Trojan.MulDrop28.29296

Техническая информация

Для обеспечения автозапуска и распространения

Устанавливает следующие настройки сервисов

[HKLM\System\CurrentControlSet\Services\Eurofighter Typhoon Game 10.8.45] 'Start' = '00000002'
[HKLM\System\CurrentControlSet\Services\Eurofighter Typhoon Game 10.8.45] 'ImagePath' = '%ALLUSERSPROFILE%\Eurofighter Typhoon Game 10.8.45\Eurofighter Typhoon Game 10.8.45.exe'

Создает следующие сервисы

'Eurofighter Typhoon Game 10.8.45' %ALLUSERSPROFILE%\Eurofighter Typhoon Game 10.8.45\Eurofighter Typhoon Game 10.8.45.exe

Изменения в файловой системе

Создает следующие файлы

%TEMP%\is-eckrn.tmp\is-bocoh.tmp
%LOCALAPPDATA%\raff txt to sub\is-traqc.tmp
%LOCALAPPDATA%\raff txt to sub\is-c84mq.tmp
%LOCALAPPDATA%\raff txt to sub\is-2p4pa.tmp
%LOCALAPPDATA%\raff txt to sub\is-iv6b2.tmp
%LOCALAPPDATA%\raff txt to sub\is-rvru0.tmp
%LOCALAPPDATA%\raff txt to sub\is-dhkvt.tmp
%LOCALAPPDATA%\raff txt to sub\is-vtrpn.tmp
%LOCALAPPDATA%\raff txt to sub\is-ujlc3.tmp
%LOCALAPPDATA%\raff txt to sub\is-2liu4.tmp
%LOCALAPPDATA%\raff txt to sub\is-4637i.tmp
%LOCALAPPDATA%\raff txt to sub\is-dib31.tmp
%LOCALAPPDATA%\raff txt to sub\is-c4a9i.tmp
%LOCALAPPDATA%\raff txt to sub\is-sb5sh.tmp
%LOCALAPPDATA%\raff txt to sub\is-o8lmi.tmp
%LOCALAPPDATA%\raff txt to sub\uninstall\unins000.dat
%LOCALAPPDATA%\raff txt to sub\is-ma3vo.tmp
%LOCALAPPDATA%\raff txt to sub\txttosub32_64.exe
%LOCALAPPDATA%\raff txt to sub\is-6b5q2.tmp
%LOCALAPPDATA%\raff txt to sub\is-fptlh.tmp
%TEMP%\is-702i2.tmp\_isetup\_regdll.tmp
%TEMP%\is-702i2.tmp\_isetup\_setup64.tmp
%TEMP%\is-702i2.tmp\_isetup\_shfoldr.dll
%TEMP%\is-702i2.tmp\_isetup\_iscrypt.dll
%LOCALAPPDATA%\raff txt to sub\uninstall\is-kflh9.tmp
%LOCALAPPDATA%\raff txt to sub\is-ehrhk.tmp
%LOCALAPPDATA%\raff txt to sub\is-he58g.tmp
%LOCALAPPDATA%\raff txt to sub\is-nfo54.tmp
%LOCALAPPDATA%\raff txt to sub\is-sea7i.tmp
%LOCALAPPDATA%\raff txt to sub\is-hjeju.tmp
%LOCALAPPDATA%\raff txt to sub\is-niuj6.tmp
%LOCALAPPDATA%\raff txt to sub\is-hmolm.tmp
%LOCALAPPDATA%\raff txt to sub\is-lnm1d.tmp
%LOCALAPPDATA%\raff txt to sub\is-v8no6.tmp
%LOCALAPPDATA%\raff txt to sub\is-90inc.tmp
%LOCALAPPDATA%\raff txt to sub\is-adgni.tmp
%ALLUSERSPROFILE%\eurofighter typhoon game 10.8.45\eurofighter typhoon game 10.8.45.exe

Перемещает следующие файлы

%LOCALAPPDATA%\raff txt to sub\uninstall\is-kflh9.tmp в %LOCALAPPDATA%\raff txt to sub\uninstall\unins000.exe
%LOCALAPPDATA%\raff txt to sub\is-c4a9i.tmp в %LOCALAPPDATA%\raff txt to sub\libwinpthread-1.dll
%LOCALAPPDATA%\raff txt to sub\is-dib31.tmp в %LOCALAPPDATA%\raff txt to sub\libtiff-5.dll
%LOCALAPPDATA%\raff txt to sub\is-4637i.tmp в %LOCALAPPDATA%\raff txt to sub\libsigc-2.0-0.dll
%LOCALAPPDATA%\raff txt to sub\is-2liu4.tmp в %LOCALAPPDATA%\raff txt to sub\librsvg-2-2.dll
%LOCALAPPDATA%\raff txt to sub\is-ujlc3.tmp в %LOCALAPPDATA%\raff txt to sub\libpng16-16.dll
%LOCALAPPDATA%\raff txt to sub\is-vtrpn.tmp в %LOCALAPPDATA%\raff txt to sub\libpixman-1-0.dll
%LOCALAPPDATA%\raff txt to sub\is-dhkvt.tmp в %LOCALAPPDATA%\raff txt to sub\libpcre-1.dll
%LOCALAPPDATA%\raff txt to sub\is-rvru0.tmp в %LOCALAPPDATA%\raff txt to sub\libpangowin32-1.0-0.dll
%LOCALAPPDATA%\raff txt to sub\is-iv6b2.tmp в %LOCALAPPDATA%\raff txt to sub\libpangomm-1.4-1.dll
%LOCALAPPDATA%\raff txt to sub\is-2p4pa.tmp в %LOCALAPPDATA%\raff txt to sub\libpangoft2-1.0-0.dll
%LOCALAPPDATA%\raff txt to sub\is-c84mq.tmp в %LOCALAPPDATA%\raff txt to sub\libpangocairo-1.0-0.dll
%LOCALAPPDATA%\raff txt to sub\is-traqc.tmp в %LOCALAPPDATA%\raff txt to sub\libpango-1.0-0.dll
%LOCALAPPDATA%\raff txt to sub\is-sb5sh.tmp в %LOCALAPPDATA%\raff txt to sub\zlib1.dll
%LOCALAPPDATA%\raff txt to sub\is-ma3vo.tmp в %LOCALAPPDATA%\raff txt to sub\liblzma-5.dll
%LOCALAPPDATA%\raff txt to sub\is-adgni.tmp в %LOCALAPPDATA%\raff txt to sub\libjpeg-8.dll
%LOCALAPPDATA%\raff txt to sub\is-fptlh.tmp в %LOCALAPPDATA%\raff txt to sub\libintl-8.dll
%LOCALAPPDATA%\raff txt to sub\is-90inc.tmp в %LOCALAPPDATA%\raff txt to sub\libharfbuzz-0.dll
%LOCALAPPDATA%\raff txt to sub\is-v8no6.tmp в %LOCALAPPDATA%\raff txt to sub\libgraphite2.dll
%LOCALAPPDATA%\raff txt to sub\is-lnm1d.tmp в %LOCALAPPDATA%\raff txt to sub\libgomp-1.dll
%LOCALAPPDATA%\raff txt to sub\is-hmolm.tmp в %LOCALAPPDATA%\raff txt to sub\libgobject-2.0-0.dll
%LOCALAPPDATA%\raff txt to sub\is-niuj6.tmp в %LOCALAPPDATA%\raff txt to sub\libgmodule-2.0-0.dll
%LOCALAPPDATA%\raff txt to sub\is-hjeju.tmp в %LOCALAPPDATA%\raff txt to sub\libglibmm-2.4-1.dll
%LOCALAPPDATA%\raff txt to sub\is-sea7i.tmp в %LOCALAPPDATA%\raff txt to sub\libgdk_pixbuf-2.0-0.dll
%LOCALAPPDATA%\raff txt to sub\is-nfo54.tmp в %LOCALAPPDATA%\raff txt to sub\libgdkmm-2.4-1.dll
%LOCALAPPDATA%\raff txt to sub\is-he58g.tmp в %LOCALAPPDATA%\raff txt to sub\libgdk-win32-2.0-0.dll
%LOCALAPPDATA%\raff txt to sub\is-ehrhk.tmp в %LOCALAPPDATA%\raff txt to sub\libgcc_s_dw2-1.dll
%LOCALAPPDATA%\raff txt to sub\is-6b5q2.tmp в %LOCALAPPDATA%\raff txt to sub\liblcms2-2.dll
%LOCALAPPDATA%\raff txt to sub\is-o8lmi.tmp в %LOCALAPPDATA%\raff txt to sub\txttosub32_64.exe