Trojan.MulDrop4.58485

Техническая информация

Вредоносные функции:

Создает и запускает на исполнение:

'C:\ProgramData\nircmd.exe' win hide ititle "cmd.exe"

Запускает на исполнение:

'<SYSTEM32>\at.exe' 22:05 /every:L,M,Mi,J,V,S,D "C:\ProgramData\Cygwin.bat"
'<SYSTEM32>\at.exe' 22:00 /every:L,M,Mi,J,V,S,D "C:\ProgramData\UpdateWindows.bat"
'<SYSTEM32>\at.exe' 21:55 /every:L,M,Mi,J,V,S,D "C:\ProgramData\System.exe"
'<SYSTEM32>\notepad.exe' C:\ProgramData\Leeme.txt
'<SYSTEM32>\ping.exe' localhost -n 1
'<SYSTEM32>\at.exe' 03:30 /every:L,M,Mi,J,V,S,D "C:\ProgramData\End.bat"
'<SYSTEM32>\at.exe' 21:50 /every:L,M,Mi,J,V,S,D "C:\ProgramData\Exterminator.bat"
'<SYSTEM32>\at.exe' 23:23 /every:L,M,Mi,J,V,S,D "C:\ProgramData\ultrafiles.bat"
'<SYSTEM32>\at.exe' 23:02 /every:L,M,Mi,J,V,S,D "C:\ProgramData\ultrafiles.bat"
'<SYSTEM32>\at.exe' 22:49 /every:L,M,Mi,J,V,S,D "C:\ProgramData\ultrafiles.bat"
'<SYSTEM32>\at.exe' 21:30 /every:L,M,Mi,J,V,S,D "%WINDIR%RecoveryEnvironment\System.exe"
'<SYSTEM32>\at.exe' 21:00 /every:L,M,Mi,J,V,S,D "C:\ProgramData\UpdateWindows.bat"
'<SYSTEM32>\at.exe' 00:18 /every:L,M,Mi,J,V,S,D "C:\ProgramData\ultrafiles.bat"
'<SYSTEM32>\attrib.exe' +H +S C:\ProgramData /D /S
'<SYSTEM32>\attrib.exe' +H +S C:\ProgramData\WGET.EXE
'<SYSTEM32>\attrib.exe' +H +S C:\ProgramData\UpdateWindows.bat
'<SYSTEM32>\attrib.exe' +H +S C:\ProgramData\tk.bat
'<SYSTEM32>\attrib.exe' +H +S C:\ProgramData\System.exe
'<SYSTEM32>\attrib.exe' +H +S C:\ProgramData\ImagingDevices.exe
'<SYSTEM32>\attrib.exe' +H +S C:\ProgramData\Cygwin.exe
'<SYSTEM32>\attrib.exe' +H +S C:\ProgramData\nircmd.exe
'<SYSTEM32>\attrib.exe' +H +S C:\ProgramData\End.bat
'<SYSTEM32>\attrib.exe' +H +S C:\ProgramData\Cygwin.bat
'<SYSTEM32>\attrib.exe' +H +S %WINDIR%RecoveryEnvironment /D /S
'<SYSTEM32>\attrib.exe' +H +S C:\ProgramData\ultrafiles.bat
'<SYSTEM32>\attrib.exe' +H +S C:\ProgramData\Leeme.txt
'<SYSTEM32>\attrib.exe' +H +S C:\ProgramData\Exterminator.bat
'<SYSTEM32>\at.exe' 10:37 /every:L,M,Mi,J,V,S,D "C:\ProgramData\ultrafiles.bat"
'<SYSTEM32>\at.exe' 10:11 /every:L,M,Mi,J,V,S,D "C:\ProgramData\ultrafiles.bat"
'<SYSTEM32>\at.exe' 09:35 /every:L,M,Mi,J,V,S,D "C:\ProgramData\ultrafiles.bat"
'<SYSTEM32>\at.exe' 13:29 /every:L,M,Mi,J,V,S,D "C:\ProgramData\ultrafiles.bat"
'<SYSTEM32>\at.exe' 12:51 /every:L,M,Mi,J,V,S,D "C:\ProgramData\ultrafiles.bat"
'<SYSTEM32>\at.exe' 11:47 /every:L,M,Mi,J,V,S,D "C:\ProgramData\ultrafiles.bat"
'<SYSTEM32>\at.exe' 09:01 /every:L,M,Mi,J,V,S,D "C:\ProgramData\ultrafiles.bat"
'<SYSTEM32>\at.exe' 02:37 /every:L,M,Mi,J,V,S,D "C:\ProgramData\ultrafiles.bat"
'<SYSTEM32>\at.exe' 01:29 /every:L,M,Mi,J,V,S,D "C:\ProgramData\ultrafiles.bat"
'<SYSTEM32>\cmd.exe' /c ""C:\ProgramData\tk.bat" "
'<SYSTEM32>\at.exe' 08:23 /every:L,M,Mi,J,V,S,D "C:\ProgramData\ultrafiles.bat"
'<SYSTEM32>\at.exe' 07:08 /every:L,M,Mi,J,V,S,D "C:\ProgramData\ultrafiles.bat"
'<SYSTEM32>\at.exe' 03:18 /every:L,M,Mi,J,V,S,D "C:\ProgramData\ultrafiles.bat"
'<SYSTEM32>\at.exe' 14:38 /every:L,M,Mi,J,V,S,D "C:\ProgramData\ultrafiles.bat"
'<SYSTEM32>\at.exe' 21:34 /every:L,M,Mi,J,V,S,D "C:\ProgramData\ultrafiles.bat"
'<SYSTEM32>\at.exe' 21:14 /every:L,M,Mi,J,V,S,D "C:\ProgramData\ultrafiles.bat"
'<SYSTEM32>\at.exe' 20:57 /every:L,M,Mi,J,V,S,D "C:\ProgramData\ultrafiles.bat"
'<SYSTEM32>\at.exe' 22:32 /every:L,M,Mi,J,V,S,D "C:\ProgramData\ultrafiles.bat"
'<SYSTEM32>\at.exe' 22:15 /every:L,M,Mi,J,V,S,D "C:\ProgramData\ultrafiles.bat"
'<SYSTEM32>\at.exe' 21:51 /every:L,M,Mi,J,V,S,D "C:\ProgramData\ultrafiles.bat"
'<SYSTEM32>\at.exe' 20:36 /every:L,M,Mi,J,V,S,D "C:\ProgramData\ultrafiles.bat"
'<SYSTEM32>\at.exe' 17:22 /every:L,M,Mi,J,V,S,D "C:\ProgramData\ultrafiles.bat"
'<SYSTEM32>\at.exe' 16:46 /every:L,M,Mi,J,V,S,D "C:\ProgramData\ultrafiles.bat"
'<SYSTEM32>\at.exe' 15:24 /every:L,M,Mi,J,V,S,D "C:\ProgramData\ultrafiles.bat"
'<SYSTEM32>\at.exe' 20:11 /every:L,M,Mi,J,V,S,D "C:\ProgramData\ultrafiles.bat"
'<SYSTEM32>\at.exe' 19:06 /every:L,M,Mi,J,V,S,D "C:\ProgramData\ultrafiles.bat"
'<SYSTEM32>\at.exe' 18:33 /every:L,M,Mi,J,V,S,D "C:\ProgramData\ultrafiles.bat"