Trojan.MulDrop31.18517

Техническая информация

Для обеспечения автозапуска и распространения

Модифицирует следующие ключи реестра

[HKLM\Software\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon] 'shell' = 'Explorer.exe sIRC4.exe'

Изменения в файловой системе

Создает следующие файлы

%WINDIR%\syswow64\sirc4.exe
%WINDIR%\syswow64\dc++ share\rcx2123.tmp
%WINDIR%\syswow64\dc++ share\orbd.exe
%WINDIR%\syswow64\dc++ share\rcx2f6c.tmp
%WINDIR%\syswow64\dc++ share\pack200.exe
%WINDIR%\syswow64\dc++ share\policytool.exe
%WINDIR%\syswow64\dc++ share\rmid.exe
%WINDIR%\syswow64\dc++ share\rcx4518.tmp
%WINDIR%\syswow64\dc++ share\rmiregistry.exe
%WINDIR%\syswow64\dc++ share\rcx50f0.tmp
%WINDIR%\syswow64\dc++ share\servertool.exe
%WINDIR%\syswow64\dc++ share\rcx5b90.tmp
%WINDIR%\syswow64\dc++ share\klist.exe
%WINDIR%\syswow64\dc++ share\ktab.exe
%WINDIR%\syswow64\dc++ share\ssvagent.exe
%WINDIR%\syswow64\dc++ share\unpack200.exe
%WINDIR%\syswow64\dc++ share\mso example intl setup file a.exe
%WINDIR%\syswow64\dc++ share\rcxaf40.tmp
%WINDIR%\syswow64\dc++ share\mso example intl setup file b.exe
%WINDIR%\syswow64\dc++ share\appsharinghookcontroller64.exe
%WINDIR%\syswow64\dc++ share\mso example setup file a.exe
%WINDIR%\syswow64\dc++ share\msohtmed.exe
%WINDIR%\syswow64\dc++ share\rcxda49.tmp
%WINDIR%\syswow64\dc++ share\msoia.exe
%WINDIR%\syswow64\dc++ share\crashreporter.exe
%WINDIR%\syswow64\dc++ share\default-browser-agent.exe
%WINDIR%\syswow64\dc++ share\tnameserv.exe
%WINDIR%\syswow64\dc++ share\rcx644b.tmp
%WINDIR%\syswow64\dc++ share\rcxca0.tmp
%WINDIR%\syswow64\dc++ share\kinit.exe
%WINDIR%\syswow64\dc++ share\keytool.exe
%WINDIR%\syswow64\xdccprograms\<Имя файла>.exe
C:\rar.bat
%WINDIR%\syswow64\xdccprograms\inputpersonalization.exe
%WINDIR%\syswow64\xdccprograms\mip.exe
%WINDIR%\syswow64\xdccprograms\shapecollector.exe
%WINDIR%\syswow64\xdccprograms\tabtip.exe
%WINDIR%\syswow64\xdccprograms\msinfo32.exe
%WINDIR%\syswow64\xdccprograms\cmigrate.exe
%WINDIR%\syswow64\xdccprograms\msoxmled.exe
%WINDIR%\syswow64\xdccprograms\vstoinstaller.exe
%WINDIR%\syswow64\dc++ share\extexport.exe
%WINDIR%\syswow64\dc++ share\iediagcmd.exe
C:\marijuana.txt
%WINDIR%\syswow64\dc++ share\ieinstal.exe
%WINDIR%\syswow64\dc++ share\iexplore.exe
%WINDIR%\syswow64\dc++ share\jabswitch.exe
%WINDIR%\syswow64\dc++ share\java-rmi.exe
%WINDIR%\syswow64\dc++ share\rcxd060.tmp
%WINDIR%\syswow64\dc++ share\java.exe
%WINDIR%\syswow64\dc++ share\javacpl.exe
%WINDIR%\syswow64\dc++ share\javaw.exe
%APPDATA%\winrar\version.dat
%WINDIR%\syswow64\dc++ share\javaws.exe
%WINDIR%\syswow64\dc++ share\rcxe291.tmp
%WINDIR%\syswow64\dc++ share\jjs.exe
%WINDIR%\syswow64\dc++ share\jp2launcher.exe
%WINDIR%\syswow64\dc++ share\ielowutil.exe
%WINDIR%\syswow64\dc++ share\rcxfee9.tmp
%WINDIR%\syswow64\dc++ share\firefox.exe

Перемещает следующие файлы

%WINDIR%\syswow64\dc++ share\rcxd060.tmp в %WINDIR%\syswow64\dc++ share\java-rmi.exe
%WINDIR%\syswow64\dc++ share\rcxe291.tmp в %WINDIR%\syswow64\dc++ share\javaws.exe
%WINDIR%\syswow64\dc++ share\rcxca0.tmp в %WINDIR%\syswow64\dc++ share\kinit.exe
%WINDIR%\syswow64\dc++ share\rcx2123.tmp в %WINDIR%\syswow64\dc++ share\ktab.exe
%WINDIR%\syswow64\dc++ share\rcx2f6c.tmp в %WINDIR%\syswow64\dc++ share\orbd.exe
%WINDIR%\syswow64\dc++ share\rcx4518.tmp в %WINDIR%\syswow64\dc++ share\rmid.exe
%WINDIR%\syswow64\dc++ share\rcx50f0.tmp в %WINDIR%\syswow64\dc++ share\rmiregistry.exe
%WINDIR%\syswow64\dc++ share\rcx5b90.tmp в %WINDIR%\syswow64\dc++ share\servertool.exe
%WINDIR%\syswow64\dc++ share\rcx644b.tmp в %WINDIR%\syswow64\dc++ share\tnameserv.exe
%WINDIR%\syswow64\dc++ share\rcxaf40.tmp в %WINDIR%\syswow64\dc++ share\mso example intl setup file a.exe
%WINDIR%\syswow64\dc++ share\rcxda49.tmp в %WINDIR%\syswow64\dc++ share\msohtmed.exe
%WINDIR%\syswow64\dc++ share\rcxfee9.tmp в %WINDIR%\syswow64\dc++ share\default-browser-agent.exe

Другое

Ищет следующие окна

ClassName: 'OleMainThreadWndClass' WindowName: ''
ClassName: 'WinRarWindow' WindowName: ''

Запускает на исполнение

'%WINDIR%\syswow64\cmd.exe' /c C:\rar.bat (со скрытым окном)
'%ProgramFiles%\winrar\winrar.exe' a -idp -inul -c- -m5 "<SYSTEM32>\xdccPrograms\mip" "<SYSTEM32>\xdccPrograms\mip.exe"
'%ProgramFiles%\winrar\winrar.exe' a -idp -inul -c- -m5 "<SYSTEM32>\DC++ Share\orbd" "<SYSTEM32>\DC++ Share\orbd.exe"
'%ProgramFiles%\winrar\winrar.exe' a -idp -inul -c- -m5 "<SYSTEM32>\DC++ Share\servertool" "<SYSTEM32>\DC++ Share\servertool.exe"
'%ProgramFiles%\winrar\winrar.exe' a -idp -inul -c- -m5 "<SYSTEM32>\DC++ Share\unpack200" "<SYSTEM32>\DC++ Share\unpack200.exe"
'%ProgramFiles%\winrar\winrar.exe' a -idp -inul -c- -m5 "<SYSTEM32>\DC++ Share\Mso Example Setup File A" "<SYSTEM32>\DC++ Share\Mso Example Setup File A.exe"
'%ProgramFiles%\winrar\winrar.exe' a -idp -inul -c- -m5 "<SYSTEM32>\DC++ Share\MSOHTMED" "<SYSTEM32>\DC++ Share\MSOHTMED.exe"
'%ProgramFiles%\winrar\winrar.exe' a -idp -inul -c- -m5 "<SYSTEM32>\DC++ Share\default-browser-agent" "<SYSTEM32>\DC++ Share\default-browser-agent.exe"