Trojan.MulDrop17.53396

Техническая информация

Вредоносные функции

Запускает на исполнение

'%WINDIR%\syswow64\taskkill.exe' /f /im QwestTouchPointAgent.exe /im CenturyLinkTouchPointAgent.exe /im QwestInstaller.exe /im QwestInstallerApp.exe /im CenturyLinkInstaller.exe /im CenturyLinkInstallerApp.exe

Изменения в файловой системе

Создает следующие файлы

%TEMP%\rarsfx0\centurylinkinstallersetup.exe
%TEMP%\{ca67a139-cb95-4c00-ae88-63983a1502cb}\{c96ff998-45bd-411e-9253-b7f2660fe280}\_is1963.tmp
%TEMP%\{ca67a139-cb95-4c00-ae88-63983a1502cb}\{c96ff998-45bd-411e-9253-b7f2660fe280}\def1962.tmp
%TEMP%\{ca67a139-cb95-4c00-ae88-63983a1502cb}\{c96ff998-45bd-411e-9253-b7f2660fe280}\isr1952.tmp
%TEMP%\{ca67a139-cb95-4c00-ae88-63983a1502cb}\{c96ff998-45bd-411e-9253-b7f2660fe280}\str1941.tmp
%TEMP%\{ca67a139-cb95-4c00-ae88-63983a1502cb}\isb1930.tmp
%TEMP%\{ca67a139-cb95-4c00-ae88-63983a1502cb}\dot192f.tmp
%TEMP%\{ca67a139-cb95-4c00-ae88-63983a1502cb}\cor191f.tmp
%TEMP%\{ca67a139-cb95-4c00-ae88-63983a1502cb}\{c96ff998-45bd-411e-9253-b7f2660fe280}\dif191e.tmp
%TEMP%\{ca67a139-cb95-4c00-ae88-63983a1502cb}\{c96ff998-45bd-411e-9253-b7f2660fe280}\fon191d.tmp
%TEMP%\{ca67a139-cb95-4c00-ae88-63983a1502cb}\{c96ff998-45bd-411e-9253-b7f2660fe280}\set190c.tmp
%TEMP%\18cd.tmp
%TEMP%\{d135a636-d939-4980-afd6-a018c29066bc}\0x0409.ini
%TEMP%\{d135a636-d939-4980-afd6-a018c29066bc}\setup.ini
%TEMP%\{d135a636-d939-4980-afd6-a018c29066bc}\disk1\setup.iss
%TEMP%\{d135a636-d939-4980-afd6-a018c29066bc}\disk1\setup.inx
%TEMP%\{d135a636-d939-4980-afd6-a018c29066bc}\disk1\setup.ini
%TEMP%\{d135a636-d939-4980-afd6-a018c29066bc}\disk1\setup.exe
%TEMP%\{d135a636-d939-4980-afd6-a018c29066bc}\disk1\md5sum.exe
%TEMP%\{d135a636-d939-4980-afd6-a018c29066bc}\disk1\license.rtf
%TEMP%\{d135a636-d939-4980-afd6-a018c29066bc}\disk1\layout.bin
%TEMP%\{d135a636-d939-4980-afd6-a018c29066bc}\disk1\issetup.dll
%TEMP%\{d135a636-d939-4980-afd6-a018c29066bc}\disk1\data1.hdr
%TEMP%\{d135a636-d939-4980-afd6-a018c29066bc}\disk1\data1.cab
%TEMP%\{d135a636-d939-4980-afd6-a018c29066bc}\disk1\0x0409.ini
%TEMP%\rarsfx0\config.ini
%TEMP%\{ca67a139-cb95-4c00-ae88-63983a1502cb}\{c96ff998-45bd-411e-9253-b7f2660fe280}\_is1964.tmp
%WINDIR%\centurylinkinstallersetup.log

Перемещает следующие файлы

%TEMP%\{ca67a139-cb95-4c00-ae88-63983a1502cb}\{c96ff998-45bd-411e-9253-b7f2660fe280}\set190c.tmp в %TEMP%\{ca67a139-cb95-4c00-ae88-63983a1502cb}\{c96ff998-45bd-411e-9253-b7f2660fe280}\setup.inx
%TEMP%\{ca67a139-cb95-4c00-ae88-63983a1502cb}\{c96ff998-45bd-411e-9253-b7f2660fe280}\fon191d.tmp в %TEMP%\{ca67a139-cb95-4c00-ae88-63983a1502cb}\{c96ff998-45bd-411e-9253-b7f2660fe280}\fontdata.ini
%TEMP%\{ca67a139-cb95-4c00-ae88-63983a1502cb}\{c96ff998-45bd-411e-9253-b7f2660fe280}\dif191e.tmp в %TEMP%\{ca67a139-cb95-4c00-ae88-63983a1502cb}\{c96ff998-45bd-411e-9253-b7f2660fe280}\difxdata.ini
%TEMP%\{ca67a139-cb95-4c00-ae88-63983a1502cb}\cor191f.tmp в %TEMP%\{ca67a139-cb95-4c00-ae88-63983a1502cb}\corecomp.ini
%TEMP%\{ca67a139-cb95-4c00-ae88-63983a1502cb}\dot192f.tmp в %TEMP%\{ca67a139-cb95-4c00-ae88-63983a1502cb}\dotnetinstaller.exe
%TEMP%\{ca67a139-cb95-4c00-ae88-63983a1502cb}\isb1930.tmp в %TEMP%\{ca67a139-cb95-4c00-ae88-63983a1502cb}\isbew64.exe
%TEMP%\{ca67a139-cb95-4c00-ae88-63983a1502cb}\{c96ff998-45bd-411e-9253-b7f2660fe280}\str1941.tmp в %TEMP%\{ca67a139-cb95-4c00-ae88-63983a1502cb}\{c96ff998-45bd-411e-9253-b7f2660fe280}\stringtable_0x0409.ips
%TEMP%\{ca67a139-cb95-4c00-ae88-63983a1502cb}\{c96ff998-45bd-411e-9253-b7f2660fe280}\isr1952.tmp в %TEMP%\{ca67a139-cb95-4c00-ae88-63983a1502cb}\{c96ff998-45bd-411e-9253-b7f2660fe280}\isrt.dll
%TEMP%\{ca67a139-cb95-4c00-ae88-63983a1502cb}\{c96ff998-45bd-411e-9253-b7f2660fe280}\def1962.tmp в %TEMP%\{ca67a139-cb95-4c00-ae88-63983a1502cb}\{c96ff998-45bd-411e-9253-b7f2660fe280}\default.pal
%TEMP%\{ca67a139-cb95-4c00-ae88-63983a1502cb}\{c96ff998-45bd-411e-9253-b7f2660fe280}\_is1963.tmp в %TEMP%\{ca67a139-cb95-4c00-ae88-63983a1502cb}\{c96ff998-45bd-411e-9253-b7f2660fe280}\_isuser_0x0409.dll
%TEMP%\{ca67a139-cb95-4c00-ae88-63983a1502cb}\{c96ff998-45bd-411e-9253-b7f2660fe280}\_is1964.tmp в %TEMP%\{ca67a139-cb95-4c00-ae88-63983a1502cb}\{c96ff998-45bd-411e-9253-b7f2660fe280}\_isres_0x0409.dll

Другое

Ищет следующие окна

ClassName: 'EDIT' WindowName: ''
ClassName: '' WindowName: ''

Создает и запускает на исполнение

'%TEMP%\rarsfx0\centurylinkinstallersetup.exe'
'%TEMP%\{ca67a139-cb95-4c00-ae88-63983a1502cb}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{04658AD5-AA9F-4938-89B4-A3D40925DEBE}
'%TEMP%\{ca67a139-cb95-4c00-ae88-63983a1502cb}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{07386285-60FC-4177-B744-6199472CBF08}
'%TEMP%\{ca67a139-cb95-4c00-ae88-63983a1502cb}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{DCF0D3E1-1249-4589-A130-ED8CCBF19A02}
'%TEMP%\{ca67a139-cb95-4c00-ae88-63983a1502cb}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{B8DDD268-409E-4EFA-93EB-39167C94BAD8}
'%TEMP%\{ca67a139-cb95-4c00-ae88-63983a1502cb}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{6B5E6E16-8512-4862-AABB-F8DD9AF0DD73}
'%TEMP%\{ca67a139-cb95-4c00-ae88-63983a1502cb}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{2B6BEAC4-73B7-4124-A4F9-F1E359F2B1D4}
'%TEMP%\{ca67a139-cb95-4c00-ae88-63983a1502cb}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{DF70C0E6-F762-4385-BBCD-82F9F42230DD}
'%TEMP%\{ca67a139-cb95-4c00-ae88-63983a1502cb}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{9A034496-7934-48E0-9E41-A24C33E777C5}
'%TEMP%\{ca67a139-cb95-4c00-ae88-63983a1502cb}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{A270C1D1-3D60-4A07-A213-E0AC9FC3FA1C}
'%TEMP%\{ca67a139-cb95-4c00-ae88-63983a1502cb}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{90DF2DB9-06D2-4E0D-8AA2-1DB94DB6EC2B}
'%TEMP%\{ca67a139-cb95-4c00-ae88-63983a1502cb}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{AC9A1BE2-80AD-40CE-BED0-7E9BF5801340}
'%TEMP%\{ca67a139-cb95-4c00-ae88-63983a1502cb}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{D922BF45-3EBB-4213-AD69-8CB0C8255891}
'%WINDIR%\syswow64\taskkill.exe' /f /im QwestTouchPointAgent.exe /im CenturyLinkTouchPointAgent.exe /im QwestInstaller.exe /im QwestInstallerApp.exe /im CenturyLinkInstaller.exe /im CenturyLinkInstallerApp.exe' (со скрытым окном)