Trojan.MulDrop20.46825

Техническая информация

Для обеспечения автозапуска и распространения

Устанавливает следующие настройки сервисов

[<HKLM>\System\CurrentControlSet\Services\IKEEXT] 'Start' = '00000002'

Изменяет следующие исполняемые системные файлы

%WINDIR%\flash_sa.exe
%WINDIR%\microsoft.net\framework64\v4.0.30319\edmgen.exe
%WINDIR%\microsoft.net\framework64\v4.0.30319\dfsvc.exe
%WINDIR%\microsoft.net\framework64\v4.0.30319\datasvcutil.exe
%WINDIR%\microsoft.net\framework64\v4.0.30319\cvtres.exe
%WINDIR%\microsoft.net\framework64\v4.0.30319\csc.exe
%WINDIR%\microsoft.net\framework64\v4.0.30319\comsvcconfig.exe
%WINDIR%\microsoft.net\framework64\v4.0.30319\caspol.exe
%WINDIR%\microsoft.net\framework64\v4.0.30319\aspnet_wp.exe
%WINDIR%\microsoft.net\framework64\v4.0.30319\aspnet_state.exe
%WINDIR%\microsoft.net\framework64\v4.0.30319\aspnet_regsql.exe
%WINDIR%\microsoft.net\framework64\v4.0.30319\aspnet_regiis.exe
%WINDIR%\microsoft.net\framework64\v4.0.30319\aspnet_regbrowsers.exe
%WINDIR%\microsoft.net\framework64\v4.0.30319\aspnet_compiler.exe
%WINDIR%\microsoft.net\framework64\v4.0.30319\applaunch.exe
%WINDIR%\microsoft.net\framework64\v4.0.30319\ilasm.exe
%WINDIR%\microsoft.net\framework64\v4.0.30319\addinutil.exe
%WINDIR%\microsoft.net\framework64\v4.0.30319\addinprocess.exe
%WINDIR%\microsoft.net\framework\v4.0.30319\wsatconfig.exe
%WINDIR%\microsoft.net\framework\v4.0.30319\vbc.exe
%WINDIR%\microsoft.net\framework\v4.0.30319\smsvchost.exe
%WINDIR%\microsoft.net\framework\v4.0.30319\servicemodelreg.exe
%WINDIR%\microsoft.net\framework\v4.0.30319\regtlibv12.exe
%WINDIR%\microsoft.net\framework\v4.0.30319\regsvcs.exe
%WINDIR%\microsoft.net\framework\v4.0.30319\regasm.exe
%WINDIR%\microsoft.net\framework\v4.0.30319\ngen.exe
%WINDIR%\microsoft.net\framework\v4.0.30319\mscorsvw.exe
%WINDIR%\microsoft.net\framework\v4.0.30319\msbuild.exe
%WINDIR%\microsoft.net\framework\v4.0.30319\microsoft.workflow.compiler.exe
%WINDIR%\microsoft.net\framework\v4.0.30319\jsc.exe
%WINDIR%\microsoft.net\framework\v4.0.30319\installutil.exe
%WINDIR%\microsoft.net\framework64\v4.0.30319\addinprocess32.exe
<SYSTEM32>\javaws.exe
%WINDIR%\winsxs\amd64_microsoft-windows-s..oxgames-minesweeper_31bf3856ad364e35_6.1.7600.16385_none_fe560f0352e04f48\minesweeper.exe
%WINDIR%\microsoft.net\framework64\v4.0.30319\microsoft.workflow.compiler.exe
%WINDIR%\winsxs\amd64_microsoft-windows-s..nboxgames-solitaire_31bf3856ad364e35_6.1.7600.16385_none_d1124c00155dfd14\solitaire.exe
%WINDIR%\winsxs\amd64_microsoft-windows-s..mes-spidersolitaire_31bf3856ad364e35_6.1.7600.16385_none_dead260d8f002b73\spidersolitaire.exe
%WINDIR%\winsxs\amd64_microsoft-windows-s..l-inboxgames-hearts_31bf3856ad364e35_6.1.7600.16385_none_4ffeefd67d89d45b\hearts.exe
%WINDIR%\winsxs\amd64_microsoft-windows-s..inboxgames-freecell_31bf3856ad364e35_6.1.7600.16385_none_b466b741b68bd29a\freecell.exe
%WINDIR%\temp\8147932992814195939363050711163993686\adobearm.exe
%WINDIR%\syswow64\urttemp\regtlib.exe
%WINDIR%\syswow64\macromed\flash\flashutil32_19_0_0_207_activex.exe
%WINDIR%\syswow64\macromed\flash\flashutil32_18_0_0_261_plugin.exe
%WINDIR%\syswow64\macromed\flash\flashplayerupdateservice.exe
%WINDIR%\syswow64\macromed\flash\flashplayerplugin_18_0_0_261.exe
%WINDIR%\syswow64\flashplayerapp.exe
<SYSTEM32>\macromed\flash\flashutil64_19_0_0_207_activex.exe
<SYSTEM32>\macromed\flash\flashutil64_18_0_0_261_plugin.exe
<SYSTEM32>\vmicsvc.exe
%WINDIR%\microsoft.net\framework\v4.0.30319\ilasm.exe
<SYSTEM32>\mpsigstub.exe
<SYSTEM32>\javaw.exe
<SYSTEM32>\java.exe
%WINDIR%\microsoft.net\framework64\v4.0.30319\setupcache\v4.7.02558\setuputility.exe
%WINDIR%\microsoft.net\framework64\v4.0.30319\setupcache\v4.7.02558\setup.exe
%WINDIR%\microsoft.net\framework64\v4.0.30319\wsatconfig.exe
%WINDIR%\microsoft.net\framework64\v4.0.30319\vbc.exe
%WINDIR%\microsoft.net\framework64\v4.0.30319\smsvchost.exe
%WINDIR%\microsoft.net\framework64\v4.0.30319\servicemodelreg.exe
%WINDIR%\microsoft.net\framework64\v4.0.30319\regtlibv12.exe
%WINDIR%\microsoft.net\framework64\v4.0.30319\regsvcs.exe
%WINDIR%\microsoft.net\framework64\v4.0.30319\regasm.exe
%WINDIR%\microsoft.net\framework64\v4.0.30319\ngen.exe
%WINDIR%\microsoft.net\framework64\v4.0.30319\mscorsvw.exe
%WINDIR%\microsoft.net\framework64\v4.0.30319\msbuild.exe
%WINDIR%\microsoft.net\framework64\v4.0.30319\installutil.exe
%WINDIR%\microsoft.net\framework64\v4.0.30319\jsc.exe
%WINDIR%\microsoft.net\framework\v4.0.30319\edmgen.exe
%WINDIR%\microsoft.net\framework\v1.1.4322\al.exe
%WINDIR%\assembly\nativeimages_v4.0.30319_64\wsatconfig\fb3f50d8fd5c7254eca025df89c1c64c\wsatconfig.ni.exe
%WINDIR%\assembly\nativeimages_v4.0.30319_64\smsvchost\606912f2d4b279cec3ec26662a8f34df\smsvchost.ni.exe
%WINDIR%\assembly\nativeimages_v4.0.30319_64\msbuild\a8f635efce2e3fc7be74208b99ed3a2c\msbuild.ni.exe
%WINDIR%\assembly\nativeimages_v4.0.30319_64\microsoft.w71daf281#\175b5ddd4326a1c6276b57fccd665f33\microsoft.workflow.compiler.ni.exe
%WINDIR%\assembly\nativeimages_v4.0.30319_64\dfsvc\c2b611647540100d5b90aa0c78a55b24\dfsvc.ni.exe
%WINDIR%\assembly\nativeimages_v4.0.30319_64\comsvcconfig\78057af6d175256f57ab7485d2a09f3d\comsvcconfig.ni.exe
%WINDIR%\assembly\nativeimages_v4.0.30319_32\wsatconfig\d3ecda9cb1a8d633e0d04fb5dd8b2642\wsatconfig.ni.exe
%WINDIR%\assembly\nativeimages_v4.0.30319_32\smsvchost\87c7416378ee1c4260e4c526945da716\smsvchost.ni.exe
%WINDIR%\assembly\nativeimages_v4.0.30319_32\msbuild\63d5741d60e99116874a074a55de0d72\msbuild.ni.exe
%WINDIR%\assembly\nativeimages_v4.0.30319_32\microsoft.w71daf281#\29c5329e2c2d33550395749eca61d0da\microsoft.workflow.compiler.ni.exe
%WINDIR%\assembly\nativeimages_v4.0.30319_32\dfsvc\ad40b26cf5e057de04fce0e6327b4589\dfsvc.ni.exe
%WINDIR%\assembly\nativeimages_v4.0.30319_32\comsvcconfig\e8405cd5c2aa6202ebb8f5652987bd33\comsvcconfig.ni.exe
%WINDIR%\assembly\nativeimages_v2.0.50727_64\wsatconfig\36ca2928b2191011831ab673861c6ac6\wsatconfig.ni.exe
%WINDIR%\assembly\nativeimages_v2.0.50727_64\smsvchost\04d794428d635f6a82ac57dd3d6f3628\smsvchost.ni.exe
%WINDIR%\microsoft.net\netfxrepair.exe
%WINDIR%\assembly\nativeimages_v2.0.50727_64\presentationfontcac#\0246845f487e5f33d3564eff578665a3\presentationfontcache.ni.exe
%WINDIR%\assembly\nativeimages_v2.0.50727_64\msbuild\1a154709cdfe214029ea88c51ab2b579\msbuild.ni.exe
%WINDIR%\assembly\nativeimages_v2.0.50727_64\mcupdate\f30beba36940b5a2b55a32ea7f42d694\mcupdate.ni.exe
%WINDIR%\assembly\nativeimages_v2.0.50727_64\loadmxf\d09b54cd68bc772b3be3832926e940d4\loadmxf.ni.exe
%WINDIR%\assembly\nativeimages_v2.0.50727_64\ehexthost\ad37b6e3a1cb1081592f1c5797ae9dad\ehexthost.ni.exe
%WINDIR%\assembly\nativeimages_v2.0.50727_64\dfsvc\9bc0d921859b039d6e9f642148333949\dfsvc.ni.exe
%WINDIR%\assembly\nativeimages_v2.0.50727_64\comsvcconfig\d632b7434f821829827657e23ac98589\comsvcconfig.ni.exe
%WINDIR%\assembly\nativeimages_v2.0.50727_32\wsatconfig\96a8bdafba9f9d3e33cd974bfaa67e58\wsatconfig.ni.exe
%WINDIR%\assembly\nativeimages_v2.0.50727_32\smsvchost\1bc1ee3c3aa45d28dcf4657bceb2fcb4\smsvchost.ni.exe
%WINDIR%\assembly\nativeimages_v2.0.50727_32\presentationfontcac#\b3ade8d5c0d4bb5d4940bcafd3453642\presentationfontcache.ni.exe
%WINDIR%\assembly\nativeimages_v2.0.50727_32\narrator\0bae62c3fc6c327ed24989263988173d\narrator.ni.exe
%WINDIR%\assembly\nativeimages_v2.0.50727_32\msbuild\af28543d9b3e7d9f110448ecce53cd72\msbuild.ni.exe
%WINDIR%\assembly\nativeimages_v2.0.50727_32\ehexthost32\c899de3549784161aa66610d5735e4f0\ehexthost32.ni.exe
%WINDIR%\assembly\nativeimages_v2.0.50727_32\dfsvc\2c3e7fda8de40e45e7f5e004094dc7c9\dfsvc.ni.exe
%WINDIR%\assembly\nativeimages_v2.0.50727_32\comsvcconfig\5f1a06c0108b2c81cde1dc491d74043d\comsvcconfig.ni.exe
%WINDIR%\assembly\nativeimages_v2.0.50727_64\narrator\4cc02fad33053737088d4c18267ca0a0\narrator.ni.exe
%WINDIR%\microsoft.net\framework\v1.1.4322\regsvcs.exe
%WINDIR%\microsoft.net\framework\v4.0.30319\datasvcutil.exe
%WINDIR%\microsoft.net\framework\v1.1.4322\aspnet_regiis.exe
%WINDIR%\microsoft.net\framework\v4.0.30319\cvtres.exe
%WINDIR%\microsoft.net\framework\v4.0.30319\csc.exe
%WINDIR%\microsoft.net\framework\v4.0.30319\comsvcconfig.exe
%WINDIR%\microsoft.net\framework\v4.0.30319\caspol.exe
%WINDIR%\microsoft.net\framework\v4.0.30319\aspnet_wp.exe
%WINDIR%\microsoft.net\framework\v4.0.30319\aspnet_state.exe
%WINDIR%\microsoft.net\framework\v4.0.30319\aspnet_regsql.exe
%WINDIR%\microsoft.net\framework\v4.0.30319\aspnet_regiis.exe
%WINDIR%\microsoft.net\framework\v4.0.30319\aspnet_regbrowsers.exe
%WINDIR%\microsoft.net\framework\v4.0.30319\aspnet_compiler.exe
%WINDIR%\microsoft.net\framework\v4.0.30319\applaunch.exe
%WINDIR%\microsoft.net\framework\v4.0.30319\addinutil.exe
%WINDIR%\microsoft.net\framework\v4.0.30319\addinprocess32.exe
%WINDIR%\microsoft.net\framework\v4.0.30319\addinprocess.exe
%WINDIR%\microsoft.net\framework\v4.0.30319\dfsvc.exe
%WINDIR%\microsoft.net\framework\v1.1.4322\vbc.exe
%WINDIR%\microsoft.net\framework\v1.1.4322\regasm.exe
%WINDIR%\microsoft.net\framework\v1.1.4322\ngen.exe
%WINDIR%\microsoft.net\framework\v1.1.4322\migpolwin.exe
%WINDIR%\microsoft.net\framework\v1.1.4322\migpol.exe
%WINDIR%\microsoft.net\framework\v1.1.4322\jsc.exe
%WINDIR%\microsoft.net\framework\v1.1.4322\installutil.exe
%WINDIR%\microsoft.net\framework\v1.1.4322\ilasm.exe
%WINDIR%\microsoft.net\framework\v1.1.4322\ieexec.exe
%WINDIR%\microsoft.net\framework\v1.1.4322\cvtres.exe
%WINDIR%\microsoft.net\framework\v1.1.4322\csc.exe
%WINDIR%\microsoft.net\framework\v1.1.4322\configwizards.exe
%WINDIR%\microsoft.net\framework\v1.1.4322\caspol.exe
%WINDIR%\microsoft.net\framework\v1.1.4322\aspnet_wp.exe
%WINDIR%\microsoft.net\framework\v1.1.4322\aspnet_state.exe
%WINDIR%\microsoft.net\assembly\gac_msil\microsoft.workflow.compiler\v4.0_4.0.0.0__31bf3856ad364e35\microsoft.workflow.compiler.exe
%WINDIR%\winsxs\amd64_microsoft-windows-s..oxgames-purbleplace_31bf3856ad364e35_6.1.7600.16385_none_622070221822eb39\purbleplace.exe

Вредоносные функции

Запускает на исполнение

'<SYSTEM32>\net.exe' stop "Security Center"
'<SYSTEM32>\netsh.exe' firewall set opmode mode=disable

Завершает или пытается завершить

следующие пользовательские процессы:

firefox.exe

Изменения в файловой системе

Создает следующие файлы

%TEMP%\8620.tmp\8630.tmp\8631.bat
<Текущая директория>\inflist_exe.txt
%ALLUSERSPROFILE%\microsoft\windows\wer\reportqueue\appcrash_autokms.exe_efd62e343880604c4145a2e4462f8c532327bc70_cab_0841821b\<Имя файла>.exe
%ALLUSERSPROFILE%\microsoft\windows\wer\reportqueue\appcrash_autokms.exe_efd62e343880604c4145a2e4462f8c532327bc70_099489dd\<Имя файла>.exe
%ALLUSERSPROFILE%\microsoft\windows\wer\reportqueue\appcrash_autokms.exe_efd62e343880604c4145a2e4462f8c532327bc70_088cc9f7\<Имя файла>.exe
%WINDIR%\panther\setup.exe\<Имя файла>.exe
<Текущая директория>\pathhost

Сетевая активность

UDP

'localhost':59850
'localhost':49925

Другое

Создает и запускает на исполнение

'<SYSTEM32>\cmd.exe' /c "%TEMP%\8620.tmp\8630.tmp\8631.bat <Полный путь к файлу>"' (со скрытым окном)

Запускает на исполнение

'<SYSTEM32>\cmd.exe' /c "%TEMP%\8620.tmp\8630.tmp\8631.bat <Полный путь к файлу>"
'<SYSTEM32>\tskill.exe' /A cc*
'<SYSTEM32>\tskill.exe' /A norton*
'<SYSTEM32>\tskill.exe' /A norton au*
'<SYSTEM32>\tskill.exe' /A ccc*
'<SYSTEM32>\tskill.exe' /A npfmn*
'<SYSTEM32>\tskill.exe' /A loge*
'<SYSTEM32>\tskill.exe' /A nisum*
'<SYSTEM32>\tskill.exe' /A issvc
'<SYSTEM32>\tskill.exe' /A tmp*
'<SYSTEM32>\tskill.exe' /A tmn*
'<SYSTEM32>\tskill.exe' /A pcc*
'<SYSTEM32>\tskill.exe' /A cpd*
'<SYSTEM32>\tskill.exe' /A pop*
'<SYSTEM32>\tskill.exe' /A cle
'<SYSTEM32>\tskill.exe' /A pav*
'<SYSTEM32>\tskill.exe' /A panda*
'<SYSTEM32>\tskill.exe' /A avsch*
'<SYSTEM32>\tskill.exe' /A sche*
'<SYSTEM32>\tskill.exe' /A syman*
'<SYSTEM32>\tskill.exe' /A virus*
'<SYSTEM32>\tskill.exe' /A realm*
'<SYSTEM32>\tskill.exe' /A sweep*
'<SYSTEM32>\tskill.exe' /A scan*
'<SYSTEM32>\tskill.exe' /A ad-*
'<SYSTEM32>\tskill.exe' /A safe*
'<SYSTEM32>\tskill.exe' /A avas*
'<SYSTEM32>\tskill.exe' /A norm*
'<SYSTEM32>\tskill.exe' /A offg*
'<SYSTEM32>\tskill.exe' /A zlclien*
'<SYSTEM32>\tskill.exe' /A minilog
'<SYSTEM32>\tskill.exe' /A upd*
'<SYSTEM32>\tskill.exe' /A zauinst
'<SYSTEM32>\tskill.exe' /A zap*
'<SYSTEM32>\tskill.exe' /A av*
'<SYSTEM32>\tskill.exe' /A fire*
'<SYSTEM32>\tskill.exe' /A anti*
'<SYSTEM32>\tskill.exe' /A spy*
'<SYSTEM32>\tskill.exe' /A bullguard
'<SYSTEM32>\tskill.exe' /A PersFw
'<SYSTEM32>\tskill.exe' /A KAV*
'<SYSTEM32>\tskill.exe' /A ZONEALARM
'<SYSTEM32>\tskill.exe' /A SAFEWEB
'<SYSTEM32>\tskill.exe' /A OUTPOST
'<SYSTEM32>\tskill.exe' /A nv*
'<SYSTEM32>\tskill.exe' /A nav*
'<SYSTEM32>\tskill.exe' /A F-*
'<SYSTEM32>\cmd.exe' /S /D /c" echo Y "
'<SYSTEM32>\tskill.exe' /A padmin
'<SYSTEM32>\tskill.exe' /A ESAFE
'<SYSTEM32>\tskill.exe' /A def*
'<SYSTEM32>\tskill.exe' /A kav
'<SYSTEM32>\tskill.exe' /A avg*
'<SYSTEM32>\tskill.exe' /A ash*
'<SYSTEM32>\tskill.exe' /A aswupdsv
'<SYSTEM32>\tskill.exe' /A ewid*
'<SYSTEM32>\tskill.exe' /A guard*
'<SYSTEM32>\tskill.exe' /A guar*
'<SYSTEM32>\tskill.exe' /A msmp*
'<SYSTEM32>\tskill.exe' /A mcafe*
'<SYSTEM32>\tskill.exe' /A mghtml
'<SYSTEM32>\tskill.exe' /A msiexec
'<SYSTEM32>\tskill.exe' /A isafe
'<SYSTEM32>\net1.exe' stop "Security Center"
'<SYSTEM32>\tskill.exe' /A BLACKICE
'<SYSTEM32>\cmd.exe' /S /D /c" FOR /F "tokens=1,* delims=: " %j in (InfList_exe.txt) do copy <Полный путь к файлу> "%j:%k""

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней