Trojan.MulDrop20.557

Техническая информация

Для обеспечения автозапуска и распространения

Создает или изменяет следующие файлы

<SYSTEM32>\tasks\driverupdate

Изменения в файловой системе

Создает следующие файлы

%TEMP%\rarsfx0\yes_-_copy.bat
nul
%APPDATA%\sysinfo.txt
%APPDATA%\netuser.txt
%APPDATA%\cmdkey.txt
%APPDATA%\ipconfig.txt
C:\users\public\documents\0.bat
C:\users\public\documents\0.vbs

Присваивает атрибут 'скрытый' для следующих файлов

C:\users\public\documents\0.vbs
C:\users\public\documents\0.bat

Удаляет следующие файлы

%APPDATA%\sysinfo.txt
%APPDATA%\netuser.txt
%APPDATA%\cmdkey.txt
%APPDATA%\ipconfig.txt
%TEMP%\rarsfx0\yes_-_copy.bat

Другое

Ищет следующие окна

ClassName: 'EDIT' WindowName: ''

Запускает на исполнение

'%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\RarSFX0\yes_-_Copy.bat" "
'%WINDIR%\syswow64\cmd.exe' /S /D /c" echo steamclient.dll"
'%WINDIR%\syswow64\cmd.exe' /S /D /c" echo steamapps"
'%WINDIR%\syswow64\cmd.exe' /S /D /c" echo Steam2.dll"
'%WINDIR%\syswow64\cmd.exe' /S /D /c" echo Steam.exe.old"
'%WINDIR%\syswow64\cmd.exe' /S /D /c" echo Steam.exe"
'%WINDIR%\syswow64\cmd.exe' /S /D /c" echo Steam.dll"
'%WINDIR%\syswow64\cmd.exe' /S /D /c" echo steam"
'%WINDIR%\syswow64\cmd.exe' /S /D /c" echo skins"
'%WINDIR%\syswow64\cmd.exe' /S /D /c" echo servers"
'%WINDIR%\syswow64\cmd.exe' /S /D /c" echo SDL2.dll"
'%WINDIR%\syswow64\cmd.exe' /S /D /c" echo resource"
'%WINDIR%\syswow64\cmd.exe' /S /D /c" echo remoteui"
'%WINDIR%\syswow64\cmd.exe' /S /D /c" echo public"
'%WINDIR%\syswow64\cmd.exe' /S /D /c" echo package"
'%WINDIR%\syswow64\cmd.exe' /S /D /c" echo logs"
'%WINDIR%\syswow64\cmd.exe' /S /D /c" echo libx264-142.dll.md5"
'%WINDIR%\syswow64\cmd.exe' /S /D /c" echo libx264-142.dll.crypt"
'%WINDIR%\syswow64\cmd.exe' /S /D /c" echo steamclient64.dll"
'%WINDIR%\syswow64\cmd.exe' /S /D /c" echo steamerrorreporter.exe"
'%WINDIR%\syswow64\cmd.exe' /S /D /c" echo steamerrorreporter64.exe"
'%WINDIR%\syswow64\cmd.exe' /S /D /c" echo SteamUI.dll"
'%WINDIR%\syswow64\attrib.exe' "C:\Users\Public\Documents\0.vbs" +h
'%WINDIR%\syswow64\schtasks.exe' /create /f /sc Onidle /i 60 /tn "DriverUpdate" /tr "C:\Users\Public\Documents\0.vbs"
'%WINDIR%\syswow64\attrib.exe' -h "C:\Users\Public\Documents\"
'%WINDIR%\syswow64\cmd.exe' /c 2>NUL dir /b "%ProgramFiles%\Steam\"
'%WINDIR%\syswow64\cmd.exe' /S /D /c" echo WriteMiniDump.exe"
'%WINDIR%\syswow64\cmd.exe' /S /D /c" echo winh264.dll"
'%WINDIR%\syswow64\cmd.exe' /S /D /c" echo vstdlib_s64.dll"
'%WINDIR%\syswow64\cmd.exe' /S /D /c" echo vstdlib_s.dll"
'%WINDIR%\syswow64\cmd.exe' /S /D /c" echo v8.dll"
'%WINDIR%\syswow64\cmd.exe' /S /D /c" echo video.dll"
'%WINDIR%\syswow64\cmd.exe' /S /D /c" echo uninstall.exe"
'%WINDIR%\syswow64\cmd.exe' /S /D /c" echo tier0_s64.dll"
'%WINDIR%\syswow64\cmd.exe' /S /D /c" echo tier0_s.dll"
'%WINDIR%\syswow64\cmd.exe' /S /D /c" echo ThirdPartyLegalNotices.html"
'%WINDIR%\syswow64\cmd.exe' /S /D /c" echo ThirdPartyLegalNotices.doc"
'%WINDIR%\syswow64\cmd.exe' /S /D /c" echo ThirdPartyLegalNotices.css"
'%WINDIR%\syswow64\cmd.exe' /S /D /c" echo tenfoot"
'%WINDIR%\syswow64\cmd.exe' /S /D /c" echo streaming_client.exe"
'%WINDIR%\syswow64\attrib.exe' "C:\Users\Public\Documents\0.bat" +h
'%WINDIR%\syswow64\cmd.exe' /S /D /c" echo libswscale-3.dll"
'%WINDIR%\syswow64\cmd.exe' /S /D /c" echo libav_h264-56.dll.md5"
'%WINDIR%\syswow64\cmd.exe' /S /D /c" echo libav_h264-56.dll.crypt"
'%WINDIR%\syswow64\cmd.exe' /S /D /c" echo appcache"
'%WINDIR%\syswow64\find.exe' "ssfn"
'%WINDIR%\syswow64\cmd.exe' /S /D /c" echo amf"
'%WINDIR%\syswow64\cmd.exe' /c 2>NUL dir /b "%ProgramFiles(x86)%\Steam\"
'%WINDIR%\syswow64\cmd.exe' /c 2>NUL dir /b "%APPDATA%\discord\Local Storage\leveldb\"
'%WINDIR%\syswow64\cmd.exe' /c 2>NUL dir /b "%APPDATA%\Mozilla\Firefox\Profiles"
'%WINDIR%\syswow64\timeout.exe' /t 2 /nobreak
'%WINDIR%\syswow64\ipconfig.exe' /all
'%WINDIR%\syswow64\cmdkey.exe' /list
'%WINDIR%\syswow64\net1.exe' user
'%WINDIR%\syswow64\net.exe' user
'%WINDIR%\syswow64\systeminfo.exe'
'%WINDIR%\syswow64\timeout.exe' /t 5 /nobreak
'%WINDIR%\syswow64\attrib.exe' "C:\Users\Public\Documents\s.exe" +h
'%WINDIR%\syswow64\findstr.exe' [
'%WINDIR%\syswow64\ping.exe' -4 -n 1 rzcitoz
'%WINDIR%\syswow64\cmd.exe' /c 2>NUL ping -4 -n 1 rzcitoz | findstr [
'%WINDIR%\syswow64\cmd.exe' /S /D /c" echo AppOverlay.dll"
'%WINDIR%\syswow64\cmd.exe' /S /D /c" echo AppOverlay64.dll"
'%WINDIR%\syswow64\cmd.exe' /S /D /c" echo bin"
'%WINDIR%\syswow64\cmd.exe' /S /D /c" echo config"
'%WINDIR%\syswow64\cmd.exe' /S /D /c" echo libavresample-2.dll"
'%WINDIR%\syswow64\cmd.exe' /S /D /c" echo libavformat-56.dll"
'%WINDIR%\syswow64\cmd.exe' /S /D /c" echo libavcodec-56.dll"
'%WINDIR%\syswow64\cmd.exe' /S /D /c" echo icuuc.dll"
'%WINDIR%\syswow64\cmd.exe' /S /D /c" echo icui18n.dll"
'%WINDIR%\syswow64\cmd.exe' /S /D /c" echo html5app"
'%WINDIR%\syswow64\cmd.exe' /S /D /c" echo graphics"
'%WINDIR%\syswow64\cmd.exe' /S /D /c" echo GameOverlayUI.exe"
'%WINDIR%\syswow64\cmd.exe' /S /D /c" echo GameOverlayRenderer.dll"
'%WINDIR%\syswow64\cmd.exe' /S /D /c" echo GameOverlayRenderer64.dll"
'%WINDIR%\syswow64\cmd.exe' /S /D /c" echo friends"
'%WINDIR%\syswow64\cmd.exe' /S /D /c" echo dbghelp.dll"
'%WINDIR%\syswow64\cmd.exe' /S /D /c" echo d3dcompiler_46_64.dll"
'%WINDIR%\syswow64\cmd.exe' /S /D /c" echo d3dcompiler_46.dll"
'%WINDIR%\syswow64\cmd.exe' /S /D /c" echo CSERHelper.dll"
'%WINDIR%\syswow64\cmd.exe' /S /D /c" echo crashhandler64.dll"
'%WINDIR%\syswow64\cmd.exe' /S /D /c" echo crashhandler.dll"
'%WINDIR%\syswow64\cmd.exe' /S /D /c" echo controller_base"
'%WINDIR%\syswow64\cmd.exe' /S /D /c" echo libavutil-54.dll"
'%WINDIR%\syswow64\attrib.exe' "C:\Users\Public\Documents\1.bat" +h