Trojan.MulDrop23.55639

Техническая информация

Для обеспечения автозапуска и распространения

Модифицирует следующие ключи реестра

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce] 'tv_enua' = 'RunDll32 advpack.dll,LaunchINFSection %WINDIR%\INF\tv_enua.inf, RemoveCabinet'

Изменения в файловой системе

Создает следующие файлы

%TEMP%\nslff84.tmp\uac.dll
%TEMP%\runtimes\msagent.exe
%TEMP%\runtimes\tv_enua.exe
%TEMP%\bonzi\run.vbs
%WINDIR%\msagent\chars\bonzi.acs
%TEMP%\nslff84.tmp\nsexec.dll
%TEMP%\ixp001.tmp\tvenuax.dll
%TEMP%\ixp001.tmp\tv_enua.dll
%TEMP%\ixp000.tmp\agt0409.dll
%TEMP%\ixp000.tmp\agentdp2.dll
%TEMP%\ixp000.tmp\agentdpv.dll
%TEMP%\ixp000.tmp\agentmpx.dll
%TEMP%\ixp000.tmp\mslwvtts.dll
%TEMP%\ixp000.tmp\agentanm.dll
%TEMP%\ixp000.tmp\agentsr.dll
%TEMP%\books\bonzi and the alpha-net\sp007.gif
%TEMP%\ixp000.tmp\agentctl.dll
%TEMP%\books\bonzi and the alpha-net\sp006.gif
%TEMP%\books\bonzi and the alpha-net\page11.jpg
%TEMP%\books\bonzi and the alpha-net\page5.jpg
%TEMP%\books\bonzi and the alpha-net\page6.jpg
%TEMP%\books\bonzi and the alpha-net\page7.jpg
%TEMP%\books\bonzi and the alpha-net\page8.jpg
%TEMP%\books\bonzi and the alpha-net\page9.jpg
%TEMP%\books\bonzi and the alpha-net\page10.jpg
%TEMP%\books\bonzi and the alpha-net\page12.jpg
%TEMP%\books\bonzi and the alpha-net\sp004.gif
%TEMP%\books\bonzi and the alpha-net\page13.jpg
%TEMP%\books\bonzi and the alpha-net\page14.jpg
%TEMP%\books\bonzi and the alpha-net\page15.jpg
%TEMP%\books\bonzi and the alpha-net\page16.jpg
%TEMP%\books\bonzi and the alpha-net\sp002.gif
%TEMP%\books\bonzi and the alpha-net\sp003.gif
%TEMP%\books\bonzi and the alpha-net\sp005.gif
%TEMP%\ixp000.tmp\agentpsh.dll
%TEMP%\ixp000.tmp\agentsvr.exe
%TEMP%\ixp001.tmp\tv_enua.hlp
%WINDIR%\lhsp\help\setb2ec.tmp
%WINDIR%\fonts\setb30c.tmp
%WINDIR%\inf\setb31c.tmp
%WINDIR%\syswow64\setb33d.tmp
%WINDIR%\temp\oldb357.tmp
%WINDIR%\msagent\setb28e.tmp
%WINDIR%\lhsp\tv\setb2bc.tmp
%WINDIR%\msagent\setb389.tmp
%WINDIR%\msagent\setb485.tmp
%WINDIR%\msagent\setb4a5.tmp
%WINDIR%\inf\setb4c6.tmp
%WINDIR%\msagent\setb543.tmp
%WINDIR%\help\setb5b2.tmp
%WINDIR%\msagent\setb3b8.tmp
%WINDIR%\msagent\setb455.tmp
%WINDIR%\msagent\setb27d.tmp
%WINDIR%\lhsp\tv\setb24e.tmp
%WINDIR%\msagent\setb22e.tmp
%TEMP%\ixp001.tmp\andmoipa.ttf
%TEMP%\ixp000.tmp\agt0409.hlp
%TEMP%\ixp001.tmp\msvcp50.dll
%TEMP%\ixp000.tmp\agtctl15.tlb
%TEMP%\ixp000.tmp\agteula.txt
%TEMP%\ixp000.tmp\agtinst.inf
%TEMP%\ixp001.tmp\tv_enua.inf
%TEMP%\ixp000.tmp\agt20.inf
%TEMP%\ixp000.tmp\advpack.dll
%TEMP%\ixp001.tmp\advpack.dll
%TEMP%\ixp000.tmp\w95inf32.dll
%TEMP%\ixp000.tmp\w95inf16.dll
%TEMP%\ixp001.tmp\w95inf32.dll
%TEMP%\ixp001.tmp\w95inf16.dll
%TEMP%\ixp001.tmp\msvcirt.dll
%TEMP%\books\bonzi and the alpha-net\page4.jpg
%WINDIR%\msagent\intl\setb601.tmp
%TEMP%\books\bonzi and the alpha-net\page0.jpg
%TEMP%\books\bonz and the treasure chest\page2.jpg
%TEMP%\mscomctl.ocx
%TEMP%\msinet.ocx
%TEMP%\msvbvm60.dll
%TEMP%\msvcrt.dll
%TEMP%\mswinsck.ocx
%TEMP%\odkob32.dll
%TEMP%\p001.nbd-sr
%TEMP%\snd2.wav
%TEMP%\racreg32.dll
%TEMP%\reg.nbd
%TEMP%\regicon.ocx
%TEMP%\s1.nbd
%TEMP%\sites.nbd
%TEMP%\snd1.wav
%TEMP%\j3.nbd-sr
%TEMP%\p001.nbd
%TEMP%\j3.nbd
%TEMP%\bonzictb.dll
%LOCALAPPDATA%\uninst.exe
%TEMP%\activeskin.ocx
%TEMP%\autprx32.dll
%TEMP%\bonzibdy.vbw
%TEMP%\bonzibdy_35.exe
%TEMP%\bonzicheckers.ocx
%TEMP%\chord.wav
%TEMP%\j2.nbd
%TEMP%\empop3.dll
%TEMP%\emsmtp.dll
%TEMP%\favicon.ico
%TEMP%\intro2.wav
%TEMP%\j001.nbd
%TEMP%\j001.nbd-sr
%TEMP%\j2.nbd-sr
%TEMP%\speedup.ico
%TEMP%\ssa3d30.ocx
%TEMP%\sscala32.ocx
%TEMP%\books\bonz and the treasure chest\cb003.gif
%TEMP%\books\bonz and the treasure chest\cb004.gif
%TEMP%\books\bonz and the treasure chest\cb005.gif
%TEMP%\books\bonz and the treasure chest\cb006.gif
%TEMP%\books\bonz and the treasure chest\cb007.gif
%TEMP%\books\bonz and the treasure chest\cb001.gif
%TEMP%\books\bonz and the treasure chest\cb002.gif
%TEMP%\books\bonz and the treasure chest\cb008.gif
%TEMP%\books\bonz and the treasure chest\cb011.gif
%TEMP%\books\bonz and the treasure chest\cb012.gif
%TEMP%\books\bonz and the treasure chest\cb013.gif
%TEMP%\books\bonz and the treasure chest\cb014.gif
%TEMP%\books\bonz and the treasure chest\cb015.gif
%TEMP%\books\bonz and the treasure chest\cb009.gif
%TEMP%\books\bonz and the treasure chest\cb010.gif
%TEMP%\books\bonz and the polizoof\page14.jpg
%TEMP%\books\bonz and the polizoof\page13.jpg
%TEMP%\books\bonz and the polizoof\page12.jpg
%TEMP%\sstabs2.ocx
%TEMP%\ssubtmr6.dll
%TEMP%\t001.nbd
%TEMP%\t001.nbd-sr
%TEMP%\t2.nbd
%TEMP%\t3.nbd
%TEMP%\sscalb32.ocx
%TEMP%\t3.nbd-sr
%TEMP%\bg\bg2.bmp
%TEMP%\bg\bg3.bmp
%TEMP%\books\bonz and the polizoof\page0.jpg
%TEMP%\books\bonz and the polizoof\page1.jpg
%TEMP%\books\bonz and the polizoof\page10.jpg
%TEMP%\books\bonz and the polizoof\page11.jpg
%TEMP%\bg\bg1.bmp
%TEMP%\books\bonzi and the alpha-net\book
%WINDIR%\msagent\setb630.tmp

Удаляет следующие файлы

%TEMP%\nslff84.tmp\uac.dll
%TEMP%\ixp000.tmp\agentdpv.dll
%TEMP%\ixp000.tmp\agentmpx.dll
%TEMP%\ixp000.tmp\mslwvtts.dll
%TEMP%\ixp000.tmp\agentanm.dll
%TEMP%\ixp000.tmp\agentsr.dll
%TEMP%\ixp000.tmp\agt0409.dll
%TEMP%\ixp000.tmp\agentpsh.dll
%TEMP%\ixp000.tmp\agentsvr.exe
%TEMP%\ixp000.tmp\agt0409.hlp
%TEMP%\ixp000.tmp\agtctl15.tlb
%TEMP%\ixp000.tmp\agteula.txt
%TEMP%\ixp000.tmp\agtinst.inf
%TEMP%\ixp000.tmp\agt20.inf
%TEMP%\ixp000.tmp\agentdp2.dll
%TEMP%\ixp000.tmp\advpack.dll
%TEMP%\ixp000.tmp\w95inf16.dll
%TEMP%\ixp001.tmp\tvenuax.dll
%TEMP%\ixp001.tmp\tv_enua.dll
%TEMP%\ixp001.tmp\tv_enua.hlp
%TEMP%\ixp001.tmp\tv_enua.inf
%TEMP%\ixp001.tmp\andmoipa.ttf
%TEMP%\ixp001.tmp\msvcp50.dll
%TEMP%\ixp001.tmp\msvcirt.dll
%TEMP%\ixp001.tmp\advpack.dll
%TEMP%\ixp001.tmp\w95inf32.dll
%TEMP%\ixp001.tmp\w95inf16.dll
%WINDIR%\temp\oldb357.tmp
%TEMP%\nslff84.tmp\nsexec.dll
%TEMP%\ixp000.tmp\w95inf32.dll
%TEMP%\ixp000.tmp\agentctl.dll

Перемещает следующие файлы

%WINDIR%\msagent\setb22e.tmp в %WINDIR%\msagent\agentctl.dll
%WINDIR%\help\setb5b2.tmp в %WINDIR%\help\agt0409.hlp
%WINDIR%\msagent\setb543.tmp в %WINDIR%\msagent\mslwvtts.dll
%WINDIR%\inf\setb4c6.tmp в %WINDIR%\inf\agtinst.inf
%WINDIR%\msagent\setb4a5.tmp в %WINDIR%\msagent\agentpsh.dll
%WINDIR%\msagent\setb485.tmp в %WINDIR%\msagent\agentsr.dll
%WINDIR%\msagent\setb455.tmp в %WINDIR%\msagent\agentanm.dll
%WINDIR%\msagent\setb3b8.tmp в %WINDIR%\msagent\agentmpx.dll
%WINDIR%\msagent\intl\setb601.tmp в %WINDIR%\msagent\intl\agt0409.dll
%WINDIR%\msagent\setb389.tmp в %WINDIR%\msagent\agentsvr.exe
%WINDIR%\inf\setb31c.tmp в %WINDIR%\inf\tv_enua.inf
%WINDIR%\fonts\setb30c.tmp в %WINDIR%\fonts\andmoipa.ttf
%WINDIR%\lhsp\help\setb2ec.tmp в %WINDIR%\lhsp\help\tv_enua.hlp
%WINDIR%\lhsp\tv\setb2bc.tmp в %WINDIR%\lhsp\tv\tvenuax.dll
%WINDIR%\lhsp\tv\setb24e.tmp в %WINDIR%\lhsp\tv\tv_enua.dll
%WINDIR%\msagent\setb28e.tmp в %WINDIR%\msagent\agentdp2.dll
%WINDIR%\msagent\setb27d.tmp в %WINDIR%\msagent\agentdpv.dll
%WINDIR%\syswow64\setb33d.tmp в %WINDIR%\syswow64\msvcp50.dll
%WINDIR%\msagent\setb630.tmp в %WINDIR%\msagent\agtctl15.tlb

Другое

Создает и запускает на исполнение

'%WINDIR%\syswow64\cscript.exe' "%TEMP%\Bonzi\run.vbs" //e:vbscript //B //NOLOGO
'%TEMP%\runtimes\msagent.exe' /Q
'%TEMP%\runtimes\tv_enua.exe' /Q
'%WINDIR%\msagent\agentsvr.exe' /regserver
'%WINDIR%\syswow64\regsvr32.exe' /s "%WINDIR%\msagent\AgentPsh.dll"' (со скрытым окном)
'%WINDIR%\syswow64\regsvr32.exe' /s "%WINDIR%\msagent\AgentSR.dll"' (со скрытым окном)
'%WINDIR%\syswow64\regsvr32.exe' /s "%WINDIR%\msagent\AgentMPx.dll"' (со скрытым окном)
'%WINDIR%\syswow64\regsvr32.exe' /s "%WINDIR%\msagent\AgentDP2.dll"' (со скрытым окном)
'%WINDIR%\syswow64\grpconv.exe' -o' (со скрытым окном)
'%WINDIR%\syswow64\regsvr32.exe' /s "%WINDIR%\msagent\mslwvtts.dll"' (со скрытым окном)
'%WINDIR%\syswow64\regsvr32.exe' /s "%WINDIR%\msagent\AgentCtl.dll"' (со скрытым окном)
'%WINDIR%\syswow64\regsvr32.exe' /s "%WINDIR%\msagent\AgentDPv.dll"' (со скрытым окном)
'%WINDIR%\syswow64\regsvr32.exe' /s %WINDIR%\lhsp\tv\tv_enua.dll' (со скрытым окном)
'%TEMP%\runtimes\tv_enua.exe' /Q' (со скрытым окном)
'%TEMP%\runtimes\msagent.exe' /Q' (со скрытым окном)
'%WINDIR%\syswow64\cscript.exe' "%TEMP%\Bonzi\run.vbs" //e:vbscript //B //NOLOGO' (со скрытым окном)
'%WINDIR%\syswow64\regsvr32.exe' /s %WINDIR%\lhsp\tv\tvenuax.dll' (со скрытым окном)
'%WINDIR%\msagent\agentsvr.exe' /regserver' (со скрытым окном)

Запускает на исполнение

'%WINDIR%\syswow64\regsvr32.exe' /s %WINDIR%\lhsp\tv\tv_enua.dll
'%WINDIR%\syswow64\regsvr32.exe' /s "%WINDIR%\msagent\AgentCtl.dll"
'%WINDIR%\syswow64\regsvr32.exe' /s %WINDIR%\lhsp\tv\tvenuax.dll
'%WINDIR%\syswow64\grpconv.exe' -o
'%WINDIR%\syswow64\regsvr32.exe' /s "%WINDIR%\msagent\AgentDPv.dll"
'%WINDIR%\syswow64\regsvr32.exe' /s "%WINDIR%\msagent\mslwvtts.dll"
'%WINDIR%\syswow64\regsvr32.exe' /s "%WINDIR%\msagent\AgentDP2.dll"
'%WINDIR%\syswow64\regsvr32.exe' /s "%WINDIR%\msagent\AgentMPx.dll"
'%WINDIR%\syswow64\regsvr32.exe' /s "%WINDIR%\msagent\AgentSR.dll"
'%WINDIR%\syswow64\regsvr32.exe' /s "%WINDIR%\msagent\AgentPsh.dll"

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней