Trojan.MulDrop4.59287

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] 'AppInit_DLLs' = ''
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] 'AppInit_DLLs' = 'vsmvhk.dll'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'SuNotification' = '%PROGRAM_FILES%\ShadowStor\ShadowUser\suatshut.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sunotify] 'DLLName' = 'sunotify.dll'

Создает или изменяет следующие файлы:

%ALLUSERSPROFILE%\Start Menu\Programs\Startup\ShadowUser Pro Edition.lnk

Создает следующие сервисы:

[<HKLM>\SYSTEM\ControlSet001\Services\Shadow] 'Start' = '00000000'

Вредоносные функции:

Создает и запускает на исполнение:

'%TEMP%\AIA.tmp\~0000.exe' %TEMP%\RarSFX0\INSTALL.cfg
'%TEMP%\RarSFX0\shadowuserrus1.exe'
'%TEMP%\RarSFX0\hidcon.exe' install.cmd
'%TEMP%\RarSFX0\INSTALL.exe'

Запускает на исполнение:

'<SYSTEM32>\regsvr32.exe' /s "<SYSTEM32>\SuShell.dll"
'<SYSTEM32>\cmd.exe' /c C:\~0000.bat
'<SYSTEM32>\taskkill.exe' /F /IM INSTALL.exe
'<SYSTEM32>\msiexec.exe' -Embedding 29710EA456248174A7C78581D9DB6FAB
'<SYSTEM32>\cmd.exe' /c install.cmd
'<SYSTEM32>\msiexec.exe' /i "%TEMP%\RarSFX0\ShadowUserPro25.msi" /qn /norestart
'<SYSTEM32>\msiexec.exe' /V

Изменения в файловой системе:

Создает следующие файлы:

%WINDIR%\Installer\{8DD1701B-EEB5-4687-B442-2E5333D831EE}\NewShortcut2_CED30FDD7B9A4BC3B02586B27B0993F8_2.exe
%WINDIR%\Installer\{8DD1701B-EEB5-4687-B442-2E5333D831EE}\NewShortcut3_69034DA8023548D7B41FF753DCE6FB27.chm
%WINDIR%\Installer\{8DD1701B-EEB5-4687-B442-2E5333D831EE}\NewShortcut1_CED30FDD7B9A4BC3B02586B27B0993F8_1.exe
%WINDIR%\Installer\MSI7.tmp
%WINDIR%\Installer\MSI9.tmp
%WINDIR%\Installer\MSI8.tmp
%TEMP%\shadowhlp.dll
%WINDIR%\Installer\$PatchCache$\Managed\B1071DD85BEE78644B24E235338D13EE\2.5.0\Global_System_OLEAUT32_f3.8C0C59A0_7DC8_11D2_B95D_006097C4DE24
%WINDIR%\Installer\$PatchCache$\Managed\B1071DD85BEE78644B24E235338D13EE\2.5.0\Global_System_OLEAUT32_f2.8C0C59A0_7DC8_11D2_B95D_006097C4DE24
%WINDIR%\Installer\$PatchCache$\Managed\B1071DD85BEE78644B24E235338D13EE\2.5.0\Global_System_STDOLE_f1.8C0C59A0_7DC8_11D2_B95D_006097C4DE24
%ALLUSERSPROFILE%\Start Menu\Programs\ShadowUser\ShadowUser Pro Edition.lnk
%WINDIR%\Installer\{8DD1701B-EEB5-4687-B442-2E5333D831EE}\ARPPRODUCTICON.exe
%ALLUSERSPROFILE%\Start Menu\Programs\ShadowUser\Uninstall.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\ShadowUser\Help.lnk
%TEMP%\AIA.tmp\~0000.bat
%ALLUSERSPROFILE%\Application Data\Symantec\Ghost\AutoInstall\Installed Applications\~0000.dll
%ALLUSERSPROFILE%\Application Data\Symantec\Ghost\AutoInstall\Installed Applications\~0000.exe
%TEMP%\INSTALL.aic
%ALLUSERSPROFILE%\Application Data\Symantec\Ghost\AutoInstall\Installed Applications\{B4EF75AA-47DB1E46-3a05458f-BCB9BAB000-12E2F012F560054BB3D8A0DA90268}\ACTIONS.CFG
C:\~0000.bat
%ALLUSERSPROFILE%\Application Data\Symantec\Ghost\AutoInstall\Installed Applications\{B4EF75AA-47DB1E46-3a05458f-BCB9BAB000-12E2F012F560054BB3D8A0DA90268}\FileManTrace.log
%ALLUSERSPROFILE%\Application Data\Symantec\Ghost\AutoInstall\Installed Applications\{B4EF75AA-47DB1E46-3a05458f-BCB9BAB000-12E2F012F560054BB3D8A0DA90268}\UNINSTALL.CFG
%TEMP%\AIA.tmp\~0000.shr
%TEMP%\AIA.tmp\dialog.bmp
%TEMP%\AIA.tmp\temp.shr
%TEMP%\AIA.tmp\~0000.exe
%TEMP%\AICOMPRESSOR.DLL
%TEMP%\AIA.tmp\dosshell.pif
%TEMP%\AIA.tmp\~0000.dll
%WINDIR%\Installer\MSI1.tmp
%WINDIR%\Installer\1bacf.msi
%TEMP%\RarSFX0\ShadowUserPro25.msi
%TEMP%\DLL_{8DD1701B-EEB5-4687-B442-2E5333D831EE}.ini
%WINDIR%\Installer\MSI4.tmp
%WINDIR%\Installer\MSI3.tmp
%TEMP%\RarSFX0\_ISMSIDEL.INI
%TEMP%\RarSFX0\hidcon.exe
%TEMP%\RarSFX0\shadowuserrus1.exe
%TEMP%\RarSFX0\0x0409.ini
%TEMP%\RarSFX0\Setup.INI
%TEMP%\RarSFX0\INSTALL.exe
%TEMP%\RarSFX0\install.cmd
C:\Config.Msi\1bad2.rbs
<SYSTEM32>\vsmvhk.dll
<SYSTEM32>\sunotify.dll
%PROGRAM_FILES%\ShadowStor\ShadowUser\suatshut.exe
%WINDIR%\Installer\$PatchCache$\Managed\B1071DD85BEE78644B24E235338D13EE\2.5.0\Global_Controls_COMCATDLL_f0.3207D1B0_80E5_11D2_B95D_006097C4DE24
%WINDIR%\Installer\$PatchCache$\Managed\B1071DD85BEE78644B24E235338D13EE\2.5.0\Global_System_OLEPRO32_f0.8C0C59A0_7DC8_11D2_B95D_006097C4DE24
%WINDIR%\Installer\$PatchCache$\Managed\B1071DD85BEE78644B24E235338D13EE\2.5.0\Global_VC_CRT_f0.51D569E0_8A28_11D2_B962_006097C4DE24
%WINDIR%\Installer\$PatchCache$\Managed\B1071DD85BEE78644B24E235338D13EE\2.5.0\Global_VC_MFC42ANSICore_f0.51D569E2_8A28_11D2_B962_006097C4DE24
%PROGRAM_FILES%\ShadowStor\ShadowUser\ShadowUser_Wallpaper_005.jpg
<SYSTEM32>\suappl.cpl
<DRIVERS>\shadow.sys
<SYSTEM32>\SUShell.dll
<SYSTEM32>\shadowapi.dll
%PROGRAM_FILES%\ShadowStor\ShadowUser\ShadowUserPro.chm
%PROGRAM_FILES%\ShadowStor\ShadowUser\ShadowUser.exe

Удаляет следующие файлы:

%ALLUSERSPROFILE%\Application Data\Symantec\Ghost\AutoInstall\Installed Applications\{B4EF75AA-47DB1E46-3a05458f-BCB9BAB000-12E2F012F560054BB3D8A0DA90268}\FileManTrace.log
%TEMP%\AICOMPRESSOR.DLL
%TEMP%\RarSFX0\0x0409.ini
%TEMP%\AIA.tmp\~0000.bat
%TEMP%\AIA.tmp\~0000.exe
%TEMP%\AIA.tmp\~0000.dll
%TEMP%\AIA.tmp\dosshell.pif
%TEMP%\RarSFX0\ShadowUserPro25.msi
%TEMP%\RarSFX0\shadowuserrus1.exe
%TEMP%\RarSFX0\_ISMSIDEL.INI
%TEMP%\RarSFX0\Setup.INI
%TEMP%\RarSFX0\hidcon.exe
%TEMP%\RarSFX0\install.cmd
%TEMP%\RarSFX0\INSTALL.exe
%TEMP%\AIA.tmp\dialog.bmp
%TEMP%\shadowhlp.dll
%WINDIR%\Installer\MSI7.tmp
%WINDIR%\Installer\MSI8.tmp
C:\Config.Msi\1bad2.rbs
%WINDIR%\Installer\MSI1.tmp
%WINDIR%\Installer\MSI3.tmp
%WINDIR%\Installer\MSI4.tmp
%TEMP%\AIA.tmp\temp.shr
%TEMP%\AIA.tmp\~0000.shr
%TEMP%\INSTALL.aic
%WINDIR%\Installer\1bad1.ipi
%TEMP%\DLL_{8DD1701B-EEB5-4687-B442-2E5333D831EE}.ini
%WINDIR%\Installer\MSI9.tmp
%WINDIR%\Installer\1bacf.msi