Trojan.MulDrop28.27739

Техническая информация

Для обеспечения автозапуска и распространения

Устанавливает следующие настройки сервисов

[HKLM\System\CurrentControlSet\Services\Eurofighter Typhoon Game 10.8.45] 'Start' = '00000002'
[HKLM\System\CurrentControlSet\Services\Eurofighter Typhoon Game 10.8.45] 'ImagePath' = '%ALLUSERSPROFILE%\Eurofighter Typhoon Game 10.8.45\Eurofighter Typhoon Game 10.8.45.exe'

Создает следующие сервисы

'Eurofighter Typhoon Game 10.8.45' %ALLUSERSPROFILE%\Eurofighter Typhoon Game 10.8.45\Eurofighter Typhoon Game 10.8.45.exe

Изменения в файловой системе

Создает следующие файлы

%TEMP%\is-1bnk3.tmp\is-mttl6.tmp
%LOCALAPPDATA%\raff txt to sub\is-4jjta.tmp
%LOCALAPPDATA%\raff txt to sub\is-bqce6.tmp
%LOCALAPPDATA%\raff txt to sub\is-4h6ps.tmp
%LOCALAPPDATA%\raff txt to sub\is-ibh8k.tmp
%LOCALAPPDATA%\raff txt to sub\is-hkenk.tmp
%LOCALAPPDATA%\raff txt to sub\is-j8nsq.tmp
%LOCALAPPDATA%\raff txt to sub\is-sh7jk.tmp
%LOCALAPPDATA%\raff txt to sub\is-krq6c.tmp
%LOCALAPPDATA%\raff txt to sub\is-9mqpv.tmp
%LOCALAPPDATA%\raff txt to sub\is-2lvnu.tmp
%LOCALAPPDATA%\raff txt to sub\is-7rt8k.tmp
%LOCALAPPDATA%\raff txt to sub\uninstall\unins000.dat
%LOCALAPPDATA%\raff txt to sub\txttosub.exe
%ALLUSERSPROFILE%\eurofighter typhoon game 10.8.45\eurofighter typhoon game 10.8.45.exe
%ALLUSERSPROFILE%\eu108it45.dat
%LOCALAPPDATA%\raff txt to sub\is-djqs1.tmp
%LOCALAPPDATA%\raff txt to sub\is-9dqnl.tmp
%LOCALAPPDATA%\raff txt to sub\is-4a3eb.tmp
%LOCALAPPDATA%\raff txt to sub\is-njmlu.tmp
%LOCALAPPDATA%\raff txt to sub\is-iomhg.tmp
%TEMP%\is-uj1rj.tmp\_isetup\_setup64.tmp
%TEMP%\is-uj1rj.tmp\_isetup\_shfoldr.dll
%TEMP%\is-uj1rj.tmp\_isetup\_iscrypt.dll
%LOCALAPPDATA%\raff txt to sub\uninstall\is-flbpt.tmp
%LOCALAPPDATA%\raff txt to sub\is-j9bpn.tmp
%LOCALAPPDATA%\raff txt to sub\is-77r21.tmp
%LOCALAPPDATA%\raff txt to sub\is-0lrps.tmp
%TEMP%\is-uj1rj.tmp\_isetup\_regdll.tmp
%LOCALAPPDATA%\raff txt to sub\is-iudob.tmp
%LOCALAPPDATA%\raff txt to sub\is-fpmp2.tmp
%LOCALAPPDATA%\raff txt to sub\is-qc1nu.tmp
%LOCALAPPDATA%\raff txt to sub\is-k8k5k.tmp
%LOCALAPPDATA%\raff txt to sub\is-hn2a8.tmp
%LOCALAPPDATA%\raff txt to sub\is-75b2o.tmp
%LOCALAPPDATA%\raff txt to sub\is-kk93g.tmp
%LOCALAPPDATA%\raff txt to sub\is-vj26f.tmp
%LOCALAPPDATA%\raff txt to sub\is-n4mku.tmp
%ALLUSERSPROFILE%\eu108resa.dat
%ALLUSERSPROFILE%\eu108resb.dat

Перемещает следующие файлы

%LOCALAPPDATA%\raff txt to sub\uninstall\is-flbpt.tmp в %LOCALAPPDATA%\raff txt to sub\uninstall\unins000.exe
%LOCALAPPDATA%\raff txt to sub\is-9dqnl.tmp в %LOCALAPPDATA%\raff txt to sub\libwinpthread-1.dll
%LOCALAPPDATA%\raff txt to sub\is-djqs1.tmp в %LOCALAPPDATA%\raff txt to sub\libtiff-5.dll
%LOCALAPPDATA%\raff txt to sub\is-9mqpv.tmp в %LOCALAPPDATA%\raff txt to sub\libsigc-2.0-0.dll
%LOCALAPPDATA%\raff txt to sub\is-j8nsq.tmp в %LOCALAPPDATA%\raff txt to sub\librsvg-2-2.dll
%LOCALAPPDATA%\raff txt to sub\is-hkenk.tmp в %LOCALAPPDATA%\raff txt to sub\libpng16-16.dll
%LOCALAPPDATA%\raff txt to sub\is-ibh8k.tmp в %LOCALAPPDATA%\raff txt to sub\libpixman-1-0.dll
%LOCALAPPDATA%\raff txt to sub\is-4h6ps.tmp в %LOCALAPPDATA%\raff txt to sub\libpcre-1.dll
%LOCALAPPDATA%\raff txt to sub\is-bqce6.tmp в %LOCALAPPDATA%\raff txt to sub\libpangowin32-1.0-0.dll
%LOCALAPPDATA%\raff txt to sub\is-4jjta.tmp в %LOCALAPPDATA%\raff txt to sub\libpangomm-1.4-1.dll
%LOCALAPPDATA%\raff txt to sub\is-krq6c.tmp в %LOCALAPPDATA%\raff txt to sub\libpangoft2-1.0-0.dll
%LOCALAPPDATA%\raff txt to sub\is-sh7jk.tmp в %LOCALAPPDATA%\raff txt to sub\libpangocairo-1.0-0.dll
%LOCALAPPDATA%\raff txt to sub\is-4a3eb.tmp в %LOCALAPPDATA%\raff txt to sub\libpango-1.0-0.dll
%LOCALAPPDATA%\raff txt to sub\is-2lvnu.tmp в %LOCALAPPDATA%\raff txt to sub\zlib1.dll
%LOCALAPPDATA%\raff txt to sub\is-njmlu.tmp в %LOCALAPPDATA%\raff txt to sub\liblzma-5.dll
%LOCALAPPDATA%\raff txt to sub\is-vj26f.tmp в %LOCALAPPDATA%\raff txt to sub\libjpeg-8.dll
%LOCALAPPDATA%\raff txt to sub\is-kk93g.tmp в %LOCALAPPDATA%\raff txt to sub\libintl-8.dll
%LOCALAPPDATA%\raff txt to sub\is-75b2o.tmp в %LOCALAPPDATA%\raff txt to sub\libharfbuzz-0.dll
%LOCALAPPDATA%\raff txt to sub\is-hn2a8.tmp в %LOCALAPPDATA%\raff txt to sub\libgraphite2.dll
%LOCALAPPDATA%\raff txt to sub\is-k8k5k.tmp в %LOCALAPPDATA%\raff txt to sub\libgomp-1.dll
%LOCALAPPDATA%\raff txt to sub\is-qc1nu.tmp в %LOCALAPPDATA%\raff txt to sub\libgobject-2.0-0.dll
%LOCALAPPDATA%\raff txt to sub\is-fpmp2.tmp в %LOCALAPPDATA%\raff txt to sub\libgmodule-2.0-0.dll
%LOCALAPPDATA%\raff txt to sub\is-n4mku.tmp в %LOCALAPPDATA%\raff txt to sub\libglibmm-2.4-1.dll
%LOCALAPPDATA%\raff txt to sub\is-iudob.tmp в %LOCALAPPDATA%\raff txt to sub\libgdk_pixbuf-2.0-0.dll
%LOCALAPPDATA%\raff txt to sub\is-0lrps.tmp в %LOCALAPPDATA%\raff txt to sub\libgdkmm-2.4-1.dll
%LOCALAPPDATA%\raff txt to sub\is-77r21.tmp в %LOCALAPPDATA%\raff txt to sub\libgdk-win32-2.0-0.dll
%LOCALAPPDATA%\raff txt to sub\is-j9bpn.tmp в %LOCALAPPDATA%\raff txt to sub\libgcc_s_dw2-1.dll
%LOCALAPPDATA%\raff txt to sub\is-iomhg.tmp в %LOCALAPPDATA%\raff txt to sub\liblcms2-2.dll
%LOCALAPPDATA%\raff txt to sub\is-7rt8k.tmp в %LOCALAPPDATA%\raff txt to sub\txttosub.exe