF1EEE3D558}
'%TEMP%\{97fcd698-34de-411f-8549-fdfb3ed79d90}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{645F9AF9-F66E-449B-9AB5-5183031E319C}
'%TEMP%\{97fcd698-34de-411f-8549-fdfb3ed79d90}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{73158FFA-035D-4BC3-AD2A-D9740C97F1F9}
'%TEMP%\{97fcd698-34de-411f-8549-fdfb3ed79d90}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{C5B86987-0C1D-4130-ACCE-4DF474081D69}
'%TEMP%\{97fcd698-34de-411f-8549-fdfb3ed79d90}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{1BE3917E-DDFE-47F3-A6A0-84994FF19039}
'%TEMP%\{97fcd698-34de-411f-8549-fdfb3ed79d90}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{CCEBF4B1-521F-4FF9-9E1F-B2165A2FB656}
'%TEMP%\{97fcd698-34de-411f-8549-fdfb3ed79d90}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{E700E04B-4260-4A7A-A5FD-55B526A18F9E}
'%TEMP%\{97fcd698-34de-411f-8549-fdfb3ed79d90}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{E186D187-EBC2-4C3D-8279-CEC4946747FB}
'%WINDIR%\syswow64\taskkill.exe' /f /im QwestTouchPointAgent.exe /im CenturyLinkTouchPointAgent.exe /im QwestInstaller.exe /im QwestInstallerApp.exe /im CenturyLinkInstaller.exe /im CenturyLinkInstallerApp.exe' (со скрытым окном)