Trojan.MulDrop27.59616

Техническая информация

Для обеспечения автозапуска и распространения

Устанавливает следующие настройки сервисов

[HKLM\System\CurrentControlSet\Services\AFI CIO PrintDrv 6.26.66] 'Start' = '00000002'
[HKLM\System\CurrentControlSet\Services\AFI CIO PrintDrv 6.26.66] 'ImagePath' = '%ALLUSERSPROFILE%\AFI CIO PrintDrv 6.26.66\AFI CIO PrintDrv 6.26.66.exe'

Создает следующие сервисы

'AFI CIO PrintDrv 6.26.66' %ALLUSERSPROFILE%\AFI CIO PrintDrv 6.26.66\AFI CIO PrintDrv 6.26.66.exe

Изменения в файловой системе

Создает следующие файлы

%TEMP%\is-llaek.tmp\<Имя файла>.tmp
%LOCALAPPDATA%\direct wav mp3 splitter\unins000.dat
%LOCALAPPDATA%\direct wav mp3 splitter\is-nfem6.tmp
%LOCALAPPDATA%\direct wav mp3 splitter\is-eksno.tmp
%LOCALAPPDATA%\direct wav mp3 splitter\is-vi7ht.tmp
%LOCALAPPDATA%\direct wav mp3 splitter\is-3umgp.tmp
%LOCALAPPDATA%\direct wav mp3 splitter\is-klt17.tmp
%LOCALAPPDATA%\direct wav mp3 splitter\is-9l005.tmp
%LOCALAPPDATA%\direct wav mp3 splitter\is-l35nd.tmp
%LOCALAPPDATA%\direct wav mp3 splitter\is-98cmg.tmp
%LOCALAPPDATA%\direct wav mp3 splitter\is-bolav.tmp
%LOCALAPPDATA%\direct wav mp3 splitter\is-sddun.tmp
%LOCALAPPDATA%\direct wav mp3 splitter\wavmp3splitter32.exe
%LOCALAPPDATA%\direct wav mp3 splitter\is-4pgnn.tmp
%LOCALAPPDATA%\direct wav mp3 splitter\is-6v4gl.tmp
%LOCALAPPDATA%\direct wav mp3 splitter\is-48dvl.tmp
%LOCALAPPDATA%\direct wav mp3 splitter\is-ep223.tmp
%LOCALAPPDATA%\direct wav mp3 splitter\is-nlibe.tmp
%LOCALAPPDATA%\direct wav mp3 splitter\is-9373i.tmp
%LOCALAPPDATA%\direct wav mp3 splitter\is-l6aj7.tmp
%LOCALAPPDATA%\direct wav mp3 splitter\is-pvjpq.tmp
%TEMP%\is-7cfb6.tmp\_isetup\_iscrypt.dll
%TEMP%\is-7cfb6.tmp\_isetup\_shfoldr.dll
%TEMP%\is-7cfb6.tmp\_isetup\_setup64.tmp
%TEMP%\is-7cfb6.tmp\_isetup\_regdll.tmp
%LOCALAPPDATA%\direct wav mp3 splitter\is-l73nv.tmp
%ALLUSERSPROFILE%\afi cio printdrv 6.26.66\afi cio printdrv 6.26.66.exe

Перемещает следующие файлы

%LOCALAPPDATA%\direct wav mp3 splitter\is-pvjpq.tmp в %LOCALAPPDATA%\direct wav mp3 splitter\unins000.exe
%LOCALAPPDATA%\direct wav mp3 splitter\is-vi7ht.tmp в %LOCALAPPDATA%\direct wav mp3 splitter\proportions.txt
%LOCALAPPDATA%\direct wav mp3 splitter\is-3umgp.tmp в %LOCALAPPDATA%\direct wav mp3 splitter\openh264_license.txt
%LOCALAPPDATA%\direct wav mp3 splitter\is-klt17.tmp в %LOCALAPPDATA%\direct wav mp3 splitter\qtavwidgets1.dll
%LOCALAPPDATA%\direct wav mp3 splitter\is-9l005.tmp в %LOCALAPPDATA%\direct wav mp3 splitter\qt5xml.dll
%LOCALAPPDATA%\direct wav mp3 splitter\is-l35nd.tmp в %LOCALAPPDATA%\direct wav mp3 splitter\qt5winextras.dll
%LOCALAPPDATA%\direct wav mp3 splitter\is-98cmg.tmp в %LOCALAPPDATA%\direct wav mp3 splitter\qt5svg.dll
%LOCALAPPDATA%\direct wav mp3 splitter\is-bolav.tmp в %LOCALAPPDATA%\direct wav mp3 splitter\qt5opengl.dll
%LOCALAPPDATA%\direct wav mp3 splitter\is-eksno.tmp в %LOCALAPPDATA%\direct wav mp3 splitter\libeay32.dll
%LOCALAPPDATA%\direct wav mp3 splitter\is-sddun.tmp в %LOCALAPPDATA%\direct wav mp3 splitter\openh264.dll
%LOCALAPPDATA%\direct wav mp3 splitter\is-l73nv.tmp в %LOCALAPPDATA%\direct wav mp3 splitter\msvcp140_1.dll
%LOCALAPPDATA%\direct wav mp3 splitter\is-6v4gl.tmp в %LOCALAPPDATA%\direct wav mp3 splitter\msvcp140.dll
%LOCALAPPDATA%\direct wav mp3 splitter\is-48dvl.tmp в %LOCALAPPDATA%\direct wav mp3 splitter\msvcp120.dll
%LOCALAPPDATA%\direct wav mp3 splitter\is-ep223.tmp в %LOCALAPPDATA%\direct wav mp3 splitter\mousehelper.dll
%LOCALAPPDATA%\direct wav mp3 splitter\is-nlibe.tmp в %LOCALAPPDATA%\direct wav mp3 splitter\libmp3lame.dll
%LOCALAPPDATA%\direct wav mp3 splitter\is-9373i.tmp в %LOCALAPPDATA%\direct wav mp3 splitter\libcurl.dll
%LOCALAPPDATA%\direct wav mp3 splitter\is-l6aj7.tmp в %LOCALAPPDATA%\direct wav mp3 splitter\avdevice-58.dll
%LOCALAPPDATA%\direct wav mp3 splitter\is-4pgnn.tmp в %LOCALAPPDATA%\direct wav mp3 splitter\msvcr120.dll
%LOCALAPPDATA%\direct wav mp3 splitter\is-nfem6.tmp в %LOCALAPPDATA%\direct wav mp3 splitter\wavmp3splitter32.exe

Другое

Ищет следующие окна

ClassName: '' WindowName: 'b73775_Flash6273FixClass_b73775'

Создает и запускает на исполнение

'%TEMP%\is-llaek.tmp\<Имя файла>.tmp' /SL5="$A0256,4982149,54272,<Полный путь к файлу>"
'%LOCALAPPDATA%\direct wav mp3 splitter\wavmp3splitter32.exe' -i
'%LOCALAPPDATA%\direct wav mp3 splitter\wavmp3splitter32.exe' -s