Trojan.MulDrop28.26448

Техническая информация

Изменения в файловой системе

Создает следующие файлы

C:\addon\arquivos de programas\adicionais\64bits\sets\cpaste.cmd
%ProgramFiles%\7-zip\lang\sr-spl.txt
%ProgramFiles%\7-zip\lang\sr-spc.txt
%ProgramFiles%\7-zip\lang\sq.txt
%ProgramFiles%\7-zip\lang\sl.txt
%ProgramFiles%\7-zip\lang\sk.txt
%ProgramFiles%\7-zip\lang\si.txt
%ProgramFiles%\7-zip\lang\sa.txt
%ProgramFiles%\7-zip\lang\ru.txt
%ProgramFiles%\7-zip\lang\ro.txt
%ProgramFiles%\7-zip\lang\pt.txt
%ProgramFiles%\7-zip\lang\pt-br.txt
%ProgramFiles%\7-zip\lang\ps.txt
%ProgramFiles%\7-zip\lang\pl.txt
%ProgramFiles%\7-zip\lang\pa-in.txt
%ProgramFiles%\7-zip\lang\nn.txt
%ProgramFiles%\7-zip\lang\nl.txt
%ProgramFiles%\7-zip\lang\ne.txt
%ProgramFiles%\7-zip\lang\nb.txt
%ProgramFiles%\7-zip\lang\ms.txt
%ProgramFiles%\7-zip\lang\mr.txt
%ProgramFiles%\7-zip\lang\mng2.txt
%ProgramFiles%\7-zip\lang\mng.txt
%ProgramFiles%\7-zip\lang\mn.txt
%ProgramFiles%\7-zip\lang\mk.txt
%ProgramFiles%\7-zip\lang\lv.txt
%ProgramFiles%\7-zip\lang\sv.txt
%ProgramFiles%\7-zip\lang\ta.txt
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\7-zip\7-zip help.lnk
%ProgramFiles%\7-zip\lang\tg.txt
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\7-zip\7-zip file manager.lnk
%ProgramFiles%\7-zip\uninstall.exe
%ProgramFiles%\7-zip\7zg.exe
%ProgramFiles%\7-zip\7zfm.exe
%ProgramFiles%\7-zip\7zcon.sfx
%ProgramFiles%\7-zip\7z.sfx
%ProgramFiles%\7-zip\7z.exe
%ProgramFiles%\7-zip\7z.dll
%ProgramFiles%\7-zip\7-zip32.dll
%ProgramFiles%\7-zip\7-zip.dll
%ProgramFiles%\7-zip\readme.txt
%ProgramFiles%\7-zip\license.txt
%ProgramFiles%\7-zip\lang\zh-tw.txt
%ProgramFiles%\7-zip\lang\zh-cn.txt
%ProgramFiles%\7-zip\lang\yo.txt
%ProgramFiles%\7-zip\lang\vi.txt
%ProgramFiles%\7-zip\lang\va.txt
%ProgramFiles%\7-zip\lang\uz.txt
%ProgramFiles%\7-zip\lang\uz-cyrl.txt
%ProgramFiles%\7-zip\lang\uk.txt
%ProgramFiles%\7-zip\lang\ug.txt
%ProgramFiles%\7-zip\lang\tt.txt
%ProgramFiles%\7-zip\lang\tr.txt
%ProgramFiles%\7-zip\lang\tk.txt
%ProgramFiles%\7-zip\lang\th.txt
%ProgramFiles%\7-zip\lang\lt.txt
%ProgramFiles%\7-zip\lang\sw.txt
%ProgramFiles%\7-zip\lang\lij.txt
%ProgramFiles%\7-zip\lang\es.txt
%ProgramFiles%\7-zip\lang\en.ttt
%ProgramFiles%\7-zip\lang\el.txt
%ProgramFiles%\7-zip\lang\de.txt
%ProgramFiles%\7-zip\lang\da.txt
%ProgramFiles%\7-zip\lang\cy.txt
%ProgramFiles%\7-zip\lang\cs.txt
%ProgramFiles%\7-zip\lang\co.txt
%ProgramFiles%\7-zip\lang\ca.txt
%ProgramFiles%\7-zip\lang\br.txt
%ProgramFiles%\7-zip\lang\bn.txt
%ProgramFiles%\7-zip\lang\bg.txt
%ProgramFiles%\7-zip\lang\be.txt
%ProgramFiles%\7-zip\lang\ba.txt
%ProgramFiles%\7-zip\lang\az.txt
%ProgramFiles%\7-zip\lang\ast.txt
%ProgramFiles%\7-zip\lang\ar.txt
%ProgramFiles%\7-zip\lang\an.txt
%ProgramFiles%\7-zip\lang\af.txt
%ProgramFiles%\7-zip\history.txt
%ProgramFiles%\7-zip\descript.ion
%ProgramFiles%\7-zip\7-zip.chm
C:\users\public\desktop\contato & suporte (direto).png
C:\addon\arquivos de programas\adicionais\64bits\instalador-(64bits)-recomendado.exe
C:\addon\arquivos de programas\adicionais\64bits\sets\support\contato & suporte (direto).png
C:\addon\arquivos de programas\adicionais\64bits\sets\notice.bat
%ProgramFiles%\7-zip\lang\eo.txt
%ProgramFiles%\7-zip\lang\et.txt
%ProgramFiles%\7-zip\lang\ku.txt
%ProgramFiles%\7-zip\lang\eu.txt
%ProgramFiles%\7-zip\lang\ku-ckb.txt
%ProgramFiles%\7-zip\lang\ko.txt
%ProgramFiles%\7-zip\lang\kk.txt
%ProgramFiles%\7-zip\lang\kab.txt
%ProgramFiles%\7-zip\lang\kaa.txt
%ProgramFiles%\7-zip\lang\ka.txt
%ProgramFiles%\7-zip\lang\ja.txt
%ProgramFiles%\7-zip\lang\it.txt
%ProgramFiles%\7-zip\lang\is.txt
%ProgramFiles%\7-zip\lang\io.txt
%ProgramFiles%\7-zip\lang\id.txt
%ProgramFiles%\7-zip\lang\hy.txt
%ProgramFiles%\7-zip\lang\hu.txt
%ProgramFiles%\7-zip\lang\hr.txt
%ProgramFiles%\7-zip\lang\hi.txt
%ProgramFiles%\7-zip\lang\he.txt
%ProgramFiles%\7-zip\lang\gu.txt
%ProgramFiles%\7-zip\lang\gl.txt
%ProgramFiles%\7-zip\lang\ga.txt
%ProgramFiles%\7-zip\lang\fy.txt
%ProgramFiles%\7-zip\lang\fur.txt
%ProgramFiles%\7-zip\lang\fr.txt
%ProgramFiles%\7-zip\lang\fi.txt
%ProgramFiles%\7-zip\lang\fa.txt
%ProgramFiles%\7-zip\lang\ext.txt
%ProgramFiles%\7-zip\lang\ky.txt
nul

Присваивает атрибут 'скрытый' для следующих файлов

C:\addon\arquivos de programas\adicionais\64bits\sets\cpaste.cmd
C:\addon\arquivos de programas\adicionais\64bits\sets\notice.bat

Другое

Ищет следующие окна

ClassName: 'EDIT' WindowName: ''

Создает и запускает на исполнение

'C:\addon\arquivos de programas\adicionais\64bits\instalador-(64bits)-recomendado.exe' /S

Запускает на исполнение

'<SYSTEM32>\cmd.exe' /c ""C:\Addon\Arquivos de Programas\Adicionais\64bits\Sets\CPASTE.cmd" "
'<SYSTEM32>\cmd.exe' /c ""C:\Addon\Arquivos de Programas\Adicionais\64bits\Sets\NOTICE.bat" "
'<SYSTEM32>\mode.com' con: cols=80 lines=10
'<SYSTEM32>\timeout.exe' /t 1 /nobreak
'<SYSTEM32>\timeout.exe' /t 3