Trojan.MulDrop16.16309

Техническая информация

Для обеспечения автозапуска и распространения

Модифицирует следующие ключи реестра

[<HKCU>\SOFTWARE\Microsoft\Command Processor] 'AutoRun' = '"%LOCALAPPDATA%\Google\Chrome\User Data\Default\Storage\ext\chrome-signin\def\GPUCache\vGreVEaFs1LG1GH31rVO1.exe" O 2>NUL'
[<HKLM>\SOFTWARE\Microsoft\Command Processor] 'AutoRun' = '"%LOCALAPPDATA%\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\_locales\pt_BR\eWSKPEY437GoDZARXCy8L...
[<HKCU>\SOFTWARE\Microsoft\Command Processor] 'AutoRun' = '"%ALLUSERSPROFILE%\Microsoft\Windows\Templates\OwCdxLlV7BoQSYBpN1m7wm.exe" O 2>NUL'
[\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Command Processor] 'AutoRun' = '"%APPDATA%\Opera Software\Opera Stable\Sync Extension Settings\K1jXYPbmuQdXZ0dye5VbEVqzPfHU.exe" O 2>NUL'
[\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Command Processor] 'AutoRun' = '"%LOCALAPPDATA%\Opera Software\PDGlTiiwWLJdQl5LTyC.exe" O 2>NUL'
[<HKCU>\SOFTWARE\Microsoft\Command Processor] 'AutoRun' = '"%LOCALAPPDATA%\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.4_0\_locales\no\rR1D266ppBUX.exe" O 2>NU...
[<HKCU>_Classes\SOFTWARE\Microsoft\Command Processor] 'AutoRun' = '"%APPDATA%\ICQM\ICQ\html\en\jabber\OCdAX6tKvUtIteAmvqw.exe" O 2>NUL'
[\REGISTRY\USER\S-1-5-18\SOFTWARE\Microsoft\Command Processor] 'AutoRun' = '"%LOCALAPPDATA%\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\8.1_0\_locales\uk\J5ioQj7...
[<HKCU>\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run] '' = '"%APPDATA%\Macromedia\Flash Player\macromedia.com\4q3afiJWTlpWGXDLdKccPFyIIsF4GRhvtNfr23hwVv.exe" O'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run] '' = '"%LOCALAPPDATA%\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\_locales\hu\vVNR...
[<HKCU>\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run] '' = '"%LOCALAPPDATA%\Microsoft\Office\14.0\ooFyun0UpZyob8Vf.exe" O'
[\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run] '' = '"%LOCALAPPDATA%Low\Sun\Java\Deployment\cache\6.0\39\73GB2Cjt33GwlVf4wZ1wEl7gYtb07k3vUTcJsNJSyGKTb...
[\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run] '' = '"%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\K-Lite Codec Pack\Uninstall\uIu2Lq62h2dS...
[<HKCU>\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run] '' = '"%APPDATA%\Microsoft\Windows\SendTo\SYWz9EuXNbkG0SSkQWJ9VYRS.exe" O'
[<HKCU>_Classes\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run] '' = '"%LOCALAPPDATA%\Microsoft\Internet Explorer\d0voqm038PJbq.exe" O'
[\REGISTRY\USER\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run] '' = '"%LOCALAPPDATA%\Mozilla\wyvbfaEZtKbRnCN1L8drFGkQiPGodeJM04VZk.exe" O'

Изменения в файловой системе

Создает следующие файлы

%LOCALAPPDATA%\google\chrome\user data\default\extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\_locales\lt\ltibpoohlgemsnyryxw7jm1zdekehhmf9cm79gz1.bat
%APPDATA%\microsoft\windows\sendto\sywz9euxnbkg0sskqwj9vyrs.exe
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\k-lite codec pack\uninstall\uiu2lq62h2dsm18.exe
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\39\73gb2cjt33gwlvf4wz1wel7gytb07k3vutcjsnjsygktbyjkswoxzn9xvrikx.exe
%LOCALAPPDATA%\microsoft\office\14.0\oofyun0upzyob8vf.exe
%LOCALAPPDATA%\google\chrome\user data\default\extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\_locales\hu\vvnrun0zuw3.exe
%APPDATA%\macromedia\flash player\macromedia.com\4q3afijwtlpwgxdldkccpfyiisf4grhvtnfr23hwvv.exe
%LOCALAPPDATA%\microsoft\internet explorer\d0voqm038pjbq.exe
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\8.1_0\_locales\uk\j5ioqj7kdpkhhqizycrr8i1ynjfvrjlhadx8absziqps2i4uxm1semt3jop95.exe
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.4_0\_locales\no\rr1d266ppbux.exe
%LOCALAPPDATA%\opera software\pdgltiiwwljdql5ltyc.exe
%APPDATA%\opera software\opera stable\sync extension settings\k1jxypbmuqdxz0dye5vbevqzpfhu.exe
%ALLUSERSPROFILE%\microsoft\windows\templates\owcdxllv7boqsybpn1m7wm.exe
%LOCALAPPDATA%\google\chrome\user data\default\extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\_locales\pt_br\ewskpey437godzarxcy8lmmimvc6ynhtucgpijpe1rtdjtzvacl.exe
%LOCALAPPDATA%\google\chrome\user data\default\storage\ext\chrome-signin\def\gpucache\vgreveafs1lg1gh31rvo1.exe
%APPDATA%\icqm\icq\html\en\jabber\ocdax6tkvutiteamvqw.exe
%LOCALAPPDATA%\mozilla\wyvbfaeztkbrncn1l8drfgkqipgodejm04vzk.exe

Присваивает атрибут 'скрытый' для следующих файлов

%LOCALAPPDATA%\google\chrome\user data\default\extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\_locales\lt\ltibpoohlgemsnyryxw7jm1zdekehhmf9cm79gz1.bat
%APPDATA%\microsoft\windows\sendto\sywz9euxnbkg0sskqwj9vyrs.exe
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\k-lite codec pack\uninstall\uiu2lq62h2dsm18.exe
%LOCALAPPDATA%low\sun\java\deployment\cache\6.0\39\73gb2cjt33gwlvf4wz1wel7gytb07k3vutcjsnjsygktbyjkswoxzn9xvrikx.exe
%LOCALAPPDATA%\microsoft\office\14.0\oofyun0upzyob8vf.exe
%LOCALAPPDATA%\google\chrome\user data\default\extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\_locales\hu\vvnrun0zuw3.exe
%APPDATA%\macromedia\flash player\macromedia.com\4q3afijwtlpwgxdldkccpfyiisf4grhvtnfr23hwvv.exe
%LOCALAPPDATA%\microsoft\internet explorer\d0voqm038pjbq.exe
%LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\8.1_0\_locales\uk\j5ioqj7kdpkhhqizycrr8i1ynjfvrjlhadx8absziqps2i4uxm1semt3jop95.exe
%LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.4_0\_locales\no\rr1d266ppbux.exe
%LOCALAPPDATA%\opera software\pdgltiiwwljdql5ltyc.exe
%APPDATA%\opera software\opera stable\sync extension settings\k1jxypbmuqdxz0dye5vbevqzpfhu.exe
%ALLUSERSPROFILE%\microsoft\windows\templates\owcdxllv7boqsybpn1m7wm.exe
%LOCALAPPDATA%\google\chrome\user data\default\extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\_locales\pt_br\ewskpey437godzarxcy8lmmimvc6ynhtucgpijpe1rtdjtzvacl.exe
%LOCALAPPDATA%\google\chrome\user data\default\storage\ext\chrome-signin\def\gpucache\vgreveafs1lg1gh31rvo1.exe
%APPDATA%\icqm\icq\html\en\jabber\ocdax6tkvutiteamvqw.exe
%LOCALAPPDATA%\mozilla\wyvbfaeztkbrncn1l8drfgkqipgodejm04vzk.exe