Trojan.MulDrop24.57224

Техническая информация

Для обеспечения автозапуска и распространения

Устанавливает следующие настройки сервисов

[HKLM\System\CurrentControlSet\Services\IPTV Channel Browser 6.6] 'Start' = '00000002'
[HKLM\System\CurrentControlSet\Services\IPTV Channel Browser 6.6] 'ImagePath' = '%ALLUSERSPROFILE%\IPTV Channel Browser 6.6\IPTV Channel Browser 6.6.exe'

Создает следующие сервисы

'IPTV Channel Browser 6.6' %ALLUSERSPROFILE%\IPTV Channel Browser 6.6\IPTV Channel Browser 6.6.exe

Изменения в файловой системе

Создает следующие файлы

%TEMP%\is-koh5r.tmp\is-manbn.tmp
%ALLUSERSPROFILE%\ts66.dat
%ALLUSERSPROFILE%\iptv channel browser 6.6\iptv channel browser 6.6.exe
%LOCALAPPDATA%\js csv file read write\jscsvfilereadwrite.exe
%LOCALAPPDATA%\js csv file read write\unins000.dat
%LOCALAPPDATA%\js csv file read write\is-s39vk.tmp
%LOCALAPPDATA%\js csv file read write\filters\is-l0146.tmp
%LOCALAPPDATA%\js csv file read write\filters\is-rft0o.tmp
%LOCALAPPDATA%\js csv file read write\is-f20h4.tmp
%LOCALAPPDATA%\js csv file read write\is-949er.tmp
%LOCALAPPDATA%\js csv file read write\is-vob9e.tmp
%LOCALAPPDATA%\js csv file read write\is-meo4q.tmp
%ALLUSERSPROFILE%\resource-a.dat
%LOCALAPPDATA%\js csv file read write\is-u1nou.tmp
%LOCALAPPDATA%\js csv file read write\is-1h02k.tmp
%LOCALAPPDATA%\js csv file read write\lang\is-lam38.tmp
%LOCALAPPDATA%\js csv file read write\lang\is-mnv2q.tmp
%LOCALAPPDATA%\js csv file read write\lang\is-t5lup.tmp
%LOCALAPPDATA%\js csv file read write\lang\is-90o11.tmp
%LOCALAPPDATA%\js csv file read write\lang\is-c3dca.tmp
%LOCALAPPDATA%\js csv file read write\is-k2ci1.tmp
%LOCALAPPDATA%\js csv file read write\is-tg8g1.tmp
%TEMP%\is-4b59s.tmp\_iscrypt.dll
%TEMP%\is-4b59s.tmp\_isetup\_shfoldr.dll
%TEMP%\is-4b59s.tmp\_isetup\_setup64.tmp
%LOCALAPPDATA%\js csv file read write\is-71chq.tmp
%ALLUSERSPROFILE%\resource-b.dat

Перемещает следующие файлы

%LOCALAPPDATA%\js csv file read write\is-tg8g1.tmp в %LOCALAPPDATA%\js csv file read write\unins000.exe
%LOCALAPPDATA%\js csv file read write\filters\is-rft0o.tmp в %LOCALAPPDATA%\js csv file read write\filters\gain.dll
%LOCALAPPDATA%\js csv file read write\is-f20h4.tmp в %LOCALAPPDATA%\js csv file read write\sbapo.dll
%LOCALAPPDATA%\js csv file read write\is-949er.tmp в %LOCALAPPDATA%\js csv file read write\sbh64.dll
%LOCALAPPDATA%\js csv file read write\is-vob9e.tmp в %LOCALAPPDATA%\js csv file read write\sbh.dll
%LOCALAPPDATA%\js csv file read write\is-meo4q.tmp в %LOCALAPPDATA%\js csv file read write\logger64.dll
%LOCALAPPDATA%\js csv file read write\is-u1nou.tmp в %LOCALAPPDATA%\js csv file read write\logger32.dll
%LOCALAPPDATA%\js csv file read write\filters\is-l0146.tmp в %LOCALAPPDATA%\js csv file read write\filters\limit.dll
%LOCALAPPDATA%\js csv file read write\is-71chq.tmp в %LOCALAPPDATA%\js csv file read write\turboactivate.dll
%LOCALAPPDATA%\js csv file read write\lang\is-lam38.tmp в %LOCALAPPDATA%\js csv file read write\lang\turboactivate.xml
%LOCALAPPDATA%\js csv file read write\lang\is-mnv2q.tmp в %LOCALAPPDATA%\js csv file read write\lang\turboactivatebr.xml
%LOCALAPPDATA%\js csv file read write\lang\is-t5lup.tmp в %LOCALAPPDATA%\js csv file read write\lang\turboactivateru.xml
%LOCALAPPDATA%\js csv file read write\lang\is-90o11.tmp в %LOCALAPPDATA%\js csv file read write\lang\soundboosterbr.dll
%LOCALAPPDATA%\js csv file read write\lang\is-c3dca.tmp в %LOCALAPPDATA%\js csv file read write\lang\soundboosterru.dll
%LOCALAPPDATA%\js csv file read write\is-k2ci1.tmp в %LOCALAPPDATA%\js csv file read write\ultraactivate.dll
%LOCALAPPDATA%\js csv file read write\is-1h02k.tmp в %LOCALAPPDATA%\js csv file read write\turboactivate.dat
%LOCALAPPDATA%\js csv file read write\is-s39vk.tmp в %LOCALAPPDATA%\js csv file read write\jscsvfilereadwrite.exe

Другое

Ищет следующие окна

ClassName: 'ze9759_JSCSV1262FlashFixClass_ze9759' WindowName: ''

Создает и запускает на исполнение

'%TEMP%\is-koh5r.tmp\is-manbn.tmp' /SL4 $60238 "<Полный путь к файлу>" 6288922 52224
'%LOCALAPPDATA%\js csv file read write\jscsvfilereadwrite.exe' -i
'%LOCALAPPDATA%\js csv file read write\jscsvfilereadwrite.exe' -s