Trojan.MulDrop20.55637

Техническая информация

Вредоносные функции

Запускает на исполнение

'%WINDIR%\syswow64\taskkill.exe' /F /IM iemisbrowser.exe /T
'%WINDIR%\syswow64\taskkill.exe' /F /IM iebrowser.exe /T
'%WINDIR%\syswow64\taskkill.exe' /F /IM iexplore.exe /T

Завершает или пытается завершить

следующие пользовательские процессы:

iexplore.exe

Изменения в файловой системе

Создает следующие файлы

%TEMP%\rarsfx0\flow.dll
%TEMP%\rarsfx0\reportwi.dll
%TEMP%\rarsfx0\iecnts2n.ocx
%TEMP%\rarsfx0\iecombox.ocx
%TEMP%\rarsfx0\iedate.ocx
%TEMP%\rarsfx0\ielablen.ocx
%TEMP%\rarsfx0\ielist2n.ocx
%TEMP%\rarsfx0\iemultab.ocx
%TEMP%\rarsfx0\iepicture.ocx
%TEMP%\rarsfx0\iepng.ocx
%TEMP%\rarsfx0\iequery.ocx
%TEMP%\rarsfx0\ietree.ocx
%TEMP%\rarsfx0\ievsgrid.ocx
%TEMP%\rarsfx0\vbcontrol.ocx
%TEMP%\rarsfx0\vsflex8.ocx
%TEMP%\rarsfx0\t.bat
%TEMP%\rarsfx0\iebrowser.exe
%TEMP%\rarsfx0\board.dll
%TEMP%\rarsfx0\reportss.dll
%TEMP%\rarsfx0\clientchart.dll
%TEMP%\rarsfx0\reportsc.dll
%TEMP%\rarsfx0\reportqc.dll
%TEMP%\rarsfx0\mainform.dll
%TEMP%\rarsfx0\reportabase.dll
%TEMP%\rarsfx0\reportac.dll
%TEMP%\rarsfx0\reportarck.dll
%TEMP%\rarsfx0\reportbo.dll
%TEMP%\rarsfx0\reportch.dll
%TEMP%\rarsfx0\reportco.dll
%TEMP%\rarsfx0\reportcu.dll
%TEMP%\rarsfx0\reporteg.dll
%TEMP%\rarsfx0\reportem.dll
%TEMP%\rarsfx0\reportiv.dll
%TEMP%\rarsfx0\reportlib.dll
%TEMP%\rarsfx0\reportma.dll
%TEMP%\rarsfx0\reportmt.dll
%TEMP%\rarsfx0\reportos.dll
%TEMP%\rarsfx0\reportpa.dll
%TEMP%\rarsfx0\reportpb.dll
%TEMP%\rarsfx0\reportsale.dll
%TEMP%\rarsfx0\clienthyplink.dll

Другое

Ищет следующие окна

ClassName: 'EDIT' WindowName: ''
ClassName: '' WindowName: ''

Запускает на исполнение

'%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\RarSFX0\T.BAT" "
'%WINDIR%\syswow64\regsvr32.exe' "%ProgramFiles(x86)%\IEMIS\navigate\cycle\report\ReportOS.dll " /S
'%WINDIR%\syswow64\regsvr32.exe' "%ProgramFiles(x86)%\IEMIS\navigate\cycle\report\ReportPA.dll " /S
'%WINDIR%\syswow64\regsvr32.exe' "%ProgramFiles(x86)%\IEMIS\navigate\cycle\report\ReportPB.dll " /S
'%WINDIR%\syswow64\regsvr32.exe' "%ProgramFiles(x86)%\IEMIS\navigate\cycle\report\ReportQC.dll " /S
'%WINDIR%\syswow64\regsvr32.exe' "%ProgramFiles(x86)%\IEMIS\navigate\cycle\report\ReportSALE.dll " /S
'%WINDIR%\syswow64\regsvr32.exe' "%ProgramFiles(x86)%\IEMIS\navigate\cycle\report\ReportSC.dll " /S
'%WINDIR%\syswow64\regsvr32.exe' "%ProgramFiles(x86)%\IEMIS\navigate\cycle\report\ReportSS.dll " /S
'%WINDIR%\syswow64\regsvr32.exe' "%ProgramFiles(x86)%\IEMIS\navigate\cycle\IECombox.ocx " /S
'%WINDIR%\syswow64\regsvr32.exe' "%ProgramFiles(x86)%\IEMIS\navigate\cycle\IEVSGrid.ocx " /S
'%WINDIR%\syswow64\regsvr32.exe' "%ProgramFiles(x86)%\IEMIS\navigate\cycle\IEDate.ocx " /S
'%WINDIR%\syswow64\regsvr32.exe' "%ProgramFiles(x86)%\IEMIS\navigate\cycle\IeLableN.ocx " /S
'%WINDIR%\syswow64\regsvr32.exe' "%ProgramFiles(x86)%\IEMIS\navigate\cycle\IEMulTab.ocx " /S
'%WINDIR%\syswow64\regsvr32.exe' "%ProgramFiles(x86)%\IEMIS\navigate\cycle\IEPicture.ocx " /S
'%WINDIR%\syswow64\regsvr32.exe' "%ProgramFiles(x86)%\IEMIS\navigate\cycle\IEPng.ocx " /S
'%WINDIR%\syswow64\regsvr32.exe' "%ProgramFiles(x86)%\IEMIS\navigate\cycle\IEQuery.ocx " /S
'%WINDIR%\syswow64\regsvr32.exe' "%ProgramFiles(x86)%\IEMIS\navigate\cycle\IETree.ocx " /S
'%WINDIR%\syswow64\regsvr32.exe' "%ProgramFiles(x86)%\IEMIS\navigate\cycle\report\ReportMT.dll " /S
'%WINDIR%\syswow64\regsvr32.exe' "%ProgramFiles(x86)%\IEMIS\navigate\cycle\report\ReportWI.dll " /S
'%WINDIR%\syswow64\regsvr32.exe' "%ProgramFiles(x86)%\IEMIS\navigate\cycle\report\ReportMA.dll " /S
'%WINDIR%\syswow64\regsvr32.exe' "%ProgramFiles(x86)%\IEMIS\navigate\cycle\report\ReportABase.dll " /S
'%WINDIR%\syswow64\regsvr32.exe' "%ProgramFiles(x86)%\IEMIS\client\IECnts2N.ocx " /S
'%WINDIR%\syswow64\regsvr32.exe' "%ProgramFiles(x86)%\IEMIS\client\IEList2N.ocx " /S
'%WINDIR%\syswow64\regsvr32.exe' "%ProgramFiles(x86)%\IEMIS\navigate\cycle\report\MainForm.dll " /S
'%WINDIR%\syswow64\regsvr32.exe' "%ProgramFiles(x86)%\IEMIS\navigate\cycle\report\Board.dll " /S
'%WINDIR%\syswow64\regsvr32.exe' "%ProgramFiles(x86)%\IEMIS\navigate\cycle\report\ClientChart.dll " /S
'%WINDIR%\syswow64\regsvr32.exe' "%ProgramFiles(x86)%\IEMIS\navigate\cycle\report\ClientHypLink.dll " /S
'%WINDIR%\syswow64\regsvr32.exe' "%ProgramFiles(x86)%\IEMIS\navigate\cycle\report\Flow.dll " /S
'%WINDIR%\syswow64\regsvr32.exe' "%ProgramFiles(x86)%\IEMIS\navigate\cycle\report\ReportAC.dll " /S
'%WINDIR%\syswow64\regsvr32.exe' "%ProgramFiles(x86)%\IEMIS\navigate\cycle\report\ReportIV.dll " /S
'%WINDIR%\syswow64\regsvr32.exe' "%ProgramFiles(x86)%\IEMIS\navigate\cycle\report\ReportArck.dll " /S
'%WINDIR%\syswow64\regsvr32.exe' "%ProgramFiles(x86)%\IEMIS\navigate\cycle\report\ReportBO.dll " /S
'%WINDIR%\syswow64\regsvr32.exe' "%ProgramFiles(x86)%\IEMIS\navigate\cycle\report\ReportCH.dll " /S
'%WINDIR%\syswow64\regsvr32.exe' "%ProgramFiles(x86)%\IEMIS\navigate\cycle\report\ReportCO.dll " /S
'%WINDIR%\syswow64\regsvr32.exe' "%ProgramFiles(x86)%\IEMIS\navigate\cycle\report\ReportCU.dll " /S
'%WINDIR%\syswow64\regsvr32.exe' "%ProgramFiles(x86)%\IEMIS\navigate\cycle\report\ReportEG.dll " /S
'%WINDIR%\syswow64\regsvr32.exe' "%ProgramFiles(x86)%\IEMIS\navigate\cycle\report\ReportEM.dll " /S
'%WINDIR%\syswow64\regsvr32.exe' "%ProgramFiles(x86)%\IEMIS\navigate\cycle\report\ReportLib.dll " /S
'%WINDIR%\syswow64\regsvr32.exe' "%ProgramFiles(x86)%\IEMIS\navigate\cycle\VBControl.ocx " /S