Trojan.MulDrop22.87

Техническая информация

Для обеспечения автозапуска и распространения

Модифицирует следующие ключи реестра

[HKLM\Software\Classes\PROTOCOLS\Handler\touchenex] 'CLSID' = '{ae2e4412-b293-11ed-b067-000c2936bd4f}'

Изменения в файловой системе

Создает следующие файлы

%ProgramFiles%\keysharp\crossexclient_64.sig
%ProgramFiles%\keysharp\kscertrelay\kscrc2activex.dll
%ProgramFiles%\keysharp\kscertrelay\setupprogram.exe
%ProgramFiles%\keysharp\kscertrelay\cksetup32.exe
%ProgramFiles%\keysharp\kscertrelay\touchenkeycs.dll
%ProgramFiles%\keysharp\kscertrelay\keysharpcrypto.dll
%ProgramFiles%\keysharp\kscertrelay\kscertrelayqr.exe
%ProgramFiles%\keysharp\kscertrelay\qrcodeencodedll.dll
%ProgramFiles%\keysharp\kscertrelay\ca.der
%ProgramFiles%\keysharp\kscertrelay\certadm.dll
%ProgramFiles%\keysharp\kscertrelay\certutil.exe
%ProgramFiles%\keysharp\_rca_digicert_root_g4.cer
%ProgramFiles%\keysharp\kscertrelay\kscertrelay.exe
%ProgramFiles%\keysharp\kscertrelay\npkscertrelay.dll
%ProgramFiles%\keysharp\kscertrelay\kscertrelaydll.dll
%ProgramFiles%\raonsecure\bridge\crossex\touchenex\1.0.1.1547\digicert_root_g4.cer
%ProgramFiles%\raonsecure\bridge\crossex\touchenex\1.0.1.1547\crossexprotocol.dll
%ProgramFiles%\raonsecure\bridge\crossex\touchenex\1.0.1.1547\crossexchrome.exe
%ProgramFiles%\raonsecure\bridge\crossex\touchenex\1.0.1.1547\crossexfirefox.dll
%ProgramFiles%\raonsecure\bridge\crossex\touchenex\1.0.1.1547\npraontouchenex.dll
%ProgramFiles%\raonsecure\bridge\crossex\touchenex\1.0.1.1547\crossex.sig
%ProgramFiles%\raonsecure\bridge\crossex\touchenex\1.0.1.1547\kr.co.raon.touchenex.json
%ProgramFiles%\raonsecure\bridge\crossex\touchenex\1.0.1.1547\kr.co.raon.touchenex.firefox.json
%ProgramFiles%\raonsecure\bridge\crossex\touchenex\uninstallcrossex.exe
%ProgramFiles%\keysharp\kscertrelay\crc2string_eng.dll
%ProgramFiles%\keysharp\kscertrelay\crc2string_kor.dll
%ProgramFiles%\keysharp\_rca_digicert_root.cer
%ProgramFiles%\keysharp\_rca_verisign_root.cer
%ProgramFiles%\keysharp\_rca_verisign_class.cer
%ProgramFiles%\keysharp\kscertrelay_installer_64bit.exe
%ProgramFiles%\keysharp\raon_touchenex_install-x64.exe
%ProgramFiles%\keysharp\kscertrelay_nxinstaller_64bit.exe
%ProgramFiles%\raonsecure\keysharp nxwireless cert\kscertrelay_installer_64bit.exe
%ProgramFiles%\raonsecure\keysharp nxwireless cert\raon_touchenex_install-x64.exe
%ProgramFiles%\raonsecure\keysharp nxwireless cert\crossexclient_64.sig
%ProgramFiles%\keysharp\kscertrelay.exe
%ProgramFiles%\keysharp\kscrc2activex.dll
%ProgramFiles%\keysharp\cksetup32.exe
%ProgramFiles%\keysharp\touchenkeycs.dll
%ProgramFiles%\keysharp\kscertrelayqr.exe
%ProgramFiles%\keysharp\kscertrelaymain.dll
%ProgramFiles%\keysharp\setupprogram.exe
%ProgramFiles%\keysharp\qrcodeencodedll.dll
%ProgramFiles%\keysharp\ca.der
%ProgramFiles%\keysharp\certadm.dll
%ProgramFiles%\keysharp\certutil.exe
%ProgramFiles%\keysharp\npkscertrelay.dll
%ProgramFiles%\keysharp\crc2string_eng.dll
%ProgramFiles%\keysharp\crc2string_kor.dll
%ProgramFiles%\keysharp\kscertrelaydll.dll
%ProgramFiles%\keysharp\_rca_globalsign_root.cer
%ProgramFiles%\keysharp\_rca_thawte_root.cer
%ProgramFiles%\keysharp\_rca_thawte_time.cer
%ProgramFiles%\keysharp\keysharpcrypto.dll
%TEMP%\nslb52c.tmp\system.dll
%ProgramFiles%\raonsecure\keysharp nxwireless cert\kscertrelaymain.dll

Удаляет следующие файлы

%ProgramFiles%\keysharp\kscertrelay\ca.der
%ProgramFiles%\raonsecure\keysharp nxwireless cert\raon_touchenex_install-x64.exe
%TEMP%\nslb52c.tmp\system.dll
%ProgramFiles%\raonsecure\bridge\crossex\touchenex\1.0.1.1547\digicert_root_g4.cer
%ProgramFiles%\keysharp\_rca_digicert_root_g4.cer
%ProgramFiles%\keysharp\_rca_digicert_root.cer
%ProgramFiles%\keysharp\_rca_verisign_root.cer
%ProgramFiles%\keysharp\_rca_verisign_class.cer
%ProgramFiles%\keysharp\_rca_thawte_time.cer
%ProgramFiles%\keysharp\_rca_thawte_root.cer
%ProgramFiles%\keysharp\_rca_globalsign_root.cer
%ProgramFiles%\keysharp\kscertrelaydll.dll
%ProgramFiles%\keysharp\crc2string_kor.dll
%ProgramFiles%\keysharp\crc2string_eng.dll
%ProgramFiles%\keysharp\npkscertrelay.dll
%ProgramFiles%\keysharp\certutil.exe
%ProgramFiles%\keysharp\certadm.dll
%ProgramFiles%\keysharp\ca.der
%ProgramFiles%\keysharp\qrcodeencodedll.dll
%ProgramFiles%\keysharp\keysharpcrypto.dll
%ProgramFiles%\keysharp\setupprogram.exe
%ProgramFiles%\keysharp\kscertrelayqr.exe
%ProgramFiles%\keysharp\touchenkeycs.dll
%ProgramFiles%\keysharp\cksetup32.exe
%ProgramFiles%\keysharp\kscrc2activex.dll
%ProgramFiles%\keysharp\kscertrelay.exe
%ProgramFiles%\keysharp\kscertrelay\certadm.dll
%ProgramFiles%\keysharp\kscertrelay\certutil.exe
%ProgramFiles%\raonsecure\keysharp nxwireless cert\kscertrelay_installer_64bit.exe
%ProgramFiles%\raonsecure\keysharp nxwireless cert\crossexclient_64.sig

Другое

Добавляет корневой сертификат

Создает и запускает на исполнение

'%ProgramFiles%\keysharp\kscertrelay_nxinstaller_64bit.exe' -i c
'%ProgramFiles%\raonsecure\keysharp nxwireless cert\kscertrelay_installer_64bit.exe' /s
'%ProgramFiles%\keysharp\setupprogram.exe' -i c u
'%ProgramFiles%\raonsecure\keysharp nxwireless cert\raon_touchenex_install-x64.exe' /S

Запускает на исполнение

'%WINDIR%\syswow64\regsvr32.exe' "%ProgramFiles%\RaonSecure\bridge\CrossEX\touchenex\1.0.1.1547\CrossEXProtocol.dll" /S
'<SYSTEM32>\regsvr32.exe' "%ProgramFiles%\RaonSecure\bridge\CrossEX\touchenex\1.0.1.1547\CrossEXProtocol.dll" /S