Trojan.MulDrop28.34737

Техническая информация

Для обеспечения автозапуска и распространения

Устанавливает следующие настройки сервисов

[HKLM\System\CurrentControlSet\Services\DateTime Program Verifier 10.27.46] 'Start' = '00000002'
[HKLM\System\CurrentControlSet\Services\DateTime Program Verifier 10.27.46] 'ImagePath' = '%ALLUSERSPROFILE%\DateTime Program Verifier 10.27.46\DateTime Program Verifier 10.27.46.exe'

Создает следующие сервисы

'DateTime Program Verifier 10.27.46' %ALLUSERSPROFILE%\DateTime Program Verifier 10.27.46\DateTime Program Verifier 10.27.46.exe

Изменения в файловой системе

Создает следующие файлы

%TEMP%\is-9ctk8.tmp\<Имя файла>.tmp
%LOCALAPPDATA%\dan codecs portable\is-ogt0u.tmp
%LOCALAPPDATA%\dan codecs portable\is-abbdc.tmp
%LOCALAPPDATA%\dan codecs portable\is-ibomr.tmp
%LOCALAPPDATA%\dan codecs portable\is-9dtub.tmp
%LOCALAPPDATA%\dan codecs portable\is-6pdt6.tmp
%LOCALAPPDATA%\dan codecs portable\is-enilj.tmp
%LOCALAPPDATA%\dan codecs portable\is-341i0.tmp
%LOCALAPPDATA%\dan codecs portable\dancodecsportable32.exe
%LOCALAPPDATA%\dan codecs portable\is-knjec.tmp
%LOCALAPPDATA%\dan codecs portable\is-abfmj.tmp
%LOCALAPPDATA%\dan codecs portable\is-bbj2t.tmp
%LOCALAPPDATA%\dan codecs portable\is-66qgp.tmp
%LOCALAPPDATA%\dan codecs portable\is-4co79.tmp
%LOCALAPPDATA%\dan codecs portable\unins000.dat
%LOCALAPPDATA%\dan codecs portable\is-7g5i3.tmp
%LOCALAPPDATA%\dan codecs portable\is-nbr6v.tmp
%LOCALAPPDATA%\dan codecs portable\is-3p1hp.tmp
%LOCALAPPDATA%\dan codecs portable\is-j5qqd.tmp
%TEMP%\is-ho16g.tmp\_isetup\_setup64.tmp
%TEMP%\is-ho16g.tmp\_isetup\_shfoldr.dll
%TEMP%\is-ho16g.tmp\_isetup\_iscrypt.dll
%LOCALAPPDATA%\dan codecs portable\is-r05t4.tmp
%LOCALAPPDATA%\dan codecs portable\is-rtp9j.tmp
%LOCALAPPDATA%\dan codecs portable\is-8tdg6.tmp
%LOCALAPPDATA%\dan codecs portable\is-qkerp.tmp
%LOCALAPPDATA%\dan codecs portable\is-qtdqt.tmp
%LOCALAPPDATA%\dan codecs portable\is-8ai9t.tmp
%LOCALAPPDATA%\dan codecs portable\is-h97kp.tmp
%LOCALAPPDATA%\dan codecs portable\is-0vf0a.tmp
%LOCALAPPDATA%\dan codecs portable\is-3sb47.tmp
%LOCALAPPDATA%\dan codecs portable\is-u3kb2.tmp
%LOCALAPPDATA%\dan codecs portable\is-vlpdg.tmp
%LOCALAPPDATA%\dan codecs portable\is-kd345.tmp
%ALLUSERSPROFILE%\datetime program verifier 10.27.46\datetime program verifier 10.27.46.exe

Перемещает следующие файлы

%LOCALAPPDATA%\dan codecs portable\is-r05t4.tmp в %LOCALAPPDATA%\dan codecs portable\unins000.exe
%LOCALAPPDATA%\dan codecs portable\is-bbj2t.tmp в %LOCALAPPDATA%\dan codecs portable\libtiff-5.dll
%LOCALAPPDATA%\dan codecs portable\is-abfmj.tmp в %LOCALAPPDATA%\dan codecs portable\libsigc-2.0-0.dll
%LOCALAPPDATA%\dan codecs portable\is-knjec.tmp в %LOCALAPPDATA%\dan codecs portable\librsvg-2-2.dll
%LOCALAPPDATA%\dan codecs portable\is-341i0.tmp в %LOCALAPPDATA%\dan codecs portable\libpng16-16.dll
%LOCALAPPDATA%\dan codecs portable\is-nbr6v.tmp в %LOCALAPPDATA%\dan codecs portable\libpixman-1-0.dll
%LOCALAPPDATA%\dan codecs portable\is-enilj.tmp в %LOCALAPPDATA%\dan codecs portable\libpcre-1.dll
%LOCALAPPDATA%\dan codecs portable\is-6pdt6.tmp в %LOCALAPPDATA%\dan codecs portable\libpangowin32-1.0-0.dll
%LOCALAPPDATA%\dan codecs portable\is-9dtub.tmp в %LOCALAPPDATA%\dan codecs portable\libpangomm-1.4-1.dll
%LOCALAPPDATA%\dan codecs portable\is-ibomr.tmp в %LOCALAPPDATA%\dan codecs portable\libpangoft2-1.0-0.dll
%LOCALAPPDATA%\dan codecs portable\is-abbdc.tmp в %LOCALAPPDATA%\dan codecs portable\libpangocairo-1.0-0.dll
%LOCALAPPDATA%\dan codecs portable\is-ogt0u.tmp в %LOCALAPPDATA%\dan codecs portable\libpango-1.0-0.dll
%LOCALAPPDATA%\dan codecs portable\is-7g5i3.tmp в %LOCALAPPDATA%\dan codecs portable\liblzma-5.dll
%LOCALAPPDATA%\dan codecs portable\is-3p1hp.tmp в %LOCALAPPDATA%\dan codecs portable\liblcms2-2.dll
%LOCALAPPDATA%\dan codecs portable\is-kd345.tmp в %LOCALAPPDATA%\dan codecs portable\libjpeg-8.dll
%LOCALAPPDATA%\dan codecs portable\is-qtdqt.tmp в %LOCALAPPDATA%\dan codecs portable\libintl-8.dll
%LOCALAPPDATA%\dan codecs portable\is-vlpdg.tmp в %LOCALAPPDATA%\dan codecs portable\libharfbuzz-0.dll
%LOCALAPPDATA%\dan codecs portable\is-u3kb2.tmp в %LOCALAPPDATA%\dan codecs portable\libgraphite2.dll
%LOCALAPPDATA%\dan codecs portable\is-3sb47.tmp в %LOCALAPPDATA%\dan codecs portable\libgomp-1.dll
%LOCALAPPDATA%\dan codecs portable\is-0vf0a.tmp в %LOCALAPPDATA%\dan codecs portable\libgobject-2.0-0.dll
%LOCALAPPDATA%\dan codecs portable\is-h97kp.tmp в %LOCALAPPDATA%\dan codecs portable\libgmodule-2.0-0.dll
%LOCALAPPDATA%\dan codecs portable\is-8ai9t.tmp в %LOCALAPPDATA%\dan codecs portable\libglibmm-2.4-1.dll
%LOCALAPPDATA%\dan codecs portable\is-qkerp.tmp в %LOCALAPPDATA%\dan codecs portable\libgdk_pixbuf-2.0-0.dll
%LOCALAPPDATA%\dan codecs portable\is-j5qqd.tmp в %LOCALAPPDATA%\dan codecs portable\libgdkmm-2.4-1.dll
%LOCALAPPDATA%\dan codecs portable\is-8tdg6.tmp в %LOCALAPPDATA%\dan codecs portable\libgdk-win32-2.0-0.dll
%LOCALAPPDATA%\dan codecs portable\is-rtp9j.tmp в %LOCALAPPDATA%\dan codecs portable\libgcc_s_dw2-1.dll
%LOCALAPPDATA%\dan codecs portable\is-66qgp.tmp в %LOCALAPPDATA%\dan codecs portable\libwinpthread-1.dll
%LOCALAPPDATA%\dan codecs portable\is-4co79.tmp в %LOCALAPPDATA%\dan codecs portable\dancodecsportable32.exe

Другое

Ищет следующие окна

ClassName: 'be09c1_DTVER_10273_be09c1' WindowName: ''

Создает и запускает на исполнение

'%TEMP%\is-9ctk8.tmp\<Имя файла>.tmp' /SL5="$5024C,3906351,54272,<Полный путь к файлу>"
'%LOCALAPPDATA%\dan codecs portable\dancodecsportable32.exe' -i