Trojan.MulDrop16.19375

Техническая информация

Для обеспечения автозапуска и распространения

Модифицирует следующие ключи реестра

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\RunOnce] 'GoToAssist_Reboot_9daynhEWLP' = '%LOCALAPPDATA%\GoToAssist Remote Support Applet\LMI0001.tmp\GoToAssistProcessChecker.exe -Rebooted -...

Изменения в файловой системе

Создает следующие файлы

%LOCALAPPDATA%\gotoassist remote support applet\lmi0001.tmp\gotoassistservice.exe
%LOCALAPPDATA%\gotoassist remote support applet\lmi0001.tmp\appdata\ipc\9daynhewlp_processchecker
%LOCALAPPDATA%\gotoassist remote support applet\lmi0001.tmp\appdata\gotoassistprocesschecker.log
%LOCALAPPDATA%\gotoassist remote support applet\lmi0001.tmp\pc.json
%LOCALAPPDATA%\gotoassist remote support applet\lmi0001.tmp\appdata\gotoassistservice.log
%LOCALAPPDATA%\gotoassist remote support applet\lmi0001.tmp\mandatory.json
%LOCALAPPDATA%\gotoassist remote support applet\lmi0001.tmp\params.json
<Полный путь к файлу>.cmd
%LOCALAPPDATA%\gotoassist remote support applet\lmi0001.tmp\libssl-1_1.dll
%LOCALAPPDATA%\gotoassist remote support applet\lmi0001.tmp\libcrypto-1_1.dll
%LOCALAPPDATA%\gotoassist remote support applet\lmi0001.tmp\libgotoassist.dll
%LOCALAPPDATA%\gotoassist remote support applet\lmi0001.tmp\gotoassistloggerprocess.exe
%LOCALAPPDATA%\gotoassist remote support applet\lmi0001.tmp\gotoassistprocesschecker.exe
%LOCALAPPDATA%\gotoassist remote support applet\lmi0001.tmp\gotoassistcrashhandler.exe
%LOCALAPPDATA%\gotoassist remote support applet\lmi0001.tmp\gotoassisttools64.exe
%LOCALAPPDATA%\gotoassist remote support applet\lmi0001.tmp\appdata\gotoassistloggerprocess_20210311__16_14_14_412.log
%LOCALAPPDATA%\gotoassist remote support applet\lmi0001.tmp\gotoassisttools32.exe
%LOCALAPPDATA%\gotoassist remote support applet\lmi0001.tmp\gotoassistunlock32.dll
%LOCALAPPDATA%\gotoassist remote support applet\lmi0001.tmp\gotoassistui.exe
%LOCALAPPDATA%\gotoassist remote support applet\lmi0001.tmp\passwordprivacydll.dll
%LOCALAPPDATA%\gotoassist remote support applet\lmi0001.tmp\mediaclientlib.dll
%LOCALAPPDATA%\gotoassist remote support applet\lmi0001.tmp\lmisupportm64.exe
%LOCALAPPDATA%\gotoassist remote support applet\lmi0001.tmp\lmisupportm32.exe
%LOCALAPPDATA%\gotoassist remote support applet\lmi0001.tmp\lmisupport7x64.dll
%LOCALAPPDATA%\gotoassist remote support applet\lmi0001.tmp\lmisupport7x32.dll
%LOCALAPPDATA%\gotoassist remote support applet\lmi0001.tmp\lmiscrhook64.dll
%LOCALAPPDATA%\gotoassist remote support applet\lmi0001.tmp\lmiscrhook32.dll
%LOCALAPPDATA%\gotoassist remote support applet\lmi0001.tmp\lmiinputhook64.dll
%LOCALAPPDATA%\gotoassist remote support applet\lmi0001.tmp\lmiinputhook32.dll
%LOCALAPPDATA%\gotoassist remote support applet\lmi0001.tmp\lmifilterhook64.dll
%LOCALAPPDATA%\gotoassist remote support applet\lmi0001.tmp\lmifilterhook32.dll
%LOCALAPPDATA%\gotoassist remote support applet\lmi0001.tmp\gotoassistunlock64.dll
%LOCALAPPDATA%\gotoassist remote support applet\lmi0001.tmp\appdata\ipc\9daynhewlp_attended

Удаляет следующие файлы

<Полный путь к файлу>.cmd

Самоудаляется.

Другое

Создает и запускает на исполнение

'%LOCALAPPDATA%\gotoassist remote support applet\lmi0001.tmp\gotoassistservice.exe'
'%LOCALAPPDATA%\gotoassist remote support applet\lmi0001.tmp\gotoassistprocesschecker.exe' "-ApplicationType" "1"
'%LOCALAPPDATA%\gotoassist remote support applet\lmi0001.tmp\gotoassistservice.exe' "-RegisteredProcess" "1" "-ParentProcessId" "1920" "-WtsStartingUsername" "qkvsnavvdfi\user"
'%LOCALAPPDATA%\gotoassist remote support applet\lmi0001.tmp\gotoassistloggerprocess.exe' -HostId 78c47ff76c4018f7a5e0e5cc0f782d52 -SessionType "" -InstallationId 9daynhEWLP -DeviceId "" -LogLevel 2
'%WINDIR%\syswow64\cmd.exe' /S /C ""<Полный путь к файлу>.cmd" "<Полный путь к файлу>""' (со скрытым окном)
'%LOCALAPPDATA%\gotoassist remote support applet\lmi0001.tmp\gotoassistprocesschecker.exe' "-ApplicationType" "1"' (со скрытым окном)
'%LOCALAPPDATA%\gotoassist remote support applet\lmi0001.tmp\gotoassistservice.exe' "-RegisteredProcess" "1" "-ParentProcessId" "1920" "-WtsStartingUsername" "qkvsnavvdfi\user"' (со скрытым окном)

Запускает на исполнение