Trojan.MulDrop21.47822

Техническая информация

Вредоносные функции

Запускает на исполнение

'<SYSTEM32>\taskkill.exe' /F /IM AYCRTSrv.ayc
'<SYSTEM32>\taskkill.exe' /F /IM AYCAgentSrv.ayc
'<SYSTEM32>\taskkill.exe' /F /IM AYCUpdSrv.ayc
'<SYSTEM32>\taskkill.exe' /F /IM AYCAgent.ayc
'<SYSTEM32>\taskkill.exe' /F /IM AYIASrv.exe
'<SYSTEM32>\taskkill.exe' /F /IM AYIA.exe
'<SYSTEM32>\taskkill.exe' /F /IM AYPMSSrv.exe
'<SYSTEM32>\taskkill.exe' /F /IM AYMPISrv.exe
'<SYSTEM32>\taskkill.exe' /F /IM AYCHost.ayc
'<SYSTEM32>\taskkill.exe' /F /IM AYPMS.exe
'<SYSTEM32>\taskkill.exe' /F /IM AYMPI.exe
'<SYSTEM32>\taskkill.exe' /F /IM AYCMain.ayc

Изменения в файловой системе

Создает следующие файлы

%TEMP%\nsq3eb5.tmd\system.dll
%TEMP%\rmalyac.exe
%TEMP%\rmclient.exe
%TEMP%\forceremover.exe

Удаляет следующие файлы

%TEMP%\rmalyac.exe
%TEMP%\rmclient.exe
%TEMP%\forceremover.exe
%TEMP%\nsq3eb5.tmd\system.dll

Другое

Ищет следующие окна

ClassName: '' WindowName: ''

Создает и запускает на исполнение

'%TEMP%\rmalyac.exe'
'%TEMP%\rmclient.exe' -cmd 15
'%TEMP%\forceremover.exe'

Запускает на исполнение

'<SYSTEM32>\cmd.exe' /c fltmc unload EstRtwIFDrv
'<SYSTEM32>\cmd.exe' /c "del /s /f /q "%ALLUSERSPROFILE%\ESTsoft\ASM"
'<SYSTEM32>\cmd.exe' /c "del /s /f /q "%ALLUSERSPROFILE%\ESTsoft\ALYacIntegrationAgent"
'<SYSTEM32>\cmd.exe' /c "del /s /f /q "%ALLUSERSPROFILE%\ESTsoft\ALYacMyPCInspector"
'<SYSTEM32>\cmd.exe' /c "del /s /f /q "%ALLUSERSPROFILE%\ESTsoft\ALYacPatchManagement"
'<SYSTEM32>\cmd.exe' /c rd /s /q "%ProgramFiles%\ESTsoft\ALYac"
'<SYSTEM32>\cmd.exe' /c rd /s /q "%ProgramFiles%\ESTsoft\ASM"
'<SYSTEM32>\cmd.exe' /c rd /s /q "%ALLUSERSPROFILE%\ESTsoft\ALYac"
'<SYSTEM32>\cmd.exe' /c rd /s /q "%ALLUSERSPROFILE%\ESTsoft\ASM"
'<SYSTEM32>\cmd.exe' /c rd /s /q "%ProgramFiles%\ESTsoft\ALYacIntegrationAgent"
'<SYSTEM32>\cmd.exe' /c rd /s /q "%ALLUSERSPROFILE%\ESTsoft\ALYacIntegrationAgent"
'<SYSTEM32>\cmd.exe' /c rd /s /q "%ProgramFiles%\ESTsoft\ALYacMyPCInspector"
'<SYSTEM32>\cmd.exe' /c rd /s /q "%ProgramFiles%\ESTsoft\ALYacPatchManagement"
'<SYSTEM32>\cmd.exe' /c rd /s /q "%ALLUSERSPROFILE%\ESTsoft\ALYacMyPCInspector"
'<SYSTEM32>\cmd.exe' /c sc delete ALYac_AgentSrv
'<SYSTEM32>\cmd.exe' /c rd /s /q "%ALLUSERSPROFILE%\ESTsoft\ALYacPatchManagement"
'<SYSTEM32>\reg.exe' delete "HKEY_LOCAL_MACHINE\SOFTWARE\ESTsoft\ALYac" /f
'<SYSTEM32>\cmd.exe' /c reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\ESTsoft\ALYacIntegrationAgent" /f
'<SYSTEM32>\reg.exe' delete "HKEY_LOCAL_MACHINE\SOFTWARE\ESTsoft\ALYacIntegrationAgent" /f
'<SYSTEM32>\cmd.exe' /c reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\ESTsoft\ALYacMyPCInspector" /f
'<SYSTEM32>\reg.exe' delete "HKEY_LOCAL_MACHINE\SOFTWARE\ESTsoft\ALYacMyPCInspector" /f
'<SYSTEM32>\cmd.exe' /c reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\ESTsoft\ALYacPatchManagement" /f
'<SYSTEM32>\reg.exe' delete "HKEY_LOCAL_MACHINE\SOFTWARE\ESTsoft\ALYacPatchManagement" /f
'<SYSTEM32>\cmd.exe' /c reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\ESTsoft\ALYac" /f /reg:64
'<SYSTEM32>\reg.exe' delete "HKEY_LOCAL_MACHINE\SOFTWARE\ESTsoft\ALYac" /f /reg:64
'<SYSTEM32>\cmd.exe' /c reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\ESTsoft\ALYacIntegrationAgent" /f /reg:64
'<SYSTEM32>\reg.exe' delete "HKEY_LOCAL_MACHINE\SOFTWARE\ESTsoft\ALYacIntegrationAgent" /f /reg:64
'<SYSTEM32>\cmd.exe' /c reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\ESTsoft\ALYacMyPCInspector" /f /reg:64
'<SYSTEM32>\reg.exe' delete "HKEY_LOCAL_MACHINE\SOFTWARE\ESTsoft\ALYacMyPCInspector" /f /reg:64
'<SYSTEM32>\cmd.exe' /c "del /s /f /q "%ProgramFiles%\ESTsoft\ASM"
'<SYSTEM32>\cmd.exe' /c "del /s /f /q "%ALLUSERSPROFILE%\ESTsoft\ALYac"
'<SYSTEM32>\cmd.exe' /c "del /s /f /q "%ProgramFiles%\ESTsoft\ALYac"
'<SYSTEM32>\cmd.exe' /c "del /s /f /q "%ProgramFiles%\ESTsoft\ALYacIntegrationAgent"
'<SYSTEM32>\cmd.exe' /c "del /s /f /q "%ProgramFiles%\ESTsoft\ALYacPatchManagement"
'<SYSTEM32>\cmd.exe' /c fltmc unload EstPMSRtw
'<SYSTEM32>\fltmc.exe' unload EstPMSRtw
'<SYSTEM32>\cmd.exe' /c taskkill /F /IM AYCRTSrv.ayc
'<SYSTEM32>\cmd.exe' /c taskkill /F /IM AYCAgentSrv.ayc
'<SYSTEM32>\cmd.exe' /c taskkill /F /IM AYCUpdSrv.ayc
'<SYSTEM32>\cmd.exe' /c taskkill /F /IM AYCAgent.ayc
'<SYSTEM32>\cmd.exe' /c taskkill /F /IM AYIASrv.exe
'<SYSTEM32>\cmd.exe' /c taskkill /F /IM AYIA.exe
'<SYSTEM32>\cmd.exe' /c taskkill /F /IM AYPMSSrv.exe
'<SYSTEM32>\cmd.exe' /c taskkill /F /IM AYMPISrv.exe
'<SYSTEM32>\cmd.exe' /c taskkill /F /IM AYCHost.ayc
'<SYSTEM32>\cmd.exe' /c taskkill /F /IM AYPMS.exe
'<SYSTEM32>\cmd.exe' /c taskkill /F /IM AYMPI.exe
'<SYSTEM32>\cmd.exe' /c reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\ESTsoft\ALYacPatchManagement" /f /reg:64
'<SYSTEM32>\cmd.exe' /c reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\ESTsoft\ALYac" /f
'<SYSTEM32>\cmd.exe' /c taskkill /F /IM AYCMain.ayc
'<SYSTEM32>\cmd.exe' /c sc delete ALYac_RTSrv
'<SYSTEM32>\sc.exe' delete ALYac_RTSrv
'<SYSTEM32>\cmd.exe' /c sc delete ALYac_UpdSrv
'<SYSTEM32>\sc.exe' delete ALYac_UpdSrv
'<SYSTEM32>\cmd.exe' /c sc delete ALYac_IASrv
'<SYSTEM32>\sc.exe' delete ALYac_IASrv
'<SYSTEM32>\cmd.exe' /c sc delete ALYac_PMSSrv
'<SYSTEM32>\sc.exe' delete ALYac_PMSSrv
'<SYSTEM32>\cmd.exe' /c sc delete ALYac_MPISrv
'<SYSTEM32>\sc.exe' delete ALYac_MPISrv
'<SYSTEM32>\cmd.exe' /c sc delete ALYac_WSSrv
'<SYSTEM32>\sc.exe' delete ALYac_WSSrv
'<SYSTEM32>\cmd.exe' /c "del /s /f /q "%ProgramFiles%\ESTsoft\ALYacMyPCInspector"
'<SYSTEM32>\fltmc.exe' unload EstRtwIFDrv
'<SYSTEM32>\sc.exe' delete ALYac_AgentSrv
'<SYSTEM32>\reg.exe' delete "HKEY_LOCAL_MACHINE\SOFTWARE\ESTsoft\ALYacPatchManagement" /f /reg:64