Trojan.MulDrop1.31518

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\top.exe] 'Debugger' = 'C:\iexplor.bat'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\zhinanzhenbrowser.exe] 'Debugger' = 'C:\iexplor.bat'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avant.exe] 'Debugger' = 'C:\iexplor.bat'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Iparmor.exe] 'Debugger' = '<SYSTEM32>\ruixing.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\hsreg.exe] 'Debugger' = '<SYSTEM32>\ruixing.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\XWebStar.exe] 'Debugger' = 'C:\iexplor.bat'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SaaYaa.exe] 'Debugger' = 'C:\iexplor.bat'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MyIE.exe] 'Debugger' = 'C:\iexplor.bat'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\See9IE.exe] 'Debugger' = 'C:\iexplor.bat'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TouchNet.exe] 'Debugger' = 'C:\iexplor.bat'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\srgui.exe] 'Debugger' = '<SYSTEM32>\ctfmon.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360safe.exe] 'Debugger' = '<SYSTEM32>\ctfmon.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360safebox.exe] 'Debugger' = '<SYSTEM32>\ctfmon.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kastray.exe] 'Debugger' = '<SYSTEM32>\ctfmon.exe'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Runonce] 'qqup' = '%CommonProgramFiles%\Microsoft Shared\kaysha.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360SE.exe] 'Debugger' = 'C:\iexplor.bat'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sriecli.exe] 'Debugger' = '<SYSTEM32>\ctfmon.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360tray.exe] 'Debugger' = '<SYSTEM32>\ctfmon.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winpatrol.exe] 'Debugger' = '<SYSTEM32>\ctfmon.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RSTray.exe] 'Debugger' = '<SYSTEM32>\ctfmon.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ast.exe] 'Debugger' = '<SYSTEM32>\ctfmon.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\opera.exe] 'Debugger' = 'C:\iexplor.bat'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\firefox.exe] 'Debugger' = 'C:\iexplor.bat'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Maxthon.exe] 'Debugger' = 'C:\iexplor.bat'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TTraveler.exe] 'Debugger' = 'C:\iexplor.bat'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\chrome.exe] 'Debugger' = 'C:\iexplor.bat'
[<HKLM>\SOFTWARE\Classes\HTTP\shell\open\command] '' = '"%PROGRAM_FILES%\Internet Explorer\IEXPLORE" ""'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '╧╡═│╩ф╚ы╖и' = '%CommonProgramFiles%\sxp.vbs'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Runonce] '360sfe' = '%ALLUSERSPROFILE%\Application Data\smss.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\theworld.exe] 'Debugger' = 'C:\iexplor.bat'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Runonce] 'runonnce' = '%CommonProgramFiles%\Adobe\sxp.vbs'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KylinBrowser.exe] 'Debugger' = 'C:\iexplor.bat'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\IERepair.exe] 'Debugger' = 'C:\iexplor.bat'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iemate.exe] 'Debugger' = 'C:\iexplor.bat'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SogouExplorer.exe] 'Debugger' = 'C:\iexplor.bat'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tango.exe] 'Debugger' = 'C:\iexplor.bat'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GreenBrowser.exe] 'Debugger' = 'C:\iexplor.bat'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MiniIE.exe] 'Debugger' = 'C:\iexplor.bat'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vu.exe] 'Debugger' = 'C:\iexplor.bat'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\suda.exe] 'Debugger' = 'C:\iexplor.bat'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360Start.exe] 'Debugger' = 'C:\iexplor.bat'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AdoIE.exe] 'Debugger' = 'C:\iexplor.bat'

Создает следующие сервисы:

[<HKLM>\SYSTEM\ControlSet001\Services\share363] 'Start' = '00000002'

Вредоносные функции:

Для затруднения выявления своего присутствия в системе

блокирует отображение:

скрытых файлов
расширений файлов

Создает и запускает на исполнение:

%TEMP%\a.exe
C:\axa.exe
%TEMP%\unstall.exe
%TEMP%\1.exe

Запускает на исполнение:

%WINDIR%\regedit.exe /s ffsa.reg
<SYSTEM32>\cmd.exe /c ""C:\vfga.bat" "
<SYSTEM32>\cmd.exe /c ""C:\bdr.bat" "
<SYSTEM32>\attrib.exe +H +A +S +R "<DRIVERS>\etc\hosts"
<SYSTEM32>\svchost.exe -k netsvcs
<SYSTEM32>\rundll32.exe "%TEMP%\1.tmp" "8A'U"
<SYSTEM32>\msiexec.exe /regserver
<SYSTEM32>\attrib.exe +H +A +S +R "%WINDIR%\ctfmoon.exe"
<SYSTEM32>\attrib.exe +H +A +S +R "%ALLUSERSPROFILE%\Application Data\smss.exe"
%WINDIR%\regedit.exe /s keysh.reg
<SYSTEM32>\attrib.exe +H +A +S +R "%CommonProgramFiles%\Microsoft Shared\kaysha.exe"
<SYSTEM32>\wscript.exe "C:\syyjfddfa.vbs"
<SYSTEM32>\wscript.exe "C:\systrren.vbs"
<SYSTEM32>\reg.exe add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /f /v "╧╡═│╩ф╚ы╖и" /t reg_sz /d "%CommonProgramFiles%\sxp.vbs"

Изменяет следующие настройки проводника Windows (Windows Explorer):

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] 'NoInternetIcon' = '00000001'

Без разрешения пользователя устанавливает новую стартовую страницу для Windows Internet Explorer.

Изменения в файловой системе:

Создает следующие файлы:

C:\html\peer_se74.html
C:\html\peer_se75.html
C:\html\peer_se76.html
C:\html\peer_se73.html
C:\systrren.vbs
C:\html\peer_se.html
C:\bdr.bat
C:\html\peer_se77.html
C:\html\peer_se82.html
C:\html\peer_se83.html
%HOMEPATH%\Start Menu\Internet Explore.lnk
C:\html\peer_se81.html
C:\html\peer_se78.html
C:\html\peer_se79.html
C:\html\peer_se80.html
C:\Internet Explore.lnk
C:\html\peer_down80.html
C:\keysh.reg
C:\html\peer_down79.html
C:\Users\All Users\Desktop\Internet Explore.lnk
C:\html\peer_down77.html
C:\html\peer_down78.html
C:\html\peer_down81.html
C:\html\peer_recomm5.html
C:\html\peer_recomm6.html
C:\html\peer_recomm7.html
C:\html\peer_recomm.html
C:\html\peer_down82.html
C:\html\peer_down83.html
C:\html\peer_down84.html
C:\Downloads\[电子书][書籍][圖書]犹太人为什么优秀.rar
C:\Downloads\报刊英语单词精华(电子书).rar
C:\Downloads\狐孽 - 全文阅读 - 鱼水情言情小说原创文学书库 - 小说_玄幻_武侠_言情_都市_科幻.rar
C:\Downloads\[电子书][書籍][圖書][武术][气功]睡功心法.rar
C:\Downloads\txt电子书_言情小说_[纳妾记]全集电子书txt.rar
C:\Downloads\txt电子书，全是经典 (1)(3)(1)(3)(2).rar
C:\Downloads\[唐诗鉴赏大辞典](上中下)[exe][电子书](1)(4)(1).rar
C:\Downloads\琼瑞妮丝&露丝华思理-金赛性学报(电子书).rar
%APPDATA%\Microsoft\Internet Explorer\Quick Launch\╞Ї╢п Internet Explorer фп└└╞ў.lnk
%TEMP%\1.tmp
<SYSTEM32>\share363.dll
C:\axa.exe
C:\Downloads\电脑四大核心硬件知识详解chm电子书(1)(4).rar
C:\Downloads\电脑故障维修大全(电子书).rar
C:\Downloads\采花录(花间曲) 全集完整版txt电子书(1).rar
%HOMEPATH%\Start Menu\Programs\Internet Explore.lnk
C:\html\peer_se88.html
C:\html\peer_se89.html
C:\html\peer_se87.html
C:\html\peer_se84.html
C:\html\peer_se85.html
C:\html\peer_se86.html
C:\Program\adtask.xml
C:\Downloads\100部经典电子书_全球通史(1).rar
C:\Downloads\100部经典电子书_法律法规(1).rar
C:\Downloads\6小说-笑话黄谜(1).rar
C:\Downloads\(写真集) - 美處女欲情.rar
C:\Program\gui.cfg
C:\ffsa.reg
C:\syyjfddfa.vbs
C:\html\home74.html
%ALLUSERSPROFILE%\Application Data\i\gl_2.gif
C:\html\home75.html
%ALLUSERSPROFILE%\Application Data\i\gl_1.gif
C:\config\pfplayertemp.ini
%ALLUSERSPROFILE%\Application Data\daohang.htm
C:\html\home.html
%ALLUSERSPROFILE%\Application Data\i\gl_3.gif
%ALLUSERSPROFILE%\Application Data\i\srh_1.gif
%ALLUSERSPROFILE%\Application Data\i\srh_2.gif
C:\html\home78.html
C:\html\home77.html
%ALLUSERSPROFILE%\Application Data\i\gl_4.gif
C:\html\home76.html
%ALLUSERSPROFILE%\Application Data\i\gl_5.gif
%TEMP%\bt61046.bat
%WINDIR%\ctfmoon.exe
%ALLUSERSPROFILE%\Application Data\smss.exe
%TEMP%\keysh.reg
%TEMP%\1.exe
%TEMP%\a.exe
%TEMP%\unstall.exe
%CommonProgramFiles%\Microsoft Shared\kaysha.exe
C:\config\config.ini
C:\iexplor.bat
C:\config\enumwindow.ini
<SYSTEM32>\skipxbar.dll
%CommonProgramFiles%\Adobe\start.bat
C:\vfga.bat
%CommonProgramFiles%\Adobe\sxp.vbs
%ALLUSERSPROFILE%\Application Data\images\gl_1.gif
C:\html\peer_down71.html
C:\html\peer_down72.html
C:\html\peer_down.html
C:\html\home85.html
C:\html\peer_do.html
%ALLUSERSPROFILE%\Application Data\images\funb.js
%ALLUSERSPROFILE%\Application Data\images\logo.jpg
C:\html\peer_down75.html
%ALLUSERSPROFILE%\桌面\Internet Explore.lnk
C:\html\peer_down76.html
C:\html\peer_down74.html
C:\html\peer_down73.html
%ALLUSERSPROFILE%\Application Data\images\sd_1.css
%ALLUSERSPROFILE%\Application Data\images\srh_1.gif
%ALLUSERSPROFILE%\Application Data\i\topbg01.gif
C:\html\home80.html
%ALLUSERSPROFILE%\Application Data\i\topbg02.gif
%ALLUSERSPROFILE%\Application Data\i\srh_5.gif
%ALLUSERSPROFILE%\Application Data\i\srh_3.gif
C:\html\home79.html
%ALLUSERSPROFILE%\Application Data\i\srh_4.gif
%ALLUSERSPROFILE%\Application Data\i\topbg03.gif
C:\html\home83.html
%ALLUSERSPROFILE%\Application Data\i\zj_2.gif
C:\html\home84.html
%ALLUSERSPROFILE%\Application Data\i\topbg05.gif
C:\html\home81.html
%ALLUSERSPROFILE%\Application Data\i\topbg04.gif
C:\html\home82.html

Присваивает атрибут 'скрытый' для следующих файлов:

%ALLUSERSPROFILE%\Application Data\i\topbg04.gif
%ALLUSERSPROFILE%\Application Data\i\topbg05.gif
%ALLUSERSPROFILE%\Application Data\i\zj_2.gif
%ALLUSERSPROFILE%\Application Data\i\topbg03.gif
%ALLUSERSPROFILE%\Application Data\i\srh_5.gif
%ALLUSERSPROFILE%\Application Data\i\topbg01.gif
%ALLUSERSPROFILE%\Application Data\i\topbg02.gif
%ALLUSERSPROFILE%\Application Data\images\sd_1.css
%ALLUSERSPROFILE%\Application Data\images\srh_1.gif
%CommonProgramFiles%\Microsoft Shared\kaysha.exe
%WINDIR%\ctfmoon.exe
%ALLUSERSPROFILE%\Application Data\images\funb.js
%ALLUSERSPROFILE%\Application Data\images\gl_1.gif
%ALLUSERSPROFILE%\Application Data\images\logo.jpg
%ALLUSERSPROFILE%\Application Data\i\srh_4.gif
%ALLUSERSPROFILE%\Application Data\daohang.htm
%ALLUSERSPROFILE%\Application Data\i\gl_1.gif
%ALLUSERSPROFILE%\Application Data\i\gl_2.gif
C:\iexplor.bat
%TEMP%\unstall.exe
%TEMP%\bt61046.bat
%CommonProgramFiles%\Adobe\start.bat
%ALLUSERSPROFILE%\Application Data\i\srh_1.gif
%ALLUSERSPROFILE%\Application Data\i\srh_2.gif
%ALLUSERSPROFILE%\Application Data\i\srh_3.gif
%ALLUSERSPROFILE%\Application Data\i\gl_5.gif
%ALLUSERSPROFILE%\Application Data\i\gl_3.gif
%ALLUSERSPROFILE%\Application Data\i\gl_4.gif
%ALLUSERSPROFILE%\Application Data\smss.exe

Удаляет следующие файлы:

C:\html\peer_recomm7.html
C:\html\peer_se.html
C:\html\peer_recomm5.html
C:\html\peer_recomm6.html
C:\html\peer_se73.html
C:\html\peer_se76.html
C:\html\peer_se77.html
C:\html\peer_se74.html
C:\html\peer_se75.html
C:\html\peer_recomm.html
C:\html\peer_down78.html
C:\html\peer_down79.html
C:\html\peer_down76.html
C:\html\peer_down77.html
C:\html\peer_down80.html
C:\html\peer_down83.html
C:\html\peer_down84.html
C:\html\peer_down81.html
C:\html\peer_down82.html
C:\html\peer_se78.html
C:\config\enumwindow.ini
C:\config\pfplayertemp.ini
C:\html\peer_se89.html
C:\config\config.ini
C:\Program\adtask.xml
C:\syyjfddfa.vbs
C:\axa.exe
C:\Program\gui.cfg
C:\ffsa.reg
C:\html\peer_se88.html
C:\html\peer_se81.html
C:\html\peer_se82.html
C:\html\peer_se79.html
C:\html\peer_se80.html
C:\html\peer_se83.html
C:\html\peer_se86.html
C:\html\peer_se87.html
C:\html\peer_se84.html
C:\html\peer_se85.html
C:\html\peer_down75.html
C:\Downloads\[电子书][書籍][圖書][武术][气功]睡功心法.rar
C:\Downloads\[电子书][書籍][圖書]犹太人为什么优秀.rar
C:\Downloads\txt电子书，全是经典 (1)(3)(1)(3)(2).rar
C:\Downloads\[唐诗鉴赏大辞典](上中下)[exe][电子书](1)(4)(1).rar
C:\Downloads\报刊英语单词精华(电子书).rar
C:\Downloads\电脑四大核心硬件知识详解chm电子书(1)(4).rar
C:\Downloads\电脑故障维修大全(电子书).rar
C:\Downloads\狐孽 - 全文阅读 - 鱼水情言情小说原创文学书库 - 小说_玄幻_武侠_言情_都市_科幻.rar
C:\Downloads\琼瑞妮丝&露丝华思理-金赛性学报(电子书).rar
C:\Downloads\txt电子书_言情小说_[纳妾记]全集电子书txt.rar
C:\keysh.reg
C:\Internet Explore.lnk
%TEMP%\keysh.reg
%TEMP%\bt61046.bat
C:\systrren.vbs
C:\Downloads\100部经典电子书_法律法规(1).rar
C:\Downloads\6小说-笑话黄谜(1).rar
C:\Downloads\(写真集) - 美處女欲情.rar
C:\Downloads\100部经典电子书_全球通史(1).rar
C:\Downloads\采花录(花间曲) 全集完整版txt电子书(1).rar
C:\html\home85.html
C:\html\peer_do.html
C:\html\home83.html
C:\html\home84.html
C:\html\peer_down.html
C:\html\peer_down73.html
C:\html\peer_down74.html
C:\html\peer_down71.html
C:\html\peer_down72.html
C:\html\home82.html
C:\html\home75.html
C:\html\home76.html
C:\html\home.html
C:\html\home74.html
C:\html\home77.html
C:\html\home80.html
C:\html\home81.html
C:\html\home78.html
C:\html\home79.html

Сетевая активность:

Подключается к:

'zi#####eifei.3322.org':123

UDP:

DNS ASK zi#####eifei.3322.org

Другое:

Ищет следующие окна:

ClassName: 'RegEdit_RegEdit' WindowName: ''
ClassName: 'Shell_TrayWnd' WindowName: ''
ClassName: 'EDIT' WindowName: ''

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней