Trojan.MulDrop28.35319

Техническая информация

Для обеспечения автозапуска и распространения

Устанавливает следующие настройки сервисов

[HKLM\System\CurrentControlSet\Services\DW Edit Control 10.30.46] 'Start' = '00000002'
[HKLM\System\CurrentControlSet\Services\DW Edit Control 10.30.46] 'ImagePath' = '%ALLUSERSPROFILE%\DW Edit Control 10.30.46\DW Edit Control 10.30.46.exe'

Создает следующие сервисы

'DW Edit Control 10.30.46' %ALLUSERSPROFILE%\DW Edit Control 10.30.46\DW Edit Control 10.30.46.exe

Изменения в файловой системе

Создает следующие файлы

%TEMP%\is-2eu83.tmp\<Имя файла>.tmp
%LOCALAPPDATA%\ascreenrecorder\is-52rue.tmp
%LOCALAPPDATA%\ascreenrecorder\is-3nnqe.tmp
%LOCALAPPDATA%\ascreenrecorder\is-pfvni.tmp
%LOCALAPPDATA%\ascreenrecorder\is-mhtvg.tmp
%LOCALAPPDATA%\ascreenrecorder\is-a5emf.tmp
%LOCALAPPDATA%\ascreenrecorder\is-kf9lj.tmp
%LOCALAPPDATA%\ascreenrecorder\is-hv8sp.tmp
%LOCALAPPDATA%\ascreenrecorder\ascreenrecorder3.exe
%LOCALAPPDATA%\ascreenrecorder\is-bpkvr.tmp
%LOCALAPPDATA%\ascreenrecorder\is-e2nnd.tmp
%LOCALAPPDATA%\ascreenrecorder\is-hqcmf.tmp
%LOCALAPPDATA%\ascreenrecorder\is-2l202.tmp
%LOCALAPPDATA%\ascreenrecorder\is-c6in9.tmp
%LOCALAPPDATA%\ascreenrecorder\unins000.dat
%LOCALAPPDATA%\ascreenrecorder\is-6hi2g.tmp
%LOCALAPPDATA%\ascreenrecorder\is-8tted.tmp
%LOCALAPPDATA%\ascreenrecorder\is-kern5.tmp
%LOCALAPPDATA%\ascreenrecorder\is-6mtaq.tmp
%TEMP%\is-3tc8j.tmp\_isetup\_setup64.tmp
%TEMP%\is-3tc8j.tmp\_isetup\_shfoldr.dll
%TEMP%\is-3tc8j.tmp\_isetup\_iscrypt.dll
%LOCALAPPDATA%\ascreenrecorder\is-al215.tmp
%LOCALAPPDATA%\ascreenrecorder\is-8idt6.tmp
%LOCALAPPDATA%\ascreenrecorder\is-vhcfi.tmp
%LOCALAPPDATA%\ascreenrecorder\is-rfhf8.tmp
%LOCALAPPDATA%\ascreenrecorder\is-a6jf0.tmp
%LOCALAPPDATA%\ascreenrecorder\is-nvtin.tmp
%LOCALAPPDATA%\ascreenrecorder\is-mh769.tmp
%LOCALAPPDATA%\ascreenrecorder\is-if0jc.tmp
%LOCALAPPDATA%\ascreenrecorder\is-mrmd0.tmp
%LOCALAPPDATA%\ascreenrecorder\is-rht6f.tmp
%LOCALAPPDATA%\ascreenrecorder\is-3k840.tmp
%LOCALAPPDATA%\ascreenrecorder\is-22rq5.tmp
%ALLUSERSPROFILE%\dw edit control 10.30.46\dw edit control 10.30.46.exe

Перемещает следующие файлы

%LOCALAPPDATA%\ascreenrecorder\is-al215.tmp в %LOCALAPPDATA%\ascreenrecorder\unins000.exe
%LOCALAPPDATA%\ascreenrecorder\is-hqcmf.tmp в %LOCALAPPDATA%\ascreenrecorder\libtiff-5.dll
%LOCALAPPDATA%\ascreenrecorder\is-e2nnd.tmp в %LOCALAPPDATA%\ascreenrecorder\libsigc-2.0-0.dll
%LOCALAPPDATA%\ascreenrecorder\is-bpkvr.tmp в %LOCALAPPDATA%\ascreenrecorder\librsvg-2-2.dll
%LOCALAPPDATA%\ascreenrecorder\is-hv8sp.tmp в %LOCALAPPDATA%\ascreenrecorder\libpng16-16.dll
%LOCALAPPDATA%\ascreenrecorder\is-8tted.tmp в %LOCALAPPDATA%\ascreenrecorder\libpixman-1-0.dll
%LOCALAPPDATA%\ascreenrecorder\is-kf9lj.tmp в %LOCALAPPDATA%\ascreenrecorder\libpcre-1.dll
%LOCALAPPDATA%\ascreenrecorder\is-a5emf.tmp в %LOCALAPPDATA%\ascreenrecorder\libpangowin32-1.0-0.dll
%LOCALAPPDATA%\ascreenrecorder\is-mhtvg.tmp в %LOCALAPPDATA%\ascreenrecorder\libpangomm-1.4-1.dll
%LOCALAPPDATA%\ascreenrecorder\is-pfvni.tmp в %LOCALAPPDATA%\ascreenrecorder\libpangoft2-1.0-0.dll
%LOCALAPPDATA%\ascreenrecorder\is-3nnqe.tmp в %LOCALAPPDATA%\ascreenrecorder\libpangocairo-1.0-0.dll
%LOCALAPPDATA%\ascreenrecorder\is-52rue.tmp в %LOCALAPPDATA%\ascreenrecorder\libpango-1.0-0.dll
%LOCALAPPDATA%\ascreenrecorder\is-6hi2g.tmp в %LOCALAPPDATA%\ascreenrecorder\liblzma-5.dll
%LOCALAPPDATA%\ascreenrecorder\is-kern5.tmp в %LOCALAPPDATA%\ascreenrecorder\liblcms2-2.dll
%LOCALAPPDATA%\ascreenrecorder\is-22rq5.tmp в %LOCALAPPDATA%\ascreenrecorder\libjpeg-8.dll
%LOCALAPPDATA%\ascreenrecorder\is-a6jf0.tmp в %LOCALAPPDATA%\ascreenrecorder\libintl-8.dll
%LOCALAPPDATA%\ascreenrecorder\is-3k840.tmp в %LOCALAPPDATA%\ascreenrecorder\libharfbuzz-0.dll
%LOCALAPPDATA%\ascreenrecorder\is-rht6f.tmp в %LOCALAPPDATA%\ascreenrecorder\libgraphite2.dll
%LOCALAPPDATA%\ascreenrecorder\is-mrmd0.tmp в %LOCALAPPDATA%\ascreenrecorder\libgomp-1.dll
%LOCALAPPDATA%\ascreenrecorder\is-if0jc.tmp в %LOCALAPPDATA%\ascreenrecorder\libgobject-2.0-0.dll
%LOCALAPPDATA%\ascreenrecorder\is-mh769.tmp в %LOCALAPPDATA%\ascreenrecorder\libgmodule-2.0-0.dll
%LOCALAPPDATA%\ascreenrecorder\is-nvtin.tmp в %LOCALAPPDATA%\ascreenrecorder\libglibmm-2.4-1.dll
%LOCALAPPDATA%\ascreenrecorder\is-rfhf8.tmp в %LOCALAPPDATA%\ascreenrecorder\libgdk_pixbuf-2.0-0.dll
%LOCALAPPDATA%\ascreenrecorder\is-6mtaq.tmp в %LOCALAPPDATA%\ascreenrecorder\libgdkmm-2.4-1.dll
%LOCALAPPDATA%\ascreenrecorder\is-vhcfi.tmp в %LOCALAPPDATA%\ascreenrecorder\libgdk-win32-2.0-0.dll
%LOCALAPPDATA%\ascreenrecorder\is-8idt6.tmp в %LOCALAPPDATA%\ascreenrecorder\libgcc_s_dw2-1.dll
%LOCALAPPDATA%\ascreenrecorder\is-2l202.tmp в %LOCALAPPDATA%\ascreenrecorder\libwinpthread-1.dll
%LOCALAPPDATA%\ascreenrecorder\is-c6in9.tmp в %LOCALAPPDATA%\ascreenrecorder\ascreenrecorder3.exe