Trojan.MulDrop16.47156

Техническая информация

Для обеспечения автозапуска и распространения

Устанавливает следующие настройки сервисов

[<HKLM>\System\CurrentControlSet\Services\IKEEXT] 'Start' = '00000002'

Вредоносные функции

Запускает на исполнение

'%WINDIR%\syswow64\taskkill.exe' /f /im msiexec.exe

Изменения в файловой системе

Создает следующие файлы

%TEMP%\rarsfx0\addfirewallrule.exe
%TEMP%\rarsfx0\setupfiles\help\user.files\themedata.thmx
%TEMP%\rarsfx0\setupfiles\help\user.files\props0030.xml
%TEMP%\rarsfx0\setupfiles\help\user.files\item0029.xml
%TEMP%\rarsfx0\setupfiles\help\user.files\image116.jpg
%TEMP%\rarsfx0\setupfiles\help\user.files\image114.jpg
%TEMP%\rarsfx0\setupfiles\help\user.files\image107.jpg
%TEMP%\rarsfx0\setupfiles\help\user.files\user_clip_image002.jpg
%TEMP%\rarsfx0\setupfiles\help\user.files\image106.jpg
%TEMP%\rarsfx0\setupfiles\help\user.files\image040.jpg
%TEMP%\rarsfx0\setupfiles\help\user.files\image039.jpg
%TEMP%\rarsfx0\setupfiles\help\user.files\image038.jpg
%TEMP%\rarsfx0\setupfiles\help\user.files\image037.jpg
%TEMP%\rarsfx0\setupfiles\help\user.files\image036.jpg
%TEMP%\rarsfx0\setupfiles\help\user.files\image035.jpg
%TEMP%\rarsfx0\setupfiles\help\user.files\image101.jpg
%TEMP%\rarsfx0\setupfiles\images\hotfixinstall.gif
%TEMP%\rarsfx0\setupfiles\logviewer.exe
%TEMP%\rarsfx0\setupfiles\help\user.files\user_clip_image008.jpg
%TEMP%\rarsfx0\setupfiles\lockscreen.exe
%TEMP%\rarsfx0\setupfiles\linkworkhds2.exe
%TEMP%\rarsfx0\setupfiles\libeay32.dll
%TEMP%\rarsfx0\setupfiles\installdriverx64.exe
%TEMP%\rarsfx0\setupfiles\inject.dll
%TEMP%\rarsfx0\setupfiles\images\ruleok.gif
%TEMP%\rarsfx0\setupfiles\help\user.files\image034.jpg
%TEMP%\rarsfx0\setupfiles\images\ruleerror.gif
%TEMP%\rarsfx0\setupfiles\hotfixmgr.dll
%TEMP%\rarsfx0\setupfiles\hotfixagent.exe
%TEMP%\rarsfx0\setupfiles\hostname.dll
%TEMP%\rarsfx0\setupfiles\hodmgr.dll
%TEMP%\rarsfx0\setupfiles\help\user.htm
%TEMP%\rarsfx0\setupfiles\help\user.files\user_clip_image010.jpg
%TEMP%\rarsfx0\setupfiles\help\user.files\user_clip_image004.jpg
%TEMP%\rarsfx0\setupfiles\help\user.files\user_clip_image006.jpg
%TEMP%\rarsfx0\setupfiles\help\user.files\image033.jpg
%TEMP%\rarsfx0\setupfiles\help\user.files\image015.jpg
%TEMP%\rarsfx0\setupfiles\help\user.files\image012.jpg
%TEMP%\rarsfx0\setupfiles\help\user.files\image011.jpg
%TEMP%\rarsfx0\setupfiles\help\user.files\image010.jpg
%TEMP%\rarsfx0\setupfiles\help\user.files\image009.jpg
%TEMP%\rarsfx0\setupfiles\help\user.files\image008.jpg
%TEMP%\rarsfx0\setupfiles\help\user.files\image007.jpg
%TEMP%\rarsfx0\setupfiles\help\user.files\image013.jpg
%TEMP%\rarsfx0\setupfiles\help\user.files\image006.jpg
%TEMP%\rarsfx0\setupfiles\help\user.files\image004.jpg
%TEMP%\rarsfx0\setupfiles\help\user.files\image003.jpg
%TEMP%\rarsfx0\setupfiles\help\user.files\image002.jpg
%TEMP%\rarsfx0\setupfiles\help\user.files\image001.jpg
%TEMP%\rarsfx0\setupfiles\help\user.files\header.htm
%TEMP%\rarsfx0\setupfiles\help\user.files\filelist.xml
%TEMP%\rarsfx0\setupfiles\help\user.files\image005.jpg
%TEMP%\rarsfx0\setupfiles\help\user.files\image023.jpg
%TEMP%\rarsfx0\setupfiles\help\user.files\image031.jpg
%TEMP%\rarsfx0\setupfiles\help\user.files\image016.jpg
%TEMP%\rarsfx0\setupfiles\help\user.files\image030.jpg
%TEMP%\rarsfx0\setupfiles\help\user.files\image029.jpg
%TEMP%\rarsfx0\setupfiles\help\user.files\image028.jpg
%TEMP%\rarsfx0\setupfiles\help\user.files\image027.jpg
%TEMP%\rarsfx0\setupfiles\help\user.files\image026.jpg
%TEMP%\rarsfx0\setupfiles\help\user.files\image025.jpg
%TEMP%\rarsfx0\setupfiles\help\user.files\image032.jpg
%TEMP%\rarsfx0\setupfiles\help\user.files\image024.jpg
%TEMP%\rarsfx0\setupfiles\help\user.files\image022.jpg
%TEMP%\rarsfx0\setupfiles\help\user.files\image021.jpg
%TEMP%\rarsfx0\setupfiles\help\user.files\image020.jpg
%TEMP%\rarsfx0\setupfiles\help\user.files\image019.jpg
%TEMP%\rarsfx0\setupfiles\help\user.files\image018.jpg
%TEMP%\rarsfx0\setupfiles\help\user.files\image017.jpg
%TEMP%\rarsfx0\setupfiles\help\user.files\image014.jpg
%TEMP%\rarsfx0\setupfiles\reghook.dll
%TEMP%\rarsfx0\venus .cer
%TEMP%\rarsfx0\setupfiles\mfc80.dll
%TEMP%\rarsfx0\setupfiles\sso_logo.bmp
%TEMP%\rarsfx0\setupfiles\ssleay32.dll
%TEMP%\rarsfx0\setupfiles\sqlite3.dll
%TEMP%\rarsfx0\setupfiles\sporder.dll
%TEMP%\rarsfx0\setupfiles\smsmgr.dll
%TEMP%\rarsfx0\setupfiles\shutdown.dll
%TEMP%\rarsfx0\setupfiles\startccmon.exe
%TEMP%\rarsfx0\setupfiles\setwindowsfirewall.dll
%TEMP%\rarsfx0\setupfiles\setup.ini
%TEMP%\rarsfx0\setupfiles\setup.exe
%TEMP%\rarsfx0\setupfiles\setipinwin7.dll
%TEMP%\rarsfx0\setupfiles\servcom.dll
%TEMP%\rarsfx0\setupfiles\secretaudit.dll
%TEMP%\rarsfx0\setupfiles\secedit.exe
%TEMP%\rarsfx0\setupfiles\setupframerestx.dll
%TEMP%\rarsfx0\setupfiles\wlanapis.dll
%TEMP%\rarsfx0\setupfiles\mfc42.dll
%TEMP%\rarsfx0\setupfiles\storageview.exe
%TEMP%\rarsfx0\setupframerestx.dll
%TEMP%\rarsfx0\setupfiles\zip32.dll
%TEMP%\rarsfx0\setupfiles\xpfirewall2.exe
%TEMP%\rarsfx0\setupfiles\xpfirewall.exe
%TEMP%\rarsfx0\setupfiles\xmlwrapper.dll
%TEMP%\rarsfx0\setupfiles\wtsbox.exe
%TEMP%\rarsfx0\setupfiles\secdata.dll
%TEMP%\rarsfx0\setupfiles\wmigethotfixlist.exe
%TEMP%\rarsfx0\setupfiles\wirelessconfigtool.exe
%TEMP%\rarsfx0\setupfiles\winfw.dll
%TEMP%\rarsfx0\setupfiles\wineventlog.dll
%TEMP%\rarsfx0\setupfiles\versionconfig.ini
%TEMP%\rarsfx0\setupfiles\unzip32.dll
%TEMP%\rarsfx0\setupfiles\unicows.dll
%TEMP%\rarsfx0\setupfiles\statusdialog.exe
%TEMP%\rarsfx0\setupfiles\help\user.files\colorschememapping.xml
%TEMP%\rarsfx0\setupfiles\secdata\hardwareconfig.xml
%TEMP%\rarsfx0\setupfiles\peap.xml
%TEMP%\rarsfx0\setupfiles\msvcr90.dll
%TEMP%\rarsfx0\setupfiles\msvcr80.dll
%TEMP%\rarsfx0\setupfiles\msvcp90.dll
%TEMP%\rarsfx0\setupfiles\msvcp80.dll
%TEMP%\rarsfx0\setupfiles\msvcp60.dll
%TEMP%\rarsfx0\setupfiles\msvcm90.dll
%TEMP%\rarsfx0\setupfiles\msvcrt.dll
%TEMP%\rarsfx0\setupfiles\msvcm80.dll
%TEMP%\rarsfx0\setupfiles\microsoft.vc90.crt.manifest
%TEMP%\rarsfx0\setupfiles\microsoft.vc80.mfc.manifest
%TEMP%\rarsfx0\setupfiles\microsoft.vc80.crt.manifest
%TEMP%\rarsfx0\setupfiles\mfcm80u.dll
%TEMP%\rarsfx0\setupfiles\mfcm80.dll
%TEMP%\rarsfx0\setupfiles\mfc80u.dll
%TEMP%\rarsfx0\setupfiles\mseapcltc.dll
%TEMP%\rarsfx0\setupfiles\logviewer.exe.manifest
%TEMP%\rarsfx0\setupfiles\sdagent.exe
%TEMP%\rarsfx0\setupfiles\peap2.xml
%TEMP%\rarsfx0\setupfiles\scrnsave.scr
%TEMP%\rarsfx0\setupfiles\scriptobject.tlb
%TEMP%\rarsfx0\setupfiles\schook.dll
%TEMP%\rarsfx0\setupfiles\resource\cconline.ico
%TEMP%\rarsfx0\setupfiles\resource\ccoffline.ico
%TEMP%\rarsfx0\setupfiles\resource\ccalert.ico
%TEMP%\rarsfx0\setupfiles\sdagent.ini
%TEMP%\rarsfx0\setupfiles\reghook.sys
%TEMP%\rarsfx0\setupfiles\ptdecrypt.ini
%TEMP%\rarsfx0\setupfiles\ptdecrypt.exe
%TEMP%\rarsfx0\setupfiles\printaudithook.dll
%TEMP%\rarsfx0\setupfiles\printaudit.dll
%TEMP%\rarsfx0\setupfiles\pluginlist.xml
%TEMP%\rarsfx0\setupfiles\peripheral.dll
%TEMP%\rarsfx0\setupfiles\outlinkmon.dll
%TEMP%\rarsfx0\setupfiles\storagemgr.dll
%TEMP%\rarsfx0\setupfiles\fwsetup.dll
%TEMP%\rarsfx0\setupfiles\epolccsetup.dll
%TEMP%\rarsfx0\setupfiles\dll\x32\epolgina.dll
%TEMP%\rarsfx0\setupfiles\dll\x32\epolcredentialprovider.dll
%TEMP%\rarsfx0\setupfiles\disksn32.dll
%TEMP%\rarsfx0\setupfiles\disablewindowseapol.dll
%TEMP%\rarsfx0\setupfiles\directop.dll
%TEMP%\rarsfx0\setupfiles\dialupmon.dll
%TEMP%\rarsfx0\setupfiles\dll\x64\epolcredentialprovider.dll
%TEMP%\rarsfx0\setupfiles\dialspy.dll
%TEMP%\rarsfx0\setupfiles\dbghelp.dll
%TEMP%\rarsfx0\setupfiles\control.ini
%TEMP%\rarsfx0\setupfiles\commonfunc.dll
%TEMP%\rarsfx0\setupfiles\clientregister.dll
%TEMP%\rarsfx0\setupfiles\clientmgr.dll
%TEMP%\rarsfx0\setupfiles\checksoftware.dll
%TEMP%\rarsfx0\setupfiles\devicecontrol.exe
%TEMP%\rarsfx0\setupfiles\driver-x64\eposdf.sys
%TEMP%\rarsfx0\setupfiles\drvsetup\netsf.inf
%TEMP%\rarsfx0\setupfiles\driver\eposdf.inf
%TEMP%\rarsfx0\setupfiles\drvsetup\lpsimd.dl_
%TEMP%\rarsfx0\setupfiles\drvsetup\installdrv.bat
%TEMP%\rarsfx0\setupfiles\drvsetup\drvsetup.exe
%TEMP%\rarsfx0\setupfiles\drivercommunication.dll
%TEMP%\rarsfx0\setupfiles\driver-x64\eposfsf.sys
%TEMP%\rarsfx0\setupfiles\driver-x64\eposfsf.inf
%TEMP%\rarsfx0\setupfiles\checkntadmin.dll
%TEMP%\rarsfx0\setupfiles\driver-x64\eposfsf.cat
%TEMP%\rarsfx0\setupfiles\driver-x64\eposdf.inf
%TEMP%\rarsfx0\setupfiles\driver-x64\eposdf.cat
%TEMP%\rarsfx0\setupfiles\driver\eposfsf.sys
%TEMP%\rarsfx0\setupfiles\driver\eposfsf.inf
%TEMP%\rarsfx0\setupfiles\driver\eposfsf.cat
%TEMP%\rarsfx0\setupfiles\driver\eposdf.sys
%TEMP%\rarsfx0\setupfiles\dll\x64\epolgina.dll
%TEMP%\rarsfx0\setupfiles\driver\eposdf.cat
%TEMP%\rarsfx0\setupfiles\ccmon.exe
%TEMP%\rarsfx0\setupfiles\3rdparty\windowsupdateagent20-x86.exe
%TEMP%\rarsfx0\setupfiles\3rdparty\msxml4sp2\msxml4a.dll
%TEMP%\rarsfx0\setupfiles\3rdparty\msxml4sp2\msxml4.dll
%TEMP%\rarsfx0\setup.ini
%TEMP%\rarsfx0\setup.exe
%TEMP%\rarsfx0\mseapcltc.dll
%TEMP%\rarsfx0\license.txt
%TEMP%\rarsfx0\setupfiles\3rdparty\msxml4sp2\msxml4r.dll
%TEMP%\rarsfx0\installdriverx64.exe
%TEMP%\rarsfx0\fwsetup-x64.dll
%TEMP%\rarsfx0\eposfsfsetup.dll
%TEMP%\rarsfx0\eposfsfsetup-x64.dll
%TEMP%\rarsfx0\epolccsetup.dll
%TEMP%\rarsfx0\disablewindowseapol.dll
%TEMP%\rarsfx0\checkntadmin.dll
%TEMP%\rarsfx0\fwsetup.dll
%TEMP%\rarsfx0\setupfiles\baseservice.dll
%TEMP%\rarsfx0\setupfiles\cc.ini
%TEMP%\rarsfx0\setupfiles\advhotfixlist.dll
%TEMP%\rarsfx0\setupfiles\cad.exe
%TEMP%\rarsfx0\setupfiles\burnaudit.dll
%TEMP%\rarsfx0\setupfiles\boot\ntldr.d
%TEMP%\rarsfx0\setupfiles\basevirus.dll
%TEMP%\rarsfx0\setupfiles\baseuserenv.dll
%TEMP%\rarsfx0\setupfiles\basesoft.dll
%TEMP%\rarsfx0\setupfiles\cccontrolrestx.dll
%TEMP%\rarsfx0\setupfiles\baseshareres.dll
%TEMP%\rarsfx0\setupfiles\baseregfun.dll
%TEMP%\rarsfx0\setupfiles\baseproc.dll
%TEMP%\rarsfx0\setupfiles\baselocalsec.dll
%TEMP%\rarsfx0\setupfiles\authenmgr.dll
%TEMP%\rarsfx0\setupfiles\assetid.js
%TEMP%\rarsfx0\setupfiles\appadmission.dll
%TEMP%\rarsfx0\setupfiles\3rdparty\scr56chs-2k.exe
%TEMP%\rarsfx0\setupfiles\drvsetup\winxp\netsf_m.inf
%TEMP%\rarsfx0\setupfiles\firewall.dll
%TEMP%\rarsfx0\setupfiles\drvsetup\win2000\lpsimd.sys
%TEMP%\rarsfx0\setupfiles\eap\eseap.dll
%TEMP%\rarsfx0\setupfiles\eap\eap_epol.dll
%TEMP%\rarsfx0\setupfiles\drvsetup-x64\winvista\tdifw_drv.sys
%TEMP%\rarsfx0\setupfiles\drvsetup-x64\winvista\netsf_m.inf
%TEMP%\rarsfx0\setupfiles\drvsetup-x64\winvista\netsf_m.cat
%TEMP%\rarsfx0\setupfiles\drvsetup-x64\winvista\netsf.inf
%TEMP%\rarsfx0\setupfiles\eap\eseap64.dll
%TEMP%\rarsfx0\setupfiles\drvsetup-x64\winvista\netsf.cat
%TEMP%\rarsfx0\setupfiles\drvsetup-x64\winvista\lpsimd.dl_
%TEMP%\rarsfx0\setupfiles\drvsetup-x64\win2003\tdifw_drv.sys
%TEMP%\rarsfx0\setupfiles\drvsetup-x64\win2003\netsf_m.inf
%TEMP%\rarsfx0\setupfiles\drvsetup-x64\win2003\netsf_m.cat
%TEMP%\rarsfx0\setupfiles\drvsetup-x64\win2003\netsf.inf
%TEMP%\rarsfx0\setupfiles\drvsetup-x64\win2003\netsf.cat
%TEMP%\rarsfx0\setupfiles\drvsetup-x64\winvista\lpsimd.sys
%TEMP%\rarsfx0\setupfiles\escccontrol.exe
%TEMP%\rarsfx0\setupfiles\drvsetup\win2000\lpsimd.dl_
%TEMP%\rarsfx0\setupfiles\epolupdate363.exe
%TEMP%\rarsfx0\setupfiles\filemgr.dll
%TEMP%\rarsfx0\setupfiles\filekeywordaudit.mdb
%TEMP%\rarsfx0\setupfiles\fileaudit.dll
%TEMP%\rarsfx0\setupfiles\ext_route.dll
%TEMP%\rarsfx0\setupfiles\ext_hotfix.dll
%TEMP%\rarsfx0\setupfiles\ext_account.dll
%TEMP%\rarsfx0\setupfiles\drvsetup-x64\win2003\lpsimd.sys
%TEMP%\rarsfx0\setupfiles\excludeaudiprolist.xml
%TEMP%\rarsfx0\setupfiles\escc.exe
%TEMP%\rarsfx0\setupfiles\eposfsfsetup.dll
%TEMP%\rarsfx0\setupfiles\eposfsfsetup-x64.dll
%TEMP%\rarsfx0\setupfiles\eposfsf.dll
%TEMP%\rarsfx0\setupfiles\eposdfapi.dll
%TEMP%\rarsfx0\setupfiles\epolwlnf.dll
%TEMP%\rarsfx0\setupfiles\emcclient.exe
%TEMP%\rarsfx0\setupfiles\fwsetup-x64.dll
%TEMP%\rarsfx0\setupfiles\drvsetup-x64\win2003\lpsimd.dl_
%TEMP%\rarsfx0\setupfiles\drvsetup\winvista\netsf_m.cat
%TEMP%\rarsfx0\setupfiles\drvsetup\winvista\lpsimd.sys
%TEMP%\rarsfx0\setupfiles\drvsetup\winvista\lpsimd.dl_
%TEMP%\rarsfx0\setupfiles\drvsetup\win2003\tdifw_drv.sys
%TEMP%\rarsfx0\setupfiles\drvsetup\win2003\netsf_m.inf
%TEMP%\rarsfx0\setupfiles\drvsetup\win2003\netsf_m.cat
%TEMP%\rarsfx0\setupfiles\drvsetup\win2003\netsf.inf
%TEMP%\rarsfx0\setupfiles\drvsetup\winvista\netsf.cat
%TEMP%\rarsfx0\setupfiles\drvsetup\win2003\netsf.cat
%TEMP%\rarsfx0\setupfiles\drvsetup\win2003\lpsimd.dl_
%TEMP%\rarsfx0\setupfiles\drvsetup\win2000\tdifw_drv.sys
%TEMP%\rarsfx0\setupfiles\drvsetup\win2000\netsf_m.inf
%TEMP%\rarsfx0\setupfiles\drvsetup\win2000\netsf_m.cat
%TEMP%\rarsfx0\setupfiles\drvsetup\win2000\netsf.inf
%TEMP%\rarsfx0\setupfiles\drvsetup\win2000\netsf.cat
%TEMP%\rarsfx0\setupfiles\drvsetup\win2003\lpsimd.sys
%TEMP%\rarsfx0\setupfiles\drvsetup\netsf_m.inf
%TEMP%\rarsfx0\setupfiles\drvsetup-x64\netsf_m.cat
%TEMP%\rarsfx0\setupfiles\drvsetup\winvista\netsf_m.inf
%TEMP%\rarsfx0\setupfiles\drvsetup-x64\netsf.inf
%TEMP%\rarsfx0\setupfiles\drvsetup-x64\netsf.cat
%TEMP%\rarsfx0\setupfiles\drvsetup-x64\lpsimd.dl_
%TEMP%\rarsfx0\setupfiles\drvsetup-x64\installdrv.bat
%TEMP%\rarsfx0\setupfiles\drvsetup-x64\drvsetup.exe
%TEMP%\rarsfx0\setupfiles\drvsetup-x64\drvsetup-x64.exe
%TEMP%\rarsfx0\setupfiles\drvsetup-x64\netsf_m.inf
%TEMP%\rarsfx0\setupfiles\drvsetup\winxp\tdifw_drv.sys
%TEMP%\rarsfx0\setupfiles\drvsetup\winxp\netsf_m.cat
%TEMP%\rarsfx0\setupfiles\drvsetup\winxp\netsf.inf
%TEMP%\rarsfx0\setupfiles\drvsetup\winxp\netsf.cat
%TEMP%\rarsfx0\setupfiles\drvsetup\winxp\lpsimd.sys
%TEMP%\rarsfx0\setupfiles\drvsetup\winxp\lpsimd.dl_
%TEMP%\rarsfx0\setupfiles\drvsetup\winvista\tdifw_drv.sys
%TEMP%\rarsfx0\setupfiles\drvsetup\winvista\netsf.inf
%TEMP%\rarsfx0\versionconfig.ini

Другое

Ищет следующие окна

ClassName: 'EDIT' WindowName: ''
ClassName: '' WindowName: ''

Создает и запускает на исполнение

'%TEMP%\rarsfx0\setup.exe'
'%TEMP%\rarsfx0\addfirewallrule.exe'
'%WINDIR%\syswow64\cmd.exe' /c taskkill.exe /f /im msiexec.exe' (со скрытым окном)
'%WINDIR%\syswow64\cmd.exe' /c certutil -addstore "TrustedPublisher" venus.cer' (со скрытым окном)
'%TEMP%\rarsfx0\addfirewallrule.exe' ' (со скрытым окном)

Запускает на исполнение

'%WINDIR%\syswow64\cmd.exe' /c taskkill.exe /f /im msiexec.exe
'%WINDIR%\syswow64\cmd.exe' /c certutil -addstore "TrustedPublisher" venus.cer
'%WINDIR%\syswow64\certutil.exe' -addstore "TrustedPublisher" venus.cer

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней