Trojan.MulDrop4.31592

Техническая информация

Вредоносные функции:

Создает и запускает на исполнение:

%TEMP%\7zS1.tmp\51654c97c5cda.exe /s

Запускает на исполнение:

<SYSTEM32>\wbem\wmiadap.exe /R /T

Изменения в файловой системе:

Создает следующие файлы:

<LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\jelailhlingfjjeabpacccanmkoimlng\1\lsdb.js
<LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\jelailhlingfjjeabpacccanmkoimlng\1\content.js
<LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\jelailhlingfjjeabpacccanmkoimlng\1\sqlite.js
<LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\jelailhlingfjjeabpacccanmkoimlng\1\manifest.json
<LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\jelailhlingfjjeabpacccanmkoimlng\1\background.html
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\kfik@eeuyiosbwp.edu\content\bg.js
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\kfik@eeuyiosbwp.edu\install.rdf
<LS_APPDATA>\Google\Chrome\User Data\Default\Extensions\jelailhlingfjjeabpacccanmkoimlng\1\51654c97c5ae83.24824907.js
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\kfik@eeuyiosbwp.edu\content\zy.xul
%ALLUSERSPROFILE%\Application Data\Downlooad and. Sa\uninstall.exe
%ALLUSERSPROFILE%\Application Data\Downlooad and. Sa\51654c97c5d13.tlb
%ALLUSERSPROFILE%\Start Menu\Programs\Downlooad and. Sa\Uninstall.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\Downlooad and. Sa\Downlooad and. Sa.lnk
%ALLUSERSPROFILE%\Application Data\Downlooad and. Sa\51654c97c5d13.dll
<LS_APPDATA>\Google\Chrome\User Data\Default\Preferences
%TEMP%\nsz3.tmp\nsJSON.dll
%ALLUSERSPROFILE%\Application Data\Downlooad and. Sa\settings.ini
<SYSTEM32>\wbem\Performance\WmiApRpl_new.ini
%TEMP%\7zS1.tmp\jelailhlingfjjeabpacccanmkoimlng\lsdb.js
%TEMP%\7zS1.tmp\jelailhlingfjjeabpacccanmkoimlng\content.js
%TEMP%\7zS1.tmp\settings.ini
%TEMP%\7zS1.tmp\jelailhlingfjjeabpacccanmkoimlng\sqlite.js
%TEMP%\7zS1.tmp\kfik@eeuyiosbwp.edu\bootstrap.js
%TEMP%\7zS1.tmp\jelailhlingfjjeabpacccanmkoimlng\background.html
%TEMP%\7zS1.tmp\kfik@eeuyiosbwp.edu\chrome.manifest
%TEMP%\7zS1.tmp\kfik@eeuyiosbwp.edu\content\bg.js
%TEMP%\7zS1.tmp\jelailhlingfjjeabpacccanmkoimlng\51654c97c5ae83.24824907.js
%TEMP%\nsz3.tmp\UserInfo.dll
%TEMP%\7zS1.tmp\kfik@eeuyiosbwp.edu\content\zy.xul
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\kfik@eeuyiosbwp.edu\chrome.manifest
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\kfik@eeuyiosbwp.edu\bootstrap.js
%TEMP%\7zS1.tmp\kfik@eeuyiosbwp.edu\install.rdf
%TEMP%\7zS1.tmp\51654c97c5d13.dll
%TEMP%\7zS1.tmp\51654c97c5cda.exe
%TEMP%\7zS1.tmp\jelailhlingfjjeabpacccanmkoimlng\manifest.json
%TEMP%\7zS1.tmp\51654c97c5d13.tlb

Удаляет следующие файлы:

%TEMP%\7zS1.tmp\kfik@eeuyiosbwp.edu\bootstrap.js
%TEMP%\7zS1.tmp\kfik@eeuyiosbwp.edu\chrome.manifest
%TEMP%\7zS1.tmp\jelailhlingfjjeabpacccanmkoimlng\manifest.json
%TEMP%\7zS1.tmp\jelailhlingfjjeabpacccanmkoimlng\sqlite.js
%TEMP%\7zS1.tmp\kfik@eeuyiosbwp.edu\install.rdf
%TEMP%\7zS1.tmp\settings.ini
%TEMP%\7zS1.tmp\kfik@eeuyiosbwp.edu\content\bg.js
%TEMP%\7zS1.tmp\kfik@eeuyiosbwp.edu\content\zy.xul
%TEMP%\7zS1.tmp\jelailhlingfjjeabpacccanmkoimlng\lsdb.js
%TEMP%\7zS1.tmp\51654c97c5cda.exe
%TEMP%\7zS1.tmp\51654c97c5d13.dll
%TEMP%\nsz3.tmp\nsJSON.dll
%TEMP%\nsz3.tmp\UserInfo.dll
%TEMP%\7zS1.tmp\jelailhlingfjjeabpacccanmkoimlng\background.html
%TEMP%\7zS1.tmp\jelailhlingfjjeabpacccanmkoimlng\content.js
%TEMP%\7zS1.tmp\51654c97c5d13.tlb
%TEMP%\7zS1.tmp\jelailhlingfjjeabpacccanmkoimlng\51654c97c5ae83.24824907.js

Перемещает следующие файлы:

<SYSTEM32>\wbem\Performance\WmiApRpl_new.ini в <SYSTEM32>\wbem\Performance\WmiApRpl.ini
<SYSTEM32>\wbem\Performance\WmiApRpl_new.h в <SYSTEM32>\wbem\Performance\WmiApRpl.h