Trojan.MulDrop24.57255

Техническая информация

Для обеспечения автозапуска и распространения

Устанавливает следующие настройки сервисов

[HKLM\System\CurrentControlSet\Services\IPTV Channel Browser 6.6] 'Start' = '00000002'
[HKLM\System\CurrentControlSet\Services\IPTV Channel Browser 6.6] 'ImagePath' = '%ALLUSERSPROFILE%\IPTV Channel Browser 6.6\IPTV Channel Browser 6.6.exe'

Создает следующие сервисы

'IPTV Channel Browser 6.6' %ALLUSERSPROFILE%\IPTV Channel Browser 6.6\IPTV Channel Browser 6.6.exe

Изменения в файловой системе

Создает следующие файлы

%TEMP%\is-bocl3.tmp\is-hub2e.tmp
%LOCALAPPDATA%\js csv file read write\unins000.dat
%LOCALAPPDATA%\js csv file read write\is-drcfv.tmp
%LOCALAPPDATA%\js csv file read write\filters\is-7rcci.tmp
%LOCALAPPDATA%\js csv file read write\filters\is-gng4n.tmp
%LOCALAPPDATA%\js csv file read write\is-vujsj.tmp
%LOCALAPPDATA%\js csv file read write\is-0rts7.tmp
%LOCALAPPDATA%\js csv file read write\is-31s97.tmp
%LOCALAPPDATA%\js csv file read write\is-eluol.tmp
%LOCALAPPDATA%\js csv file read write\is-noqcd.tmp
%LOCALAPPDATA%\js csv file read write\is-h57id.tmp
%LOCALAPPDATA%\js csv file read write\is-f2ghe.tmp
%LOCALAPPDATA%\js csv file read write\lang\is-8jki3.tmp
%LOCALAPPDATA%\js csv file read write\lang\is-jak6s.tmp
%LOCALAPPDATA%\js csv file read write\lang\is-eptqm.tmp
%LOCALAPPDATA%\js csv file read write\lang\is-n3i0g.tmp
%LOCALAPPDATA%\js csv file read write\lang\is-qvo3a.tmp
%LOCALAPPDATA%\js csv file read write\is-nfk9a.tmp
%LOCALAPPDATA%\js csv file read write\is-6em1c.tmp
%TEMP%\is-d4g5k.tmp\_iscrypt.dll
%TEMP%\is-d4g5k.tmp\_isetup\_shfoldr.dll
%TEMP%\is-d4g5k.tmp\_isetup\_setup64.tmp
%LOCALAPPDATA%\js csv file read write\jscsvfilereadwrite.exe
%ALLUSERSPROFILE%\iptv channel browser 6.6\iptv channel browser 6.6.exe

Перемещает следующие файлы

%LOCALAPPDATA%\js csv file read write\is-6em1c.tmp в %LOCALAPPDATA%\js csv file read write\unins000.exe
%LOCALAPPDATA%\js csv file read write\filters\is-gng4n.tmp в %LOCALAPPDATA%\js csv file read write\filters\gain.dll
%LOCALAPPDATA%\js csv file read write\is-vujsj.tmp в %LOCALAPPDATA%\js csv file read write\sbapo.dll
%LOCALAPPDATA%\js csv file read write\is-0rts7.tmp в %LOCALAPPDATA%\js csv file read write\sbh64.dll
%LOCALAPPDATA%\js csv file read write\is-31s97.tmp в %LOCALAPPDATA%\js csv file read write\sbh.dll
%LOCALAPPDATA%\js csv file read write\is-eluol.tmp в %LOCALAPPDATA%\js csv file read write\logger64.dll
%LOCALAPPDATA%\js csv file read write\is-noqcd.tmp в %LOCALAPPDATA%\js csv file read write\logger32.dll
%LOCALAPPDATA%\js csv file read write\filters\is-7rcci.tmp в %LOCALAPPDATA%\js csv file read write\filters\limit.dll
%LOCALAPPDATA%\js csv file read write\is-h57id.tmp в %LOCALAPPDATA%\js csv file read write\turboactivate.dll
%LOCALAPPDATA%\js csv file read write\lang\is-8jki3.tmp в %LOCALAPPDATA%\js csv file read write\lang\turboactivate.xml
%LOCALAPPDATA%\js csv file read write\lang\is-jak6s.tmp в %LOCALAPPDATA%\js csv file read write\lang\turboactivatebr.xml
%LOCALAPPDATA%\js csv file read write\lang\is-eptqm.tmp в %LOCALAPPDATA%\js csv file read write\lang\turboactivateru.xml
%LOCALAPPDATA%\js csv file read write\lang\is-n3i0g.tmp в %LOCALAPPDATA%\js csv file read write\lang\soundboosterbr.dll
%LOCALAPPDATA%\js csv file read write\lang\is-qvo3a.tmp в %LOCALAPPDATA%\js csv file read write\lang\soundboosterru.dll
%LOCALAPPDATA%\js csv file read write\is-nfk9a.tmp в %LOCALAPPDATA%\js csv file read write\ultraactivate.dll
%LOCALAPPDATA%\js csv file read write\is-f2ghe.tmp в %LOCALAPPDATA%\js csv file read write\turboactivate.dat
%LOCALAPPDATA%\js csv file read write\is-drcfv.tmp в %LOCALAPPDATA%\js csv file read write\jscsvfilereadwrite.exe

Другое

Ищет следующие окна

ClassName: 'P9fe9_JSCSV1262FlashFixClass_P9fe9' WindowName: ''

Создает и запускает на исполнение

'%TEMP%\is-bocl3.tmp\is-hub2e.tmp' /SL4 $A0256 "<Полный путь к файлу>" 6265491 52224
'%LOCALAPPDATA%\js csv file read write\jscsvfilereadwrite.exe' -i
'%LOCALAPPDATA%\js csv file read write\jscsvfilereadwrite.exe' -s