Trojan.MulDrop28.42643

Техническая информация

Для обеспечения автозапуска и распространения

Устанавливает следующие настройки сервисов

[HKLM\System\CurrentControlSet\Services\EShineEncoder] 'Start' = '00000002'
[HKLM\System\CurrentControlSet\Services\EShineEncoder] 'ImagePath' = '%ALLUSERSPROFILE%\EShineEncoder\EShineEncoder.exe'

Создает следующие сервисы

'EShineEncoder' %ALLUSERSPROFILE%\EShineEncoder\EShineEncoder.exe

Изменения в файловой системе

Создает следующие файлы

%TEMP%\is-m80fb.tmp\<Имя файла>.tmp
%LOCALAPPDATA%\flashback express 1.25.3.44\flashbackexpress360.exe
%LOCALAPPDATA%\flashback express 1.25.3.44\uninstall\unins000.dat
%LOCALAPPDATA%\flashback express 1.25.3.44\is-eb1cq.tmp
%LOCALAPPDATA%\flashback express 1.25.3.44\is-fph1k.tmp
%LOCALAPPDATA%\flashback express 1.25.3.44\library\is-clcm8.tmp
%LOCALAPPDATA%\flashback express 1.25.3.44\library\is-l8mpq.tmp
%LOCALAPPDATA%\flashback express 1.25.3.44\library\is-4jk9p.tmp
%LOCALAPPDATA%\flashback express 1.25.3.44\library\is-1q4g1.tmp
%LOCALAPPDATA%\flashback express 1.25.3.44\library\is-ke9fa.tmp
%LOCALAPPDATA%\flashback express 1.25.3.44\library\is-nmbp1.tmp
%LOCALAPPDATA%\flashback express 1.25.3.44\library\is-ll8b1.tmp
%LOCALAPPDATA%\flashback express 1.25.3.44\library\is-vp58s.tmp
%LOCALAPPDATA%\flashback express 1.25.3.44\library\is-pcj79.tmp
%ALLUSERSPROFILE%\eshineencoder\eshineencoder.exe
%LOCALAPPDATA%\flashback express 1.25.3.44\library\is-f0fkq.tmp
%LOCALAPPDATA%\flashback express 1.25.3.44\library\is-8c95d.tmp
%LOCALAPPDATA%\flashback express 1.25.3.44\library\is-l1cmd.tmp
%LOCALAPPDATA%\flashback express 1.25.3.44\library\is-p07oe.tmp
%LOCALAPPDATA%\flashback express 1.25.3.44\is-9sbna.tmp
%LOCALAPPDATA%\flashback express 1.25.3.44\is-t5jiu.tmp
%LOCALAPPDATA%\flashback express 1.25.3.44\is-591ot.tmp
%LOCALAPPDATA%\flashback express 1.25.3.44\is-70835.tmp
%LOCALAPPDATA%\flashback express 1.25.3.44\is-b43ar.tmp
%LOCALAPPDATA%\flashback express 1.25.3.44\uninstall\is-b6vik.tmp
%TEMP%\is-k29f1.tmp\_isetup\_iscrypt.dll
%TEMP%\is-k29f1.tmp\_isetup\_shfoldr.dll
%TEMP%\is-k29f1.tmp\_isetup\_setup64.tmp
%TEMP%\is-k29f1.tmp\_isetup\_regdll.tmp
%LOCALAPPDATA%\flashback express 1.25.3.44\library\is-ttiep.tmp
%ALLUSERSPROFILE%\eshineencoder\sqlite3.dll

Перемещает следующие файлы

%LOCALAPPDATA%\flashback express 1.25.3.44\uninstall\is-b6vik.tmp в %LOCALAPPDATA%\flashback express 1.25.3.44\uninstall\unins000.exe
%LOCALAPPDATA%\flashback express 1.25.3.44\library\is-clcm8.tmp в %LOCALAPPDATA%\flashback express 1.25.3.44\library\winter.scal
%LOCALAPPDATA%\flashback express 1.25.3.44\library\is-l8mpq.tmp в %LOCALAPPDATA%\flashback express 1.25.3.44\library\weather.scal
%LOCALAPPDATA%\flashback express 1.25.3.44\library\is-4jk9p.tmp в %LOCALAPPDATA%\flashback express 1.25.3.44\library\symbols.scal
%LOCALAPPDATA%\flashback express 1.25.3.44\library\is-1q4g1.tmp в %LOCALAPPDATA%\flashback express 1.25.3.44\library\swirls.scal
%LOCALAPPDATA%\flashback express 1.25.3.44\library\is-ke9fa.tmp в %LOCALAPPDATA%\flashback express 1.25.3.44\library\summer.scal
%LOCALAPPDATA%\flashback express 1.25.3.44\library\is-nmbp1.tmp в %LOCALAPPDATA%\flashback express 1.25.3.44\library\spring.scal
%LOCALAPPDATA%\flashback express 1.25.3.44\library\is-ll8b1.tmp в %LOCALAPPDATA%\flashback express 1.25.3.44\library\newborn.scal
%LOCALAPPDATA%\flashback express 1.25.3.44\library\is-vp58s.tmp в %LOCALAPPDATA%\flashback express 1.25.3.44\library\music.scal
%LOCALAPPDATA%\flashback express 1.25.3.44\library\is-pcj79.tmp в %LOCALAPPDATA%\flashback express 1.25.3.44\library\michellemybelle creations.scal
%LOCALAPPDATA%\flashback express 1.25.3.44\library\is-f0fkq.tmp в %LOCALAPPDATA%\flashback express 1.25.3.44\library\game.scal
%LOCALAPPDATA%\flashback express 1.25.3.44\library\is-ttiep.tmp в %LOCALAPPDATA%\flashback express 1.25.3.44\library\fall.scal
%LOCALAPPDATA%\flashback express 1.25.3.44\library\is-8c95d.tmp в %LOCALAPPDATA%\flashback express 1.25.3.44\library\createinspain designs.scal
%LOCALAPPDATA%\flashback express 1.25.3.44\library\is-l1cmd.tmp в %LOCALAPPDATA%\flashback express 1.25.3.44\library\basic shapes.scal
%LOCALAPPDATA%\flashback express 1.25.3.44\library\is-p07oe.tmp в %LOCALAPPDATA%\flashback express 1.25.3.44\library\arrows.scal
%LOCALAPPDATA%\flashback express 1.25.3.44\is-9sbna.tmp в %LOCALAPPDATA%\flashback express 1.25.3.44\winsparkle.dll
%LOCALAPPDATA%\flashback express 1.25.3.44\is-t5jiu.tmp в %LOCALAPPDATA%\flashback express 1.25.3.44\ch375dll.dll
%LOCALAPPDATA%\flashback express 1.25.3.44\is-591ot.tmp в %LOCALAPPDATA%\flashback express 1.25.3.44\cairogfx.dll
%LOCALAPPDATA%\flashback express 1.25.3.44\is-70835.tmp в %LOCALAPPDATA%\flashback express 1.25.3.44\msvcr71.dll
%LOCALAPPDATA%\flashback express 1.25.3.44\is-b43ar.tmp в %LOCALAPPDATA%\flashback express 1.25.3.44\msvcp71.dll
%LOCALAPPDATA%\flashback express 1.25.3.44\is-fph1k.tmp в %LOCALAPPDATA%\flashback express 1.25.3.44\sqlite3.dll
%LOCALAPPDATA%\flashback express 1.25.3.44\is-eb1cq.tmp в %LOCALAPPDATA%\flashback express 1.25.3.44\flashbackexpress360.exe

Другое

Ищет следующие окна

ClassName: 'f1c685_shineenc_11163_f1c685' WindowName: ''

Создает и запускает на исполнение

'%TEMP%\is-m80fb.tmp\<Имя файла>.tmp' /SL5="$60248,4319793,54272,<Полный путь к файлу>"
'%LOCALAPPDATA%\flashback express 1.25.3.44\flashbackexpress360.exe' -i

Запускает на исполнение