Trojan.MulDrop14.1473

Техническая информация

Вредоносные функции

Запускает на исполнение

'%WINDIR%\syswow64\taskkill.exe' /f /im QwestTouchPointAgent.exe /im CenturyLinkTouchPointAgent.exe /im QwestInstaller.exe /im QwestInstallerApp.exe /im CenturyLinkInstaller.exe /im CenturyLinkInstallerApp.exe

Изменения в файловой системе

Создает следующие файлы

%TEMP%\rarsfx0\centurylinkinstallersetup.exe
%TEMP%\{b158e1f0-f44d-4f53-8c48-9a4ba603ae02}\{c96ff998-45bd-411e-9253-b7f2660fe280}\_is8993.tmp
%TEMP%\{b158e1f0-f44d-4f53-8c48-9a4ba603ae02}\{c96ff998-45bd-411e-9253-b7f2660fe280}\def8992.tmp
%TEMP%\{b158e1f0-f44d-4f53-8c48-9a4ba603ae02}\{c96ff998-45bd-411e-9253-b7f2660fe280}\isr8982.tmp
%TEMP%\{b158e1f0-f44d-4f53-8c48-9a4ba603ae02}\{c96ff998-45bd-411e-9253-b7f2660fe280}\str8971.tmp
%TEMP%\{b158e1f0-f44d-4f53-8c48-9a4ba603ae02}\isb8960.tmp
%TEMP%\{b158e1f0-f44d-4f53-8c48-9a4ba603ae02}\dot895f.tmp
%TEMP%\{b158e1f0-f44d-4f53-8c48-9a4ba603ae02}\cor894f.tmp
%TEMP%\{b158e1f0-f44d-4f53-8c48-9a4ba603ae02}\{c96ff998-45bd-411e-9253-b7f2660fe280}\dif894e.tmp
%TEMP%\{b158e1f0-f44d-4f53-8c48-9a4ba603ae02}\{c96ff998-45bd-411e-9253-b7f2660fe280}\fon893d.tmp
%TEMP%\{b158e1f0-f44d-4f53-8c48-9a4ba603ae02}\{c96ff998-45bd-411e-9253-b7f2660fe280}\set892d.tmp
%TEMP%\88ed.tmp
%TEMP%\{b48d2b64-90b1-489d-99d3-d80e9e785f94}\0x0409.ini
%TEMP%\{b48d2b64-90b1-489d-99d3-d80e9e785f94}\setup.ini
%TEMP%\{b48d2b64-90b1-489d-99d3-d80e9e785f94}\disk1\setup.iss
%TEMP%\{b48d2b64-90b1-489d-99d3-d80e9e785f94}\disk1\setup.inx
%TEMP%\{b48d2b64-90b1-489d-99d3-d80e9e785f94}\disk1\setup.ini
%TEMP%\{b48d2b64-90b1-489d-99d3-d80e9e785f94}\disk1\setup.exe
%TEMP%\{b48d2b64-90b1-489d-99d3-d80e9e785f94}\disk1\md5sum.exe
%TEMP%\{b48d2b64-90b1-489d-99d3-d80e9e785f94}\disk1\license.rtf
%TEMP%\{b48d2b64-90b1-489d-99d3-d80e9e785f94}\disk1\layout.bin
%TEMP%\{b48d2b64-90b1-489d-99d3-d80e9e785f94}\disk1\issetup.dll
%TEMP%\{b48d2b64-90b1-489d-99d3-d80e9e785f94}\disk1\data1.hdr
%TEMP%\{b48d2b64-90b1-489d-99d3-d80e9e785f94}\disk1\data1.cab
%TEMP%\{b48d2b64-90b1-489d-99d3-d80e9e785f94}\disk1\0x0409.ini
%TEMP%\rarsfx0\config.ini
%TEMP%\{b158e1f0-f44d-4f53-8c48-9a4ba603ae02}\{c96ff998-45bd-411e-9253-b7f2660fe280}\_is8994.tmp
%WINDIR%\centurylinkinstallersetup.log

Перемещает следующие файлы

%TEMP%\{b158e1f0-f44d-4f53-8c48-9a4ba603ae02}\{c96ff998-45bd-411e-9253-b7f2660fe280}\set892d.tmp в %TEMP%\{b158e1f0-f44d-4f53-8c48-9a4ba603ae02}\{c96ff998-45bd-411e-9253-b7f2660fe280}\setup.inx
%TEMP%\{b158e1f0-f44d-4f53-8c48-9a4ba603ae02}\{c96ff998-45bd-411e-9253-b7f2660fe280}\fon893d.tmp в %TEMP%\{b158e1f0-f44d-4f53-8c48-9a4ba603ae02}\{c96ff998-45bd-411e-9253-b7f2660fe280}\fontdata.ini
%TEMP%\{b158e1f0-f44d-4f53-8c48-9a4ba603ae02}\{c96ff998-45bd-411e-9253-b7f2660fe280}\dif894e.tmp в %TEMP%\{b158e1f0-f44d-4f53-8c48-9a4ba603ae02}\{c96ff998-45bd-411e-9253-b7f2660fe280}\difxdata.ini
%TEMP%\{b158e1f0-f44d-4f53-8c48-9a4ba603ae02}\cor894f.tmp в %TEMP%\{b158e1f0-f44d-4f53-8c48-9a4ba603ae02}\corecomp.ini
%TEMP%\{b158e1f0-f44d-4f53-8c48-9a4ba603ae02}\dot895f.tmp в %TEMP%\{b158e1f0-f44d-4f53-8c48-9a4ba603ae02}\dotnetinstaller.exe
%TEMP%\{b158e1f0-f44d-4f53-8c48-9a4ba603ae02}\isb8960.tmp в %TEMP%\{b158e1f0-f44d-4f53-8c48-9a4ba603ae02}\isbew64.exe
%TEMP%\{b158e1f0-f44d-4f53-8c48-9a4ba603ae02}\{c96ff998-45bd-411e-9253-b7f2660fe280}\str8971.tmp в %TEMP%\{b158e1f0-f44d-4f53-8c48-9a4ba603ae02}\{c96ff998-45bd-411e-9253-b7f2660fe280}\stringtable_0x0409.ips
%TEMP%\{b158e1f0-f44d-4f53-8c48-9a4ba603ae02}\{c96ff998-45bd-411e-9253-b7f2660fe280}\isr8982.tmp в %TEMP%\{b158e1f0-f44d-4f53-8c48-9a4ba603ae02}\{c96ff998-45bd-411e-9253-b7f2660fe280}\isrt.dll
%TEMP%\{b158e1f0-f44d-4f53-8c48-9a4ba603ae02}\{c96ff998-45bd-411e-9253-b7f2660fe280}\def8992.tmp в %TEMP%\{b158e1f0-f44d-4f53-8c48-9a4ba603ae02}\{c96ff998-45bd-411e-9253-b7f2660fe280}\default.pal
%TEMP%\{b158e1f0-f44d-4f53-8c48-9a4ba603ae02}\{c96ff998-45bd-411e-9253-b7f2660fe280}\_is8993.tmp в %TEMP%\{b158e1f0-f44d-4f53-8c48-9a4ba603ae02}\{c96ff998-45bd-411e-9253-b7f2660fe280}\_isuser_0x0409.dll
%TEMP%\{b158e1f0-f44d-4f53-8c48-9a4ba603ae02}\{c96ff998-45bd-411e-9253-b7f2660fe280}\_is8994.tmp в %TEMP%\{b158e1f0-f44d-4f53-8c48-9a4ba603ae02}\{c96ff998-45bd-411e-9253-b7f2660fe280}\_isres_0x0409.dll

Другое

Ищет следующие окна

ClassName: 'EDIT' WindowName: ''
ClassName: '' WindowName: ''

Создает и запускает на исполнение

'%TEMP%\rarsfx0\centurylinkinstallersetup.exe'
'%TEMP%\{b158e1f0-f44d-4f53-8c48-9a4ba603ae02}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{1F80BFE5-A1B5-4406-944B-E01655EBD246}
'%TEMP%\{b158e1f0-f44d-4f53-8c48-9a4ba603ae02}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{A8A05E79-32FF-4C82-8C75-20E2D4E9F1B9}
'%TEMP%\{b158e1f0-f44d-4f53-8c48-9a4ba603ae02}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{CE28CD7E-CE4D-4839-8427-93123C2DC264}
'%TEMP%\{b158e1f0-f44d-4f53-8c48-9a4ba603ae02}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{9F2102FD-1BEC-4561-93D9-225A395CC3F8}
'%TEMP%\{b158e1f0-f44d-4f53-8c48-9a4ba603ae02}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{DC777599-D307-423D-A4D5-D47E3677925B}
'%TEMP%\{b158e1f0-f44d-4f53-8c48-9a4ba603ae02}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{1CD10AF7-FDEF-4A82-AC95-9BE653F13AAF}
'%TEMP%\{b158e1f0-f44d-4f53-8c48-9a4ba603ae02}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{45F59291-12C5-4F15-AD73-701EAAFA325E}
'%TEMP%\{b158e1f0-f44d-4f53-8c48-9a4ba603ae02}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{4472B7FF-7313-4583-B537-B443494A95FA}
'%TEMP%\{b158e1f0-f44d-4f53-8c48-9a4ba603ae02}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{2135684B-C967-4AA8-A56B-2B4384760EC9}
'%TEMP%\{b158e1f0-f44d-4f53-8c48-9a4ba603ae02}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{104A0CA3-6637-4FFB-B1A3-A4669C724A5E}
'%TEMP%\{b158e1f0-f44d-4f53-8c48-9a4ba603ae02}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{82EFC087-8F42-485C-A880-255020C239B4}
'%TEMP%\{b158e1f0-f44d-4f53-8c48-9a4ba603ae02}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{2A352B30-450E-4E1E-B6BF-C8FD5179645C}
'%WINDIR%\syswow64\taskkill.exe' /f /im QwestTouchPointAgent.exe /im CenturyLinkTouchPointAgent.exe /im QwestInstaller.exe /im QwestInstallerApp.exe /im CenturyLinkInstaller.exe /im CenturyLinkInstallerApp.exe' (со скрытым окном)