Trojan.MulDrop16.12149

Техническая информация

Для обеспечения автозапуска и распространения

Модифицирует следующие ключи реестра

[<HKCU>\SOFTWARE\Microsoft\Command Processor] 'AutoRun' = '"%APPDATA%\Adobe\LogTransport2\Logs\XzNOBGdrYvO2b2oateA2MoQNmbQd6VIRVrp2DsFL.exe" O 2>NUL'
[<HKLM>\SOFTWARE\Microsoft\Command Processor] 'AutoRun' = '"C:\Users\Public\Recorded TV\Yayu0ZfHjhw9VOS7Te8DsRtYggKbAXgLGUYVz6wRhNY0PNs.exe" O 2>NUL'
[<HKCU>\SOFTWARE\Microsoft\Command Processor] 'AutoRun' = '"%TEMP%\acrord32_sbx\<INETFILES>\YOdJ4sMxA4AnLT8qlX2Q.exe" O 2>NUL'
[\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Command Processor] 'AutoRun' = '"%LOCALAPPDATA%\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\8.1_0\_locales\no\erXUyEL...
[\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Command Processor] 'AutoRun' = '"%LOCALAPPDATA%\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.4_0\_locales\ru\2FbhMvq...
[<HKCU>\SOFTWARE\Microsoft\Command Processor] 'AutoRun' = '"%ALLUSERSPROFILE%\Sun\Java\Java Update\J9m4bQmCsGVIalOEiR7UsKIgpf89bkpPftjiln5LiwiEYnbho.exe" O 2>NUL'
[<HKCU>_Classes\SOFTWARE\Microsoft\Command Processor] 'AutoRun' = '"%LOCALAPPDATA%Low\Sun\Java\Deployment\cache\6.0\32\PAi7f2kZSyP88yXzgb87MOTIxNA4i4p.exe" O 2>NUL'
[\REGISTRY\USER\S-1-5-18\SOFTWARE\Microsoft\Command Processor] 'AutoRun' = '"%APPDATA%\Mail.Ru\Agent\Mra\html\en\jabber\UCunRZnpD0An8K9qV8syN1cMOnvZ2lFxZ8crG17AKaQAnKRrpK2SLDZwiaHkf8.exe" O 2>N...
[<HKCU>\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run] '' = '"%APPDATA%\Microsoft\Windows\IECompatCache\Low\6IBGvAlWW2HRDJfdgvLxZwVM9lIL3rMFIMKk6cwuh1KQQ4Gh9A1j1U7oyv46Fm9.exe...
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run] '' = '"%APPDATA%\ICQM\ICQ\html\ua\jabber\xn0H2EyLAcPh3NQeOAk3WOWUsGwcTMOw1g7RcxZXl2U9GgzqTPGESlJiq7ZaLL.exe" O'
[<HKCU>\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run] '' = '"%LOCALAPPDATA%\Mozilla\Firefox\Profiles\gn7ryp3k.default\cache2\bV19GuTeHzF8QNZ5ZbdE7QemsQmMrQYCQsvl95xfthW8.exe"...
[\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run] '' = '"%APPDATA%\Adobe\Flash Player\AssetCache\REEHZFF2\XidfnHDHTjjm9lwHZo9aoJv.exe" O'
[\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run] '' = '"%APPDATA%\Mail.Ru\Agent\Mra\html\cz\loading\BEDPALkvolVFZFiAifhXQ.exe" O'
[<HKCU>\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run] '' = '"%LOCALAPPDATA%\Thunderbird\Profiles\IWpRpYodt14J2ttPRL25GP0VDdm.exe" O'
[<HKCU>_Classes\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run] '' = '"%APPDATA%\Identities\BQFp5HdwlH5h9temoSKymYkzg7e7ksTXIIpg3gP0FflDIJJRFdWn0m.exe" O'
[\REGISTRY\USER\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run] '' = '"%APPDATA%\Opera Software\Opera Stable\dictionaries\30jrzgj8.exe" O'

Изменения в файловой системе

Создает следующие файлы

%ALLUSERSPROFILE%\microsoft\windows defender\quarantine\ydanynk3kpnnhjwihkdnb.bat
%LOCALAPPDATA%\thunderbird\profiles\iwprpyodt14j2ttprl25gp0vddm.exe
%APPDATA%\mail.ru\agent\mra\html\cz\loading\bedpalkvolvfzfiaifhxq.exe
%APPDATA%\adobe\flash player\assetcache\reehzff2\xidfnhdhtjjm9lwhzo9aojv.exe
%LOCALAPPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\cache2\bv19gutehzf8qnz5zbde7qemsqmmrqycqsvl95xfthw8.exe
%APPDATA%\icqm\icq\html\ua\jabber\xn0h2eylacph3nqeoak3wowusgwctmow1g7rcxzxl2u9ggzqtpgesljiq7zall.exe
%APPDATA%\microsoft\windows\iecompatcache\low\6ibgvalww2hrdjfdgvlxzwvm9lil3rmfimkk6cwuh1kqq4gh9a1j1u7oyv46fm9.exe
%APPDATA%\identities\bqfp5hdwlh5h9temoskymykzg7e7kstxiipg3gp0ffldijjrfdwn0m.exe
%APPDATA%\mail.ru\agent\mra\html\en\jabber\ucunrznpd0an8k9qv8syn1cmonvz2lfxz8crg17akaqankrrpk2sldzwiahkf8.exe
%ALLUSERSPROFILE%\sun\java\java update\j9m4bqmcsgvialoeir7uskigpf89bkppftjiln5liwieynbho.exe
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.4_0\_locales\ru\2fbhmvqdoitfjo82atpyiwrobg2hfpvvbxq7zxgz7xq.exe
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\8.1_0\_locales\no\erxuyel0lemreh0ran8howw1ik1oa3sf7cdb78r3gzr.exe
%TEMP%\acrord32_sbx\<INETFILES>\yodj4smxa4anlt8qlx2q.exe
C:\users\public\recorded tv\yayu0zfhjhw9vos7te8dsrtyggkbaxglguyvz6wrhny0pns.exe
%APPDATA%\adobe\logtransport2\logs\xznobgdryvo2b2oatea2moqnmbqd6virvrp2dsfl.exe
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\32\pai7f2kzsyp88yxzgb87motixna4i4p.exe
%APPDATA%\opera software\opera stable\dictionaries\30jrzgj8.exe

Присваивает атрибут 'скрытый' для следующих файлов

%ALLUSERSPROFILE%\microsoft\windows defender\quarantine\ydanynk3kpnnhjwihkdnb.bat
%LOCALAPPDATA%\thunderbird\profiles\iwprpyodt14j2ttprl25gp0vddm.exe
%APPDATA%\mail.ru\agent\mra\html\cz\loading\bedpalkvolvfzfiaifhxq.exe
%APPDATA%\adobe\flash player\assetcache\reehzff2\xidfnhdhtjjm9lwhzo9aojv.exe
%LOCALAPPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\cache2\bv19gutehzf8qnz5zbde7qemsqmmrqycqsvl95xfthw8.exe
%APPDATA%\icqm\icq\html\ua\jabber\xn0h2eylacph3nqeoak3wowusgwctmow1g7rcxzxl2u9ggzqtpgesljiq7zall.exe
%APPDATA%\microsoft\windows\iecompatcache\low\6ibgvalww2hrdjfdgvlxzwvm9lil3rmfimkk6cwuh1kqq4gh9a1j1u7oyv46fm9.exe
%APPDATA%\identities\bqfp5hdwlh5h9temoskymykzg7e7kstxiipg3gp0ffldijjrfdwn0m.exe
%APPDATA%\mail.ru\agent\mra\html\en\jabber\ucunrznpd0an8k9qv8syn1cmonvz2lfxz8crg17akaqankrrpk2sldzwiahkf8.exe
%ALLUSERSPROFILE%\sun\java\java update\j9m4bqmcsgvialoeir7uskigpf89bkppftjiln5liwieynbho.exe
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.4_0\_locales\ru\2fbhmvqdoitfjo82atpyiwrobg2hfpvvbxq7zxgz7xq.exe
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\8.1_0\_locales\no\erxuyel0lemreh0ran8howw1ik1oa3sf7cdb78r3gzr.exe
%TEMP%\acrord32_sbx\<INETFILES>\yodj4smxa4anlt8qlx2q.exe
C:\users\public\recorded tv\yayu0zfhjhw9vos7te8dsrtyggkbaxglguyvz6wrhny0pns.exe
%APPDATA%\adobe\logtransport2\logs\xznobgdryvo2b2oatea2moqnmbqd6virvrp2dsfl.exe
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\32\pai7f2kzsyp88yxzgb87motixna4i4p.exe
%APPDATA%\opera software\opera stable\dictionaries\30jrzgj8.exe