Trojan.MulDrop15.61293

Техническая информация

Вредоносные функции

Запускает на исполнение

'%WINDIR%\syswow64\taskkill.exe' /f /im QwestTouchPointAgent.exe /im CenturyLinkTouchPointAgent.exe /im QwestInstaller.exe /im QwestInstallerApp.exe /im CenturyLinkInstaller.exe /im CenturyLinkInstallerApp.exe

Изменения в файловой системе

Создает следующие файлы

%TEMP%\rarsfx0\centurylinkinstallersetup.exe
%TEMP%\{31b0a7a5-cd3d-410c-8a40-0a9cbc34081d}\{c96ff998-45bd-411e-9253-b7f2660fe280}\_is68bb.tmp
%TEMP%\{31b0a7a5-cd3d-410c-8a40-0a9cbc34081d}\{c96ff998-45bd-411e-9253-b7f2660fe280}\def68ba.tmp
%TEMP%\{31b0a7a5-cd3d-410c-8a40-0a9cbc34081d}\{c96ff998-45bd-411e-9253-b7f2660fe280}\isr68a9.tmp
%TEMP%\{31b0a7a5-cd3d-410c-8a40-0a9cbc34081d}\{c96ff998-45bd-411e-9253-b7f2660fe280}\str68a8.tmp
%TEMP%\{31b0a7a5-cd3d-410c-8a40-0a9cbc34081d}\isb6898.tmp
%TEMP%\{31b0a7a5-cd3d-410c-8a40-0a9cbc34081d}\dot6897.tmp
%TEMP%\{31b0a7a5-cd3d-410c-8a40-0a9cbc34081d}\cor6896.tmp
%TEMP%\{31b0a7a5-cd3d-410c-8a40-0a9cbc34081d}\{c96ff998-45bd-411e-9253-b7f2660fe280}\dif6885.tmp
%TEMP%\{31b0a7a5-cd3d-410c-8a40-0a9cbc34081d}\{c96ff998-45bd-411e-9253-b7f2660fe280}\fon6884.tmp
%TEMP%\{31b0a7a5-cd3d-410c-8a40-0a9cbc34081d}\{c96ff998-45bd-411e-9253-b7f2660fe280}\set6873.tmp
%TEMP%\6844.tmp
%TEMP%\{9a1134fe-cc73-4d74-a8c9-a1c61f55df07}\0x0409.ini
%TEMP%\{9a1134fe-cc73-4d74-a8c9-a1c61f55df07}\setup.ini
%TEMP%\{9a1134fe-cc73-4d74-a8c9-a1c61f55df07}\disk1\setup.iss
%TEMP%\{9a1134fe-cc73-4d74-a8c9-a1c61f55df07}\disk1\setup.inx
%TEMP%\{9a1134fe-cc73-4d74-a8c9-a1c61f55df07}\disk1\setup.ini
%TEMP%\{9a1134fe-cc73-4d74-a8c9-a1c61f55df07}\disk1\setup.exe
%TEMP%\{9a1134fe-cc73-4d74-a8c9-a1c61f55df07}\disk1\md5sum.exe
%TEMP%\{9a1134fe-cc73-4d74-a8c9-a1c61f55df07}\disk1\license.rtf
%TEMP%\{9a1134fe-cc73-4d74-a8c9-a1c61f55df07}\disk1\layout.bin
%TEMP%\{9a1134fe-cc73-4d74-a8c9-a1c61f55df07}\disk1\issetup.dll
%TEMP%\{9a1134fe-cc73-4d74-a8c9-a1c61f55df07}\disk1\data1.hdr
%TEMP%\{9a1134fe-cc73-4d74-a8c9-a1c61f55df07}\disk1\data1.cab
%TEMP%\{9a1134fe-cc73-4d74-a8c9-a1c61f55df07}\disk1\0x0409.ini
%TEMP%\rarsfx0\config.ini
%TEMP%\{31b0a7a5-cd3d-410c-8a40-0a9cbc34081d}\{c96ff998-45bd-411e-9253-b7f2660fe280}\_is68cb.tmp
%WINDIR%\centurylinkinstallersetup.log

Перемещает следующие файлы

%TEMP%\{31b0a7a5-cd3d-410c-8a40-0a9cbc34081d}\{c96ff998-45bd-411e-9253-b7f2660fe280}\set6873.tmp в %TEMP%\{31b0a7a5-cd3d-410c-8a40-0a9cbc34081d}\{c96ff998-45bd-411e-9253-b7f2660fe280}\setup.inx
%TEMP%\{31b0a7a5-cd3d-410c-8a40-0a9cbc34081d}\{c96ff998-45bd-411e-9253-b7f2660fe280}\fon6884.tmp в %TEMP%\{31b0a7a5-cd3d-410c-8a40-0a9cbc34081d}\{c96ff998-45bd-411e-9253-b7f2660fe280}\fontdata.ini
%TEMP%\{31b0a7a5-cd3d-410c-8a40-0a9cbc34081d}\{c96ff998-45bd-411e-9253-b7f2660fe280}\dif6885.tmp в %TEMP%\{31b0a7a5-cd3d-410c-8a40-0a9cbc34081d}\{c96ff998-45bd-411e-9253-b7f2660fe280}\difxdata.ini
%TEMP%\{31b0a7a5-cd3d-410c-8a40-0a9cbc34081d}\cor6896.tmp в %TEMP%\{31b0a7a5-cd3d-410c-8a40-0a9cbc34081d}\corecomp.ini
%TEMP%\{31b0a7a5-cd3d-410c-8a40-0a9cbc34081d}\dot6897.tmp в %TEMP%\{31b0a7a5-cd3d-410c-8a40-0a9cbc34081d}\dotnetinstaller.exe
%TEMP%\{31b0a7a5-cd3d-410c-8a40-0a9cbc34081d}\isb6898.tmp в %TEMP%\{31b0a7a5-cd3d-410c-8a40-0a9cbc34081d}\isbew64.exe
%TEMP%\{31b0a7a5-cd3d-410c-8a40-0a9cbc34081d}\{c96ff998-45bd-411e-9253-b7f2660fe280}\str68a8.tmp в %TEMP%\{31b0a7a5-cd3d-410c-8a40-0a9cbc34081d}\{c96ff998-45bd-411e-9253-b7f2660fe280}\stringtable_0x0409.ips
%TEMP%\{31b0a7a5-cd3d-410c-8a40-0a9cbc34081d}\{c96ff998-45bd-411e-9253-b7f2660fe280}\isr68a9.tmp в %TEMP%\{31b0a7a5-cd3d-410c-8a40-0a9cbc34081d}\{c96ff998-45bd-411e-9253-b7f2660fe280}\isrt.dll
%TEMP%\{31b0a7a5-cd3d-410c-8a40-0a9cbc34081d}\{c96ff998-45bd-411e-9253-b7f2660fe280}\def68ba.tmp в %TEMP%\{31b0a7a5-cd3d-410c-8a40-0a9cbc34081d}\{c96ff998-45bd-411e-9253-b7f2660fe280}\default.pal
%TEMP%\{31b0a7a5-cd3d-410c-8a40-0a9cbc34081d}\{c96ff998-45bd-411e-9253-b7f2660fe280}\_is68bb.tmp в %TEMP%\{31b0a7a5-cd3d-410c-8a40-0a9cbc34081d}\{c96ff998-45bd-411e-9253-b7f2660fe280}\_isuser_0x0409.dll
%TEMP%\{31b0a7a5-cd3d-410c-8a40-0a9cbc34081d}\{c96ff998-45bd-411e-9253-b7f2660fe280}\_is68cb.tmp в %TEMP%\{31b0a7a5-cd3d-410c-8a40-0a9cbc34081d}\{c96ff998-45bd-411e-9253-b7f2660fe280}\_isres_0x0409.dll

Другое

Ищет следующие окна

ClassName: 'EDIT' WindowName: ''
ClassName: '' WindowName: ''

Создает и запускает на исполнение

'%TEMP%\rarsfx0\centurylinkinstallersetup.exe'
'%TEMP%\{31b0a7a5-cd3d-410c-8a40-0a9cbc34081d}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{C72754AF-B4B9-4EA7-A3A4-E49B1BA4E723}
'%TEMP%\{31b0a7a5-cd3d-410c-8a40-0a9cbc34081d}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{D718ECB8-8B57-43ED-87ED-A2572239D193}
'%TEMP%\{31b0a7a5-cd3d-410c-8a40-0a9cbc34081d}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{A191659D-FF35-4D5C-8E41-48DA0C2C9807}
'%TEMP%\{31b0a7a5-cd3d-410c-8a40-0a9cbc34081d}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{7C6F5169-1AB8-4979-9C84-32AA3E29A215}
'%TEMP%\{31b0a7a5-cd3d-410c-8a40-0a9cbc34081d}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{E679F418-C1BB-4EB5-9562-94B0A2D2A294}
'%TEMP%\{31b0a7a5-cd3d-410c-8a40-0a9cbc34081d}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{A4147968-DDB0-4173-A65D-8CD299E40583}
'%TEMP%\{31b0a7a5-cd3d-410c-8a40-0a9cbc34081d}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{8D535720-473C-44FC-B47E-164CF8424D8A}
'%TEMP%\{31b0a7a5-cd3d-410c-8a40-0a9cbc34081d}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{66D223DB-4231-496D-8850-E4283B103572}
'%TEMP%\{31b0a7a5-cd3d-410c-8a40-0a9cbc34081d}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{EBBE24AA-9B20-466D-A0B4-E314F05FE89C}
'%TEMP%\{31b0a7a5-cd3d-410c-8a40-0a9cbc34081d}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{D7ECA97E-0ABF-4DD5-BDCF-0D0D7860B16C}
'%TEMP%\{31b0a7a5-cd3d-410c-8a40-0a9cbc34081d}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{CD7E0EAF-15A8-4940-9500-F08D5562267D}
'%TEMP%\{31b0a7a5-cd3d-410c-8a40-0a9cbc34081d}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{259CDD5A-810D-4AA7-88C4-E684C31BC8DB}
'%WINDIR%\syswow64\taskkill.exe' /f /im QwestTouchPointAgent.exe /im CenturyLinkTouchPointAgent.exe /im QwestInstaller.exe /im QwestInstallerApp.exe /im CenturyLinkInstaller.exe /im CenturyLinkInstallerApp.exe' (со скрытым окном)