Trojan.MulDrop5.2977

Техническая информация

Для обеспечения автозапуска и распространения:

Создает следующие сервисы:

[<HKLM>\SYSTEM\ControlSet001\Services\fsproflt] 'Start' = '00000002'
[<HKLM>\SYSTEM\ControlSet001\Services\FSProFilter] 'Start' = '00000000'

Вредоносные функции:

Создает и запускает на исполнение:

'<SYSTEM32>\fsproflt.exe'
'%TEMP%\is-FL7D2.tmp\setup.tmp' /SL5="$200F0,1211209,53248,%TEMP%\RarSFX0\setup.exe" /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-
'%TEMP%\RarSFX0\setup.exe' /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-

Запускает на исполнение:

'<SYSTEM32>\fltMc.exe' load FSProFilter
'<SYSTEM32>\sc.exe' create fsproflt binPath= <SYSTEM32>\fsproflt.exe DisplayName= "FSPro Filter Service" Start= Auto
'<SYSTEM32>\sc.exe' start fsproflt
'<SYSTEM32>\cmd.exe' /c ""%TEMP%\RarSFX0\auto.bat" "
'<SYSTEM32>\sc.exe' stop fsproflt
'<SYSTEM32>\sc.exe' create FSProFilter binPath= System32\Drivers\FSPFltd.sys Type= filesys start= boot DisplayName= "FSPro File Filter" group= "FSFilter Content Screener" depend= FltMgr tag= yes

Изменения в файловой системе:

Создает следующие файлы:

%PROGRAM_FILES%\Hide Folders 2009\langs\is-6M9NG.tmp
%PROGRAM_FILES%\Hide Folders 2009\langs\is-8R52S.tmp
%PROGRAM_FILES%\Hide Folders 2009\langs\is-0NGK5.tmp
%PROGRAM_FILES%\Hide Folders 2009\langs\is-K9EBT.tmp
%PROGRAM_FILES%\Hide Folders 2009\langs\is-005J4.tmp
%PROGRAM_FILES%\Hide Folders 2009\langs\is-37HFC.tmp
%PROGRAM_FILES%\Hide Folders 2009\langs\is-9M0H6.tmp
%PROGRAM_FILES%\Hide Folders 2009\langs\is-8JF73.tmp
%PROGRAM_FILES%\Hide Folders 2009\langs\is-QFR8L.tmp
%HOMEPATH%\Desktop\Hide Folders 2009.lnk
%HOMEPATH%\Start Menu\Programs\Hide Folders 2009\Uninstall Hide Folders 2009.lnk
%PROGRAM_FILES%\Hide Folders 2009\unins000.dat
%PROGRAM_FILES%\Hide Folders 2009\unins000.msg
%HOMEPATH%\Start Menu\Programs\Hide Folders 2009\Buy Hide Folders 2009 Now!.lnk
%HOMEPATH%\Start Menu\Programs\Hide Folders 2009\Hide Folders 2009 Homepage....lnk
%HOMEPATH%\Start Menu\Programs\Hide Folders 2009\Hide Folders 2009 Help.lnk
%HOMEPATH%\Start Menu\Programs\Hide Folders 2009\Hide Folders 2009.lnk
%PROGRAM_FILES%\Hide Folders 2009\langs\is-PEORG.tmp
%TEMP%\is-CO9CG.tmp\_isetup\_iscrypt.dll
%TEMP%\is-CO9CG.tmp\_isetup\_shfoldr.dll
%PROGRAM_FILES%\Hide Folders 2009\is-1TKAD.tmp
%PROGRAM_FILES%\Hide Folders 2009\is-1DVFE.tmp
%TEMP%\RarSFX0\setup.exe
%TEMP%\RarSFX0\auto.bat
%TEMP%\is-CO9CG.tmp\_isetup\_RegDLL.tmp
%TEMP%\is-FL7D2.tmp\setup.tmp
%PROGRAM_FILES%\Hide Folders 2009\is-OG4EE.tmp
%PROGRAM_FILES%\Hide Folders 2009\is-8ORLG.tmp
%PROGRAM_FILES%\Hide Folders 2009\is-CNN1A.tmp
<SYSTEM32>\is-CHI1O.tmp
<DRIVERS>\is-1MOUL.tmp
%PROGRAM_FILES%\Hide Folders 2009\is-BORGE.tmp
%PROGRAM_FILES%\Hide Folders 2009\is-774KT.tmp
%PROGRAM_FILES%\Hide Folders 2009\is-ONR54.tmp
%PROGRAM_FILES%\Hide Folders 2009\is-EE32B.tmp

Удаляет следующие файлы:

%TEMP%\is-FL7D2.tmp\setup.tmp
%TEMP%\RarSFX0\auto.bat
%TEMP%\RarSFX0\setup.exe
%TEMP%\is-CO9CG.tmp\_isetup\_shfoldr.dll
%PROGRAM_FILES%\Hide Folders 2009\license.txt
%TEMP%\is-CO9CG.tmp\_isetup\_iscrypt.dll
%TEMP%\is-CO9CG.tmp\_isetup\_RegDLL.tmp

Перемещает следующие файлы:

%PROGRAM_FILES%\Hide Folders 2009\langs\is-8JF73.tmp в %PROGRAM_FILES%\Hide Folders 2009\langs\Finnish.lng
%PROGRAM_FILES%\Hide Folders 2009\langs\is-9M0H6.tmp в %PROGRAM_FILES%\Hide Folders 2009\langs\French.lng
%PROGRAM_FILES%\Hide Folders 2009\langs\is-005J4.tmp в %PROGRAM_FILES%\Hide Folders 2009\langs\English.lng
%PROGRAM_FILES%\Hide Folders 2009\langs\is-PEORG.tmp в %PROGRAM_FILES%\Hide Folders 2009\langs\Arabic.lng
%PROGRAM_FILES%\Hide Folders 2009\langs\is-37HFC.tmp в %PROGRAM_FILES%\Hide Folders 2009\langs\Danish.lng
%PROGRAM_FILES%\Hide Folders 2009\langs\is-0NGK5.tmp в %PROGRAM_FILES%\Hide Folders 2009\langs\Spanish.lng
%PROGRAM_FILES%\Hide Folders 2009\langs\is-QFR8L.tmp в %PROGRAM_FILES%\Hide Folders 2009\langs\Spanish[LA].lng
%PROGRAM_FILES%\Hide Folders 2009\langs\is-K9EBT.tmp в %PROGRAM_FILES%\Hide Folders 2009\langs\Russian.lng
%PROGRAM_FILES%\Hide Folders 2009\langs\is-8R52S.tmp в %PROGRAM_FILES%\Hide Folders 2009\langs\German.lng
%PROGRAM_FILES%\Hide Folders 2009\langs\is-6M9NG.tmp в %PROGRAM_FILES%\Hide Folders 2009\langs\Portuguese.lng
<SYSTEM32>\is-CHI1O.tmp в <SYSTEM32>\fsproflt.exe
%PROGRAM_FILES%\Hide Folders 2009\is-774KT.tmp в %PROGRAM_FILES%\Hide Folders 2009\FSPFlt.dll
%PROGRAM_FILES%\Hide Folders 2009\is-BORGE.tmp в %PROGRAM_FILES%\Hide Folders 2009\license.txt
%PROGRAM_FILES%\Hide Folders 2009\is-OG4EE.tmp в %PROGRAM_FILES%\Hide Folders 2009\hf.chm
%PROGRAM_FILES%\Hide Folders 2009\is-1DVFE.tmp в %PROGRAM_FILES%\Hide Folders 2009\unins000.exe
%PROGRAM_FILES%\Hide Folders 2009\is-1TKAD.tmp в %PROGRAM_FILES%\Hide Folders 2009\hf.exe
%PROGRAM_FILES%\Hide Folders 2009\is-8ORLG.tmp в %PROGRAM_FILES%\Hide Folders 2009\Buynow.url
<DRIVERS>\is-1MOUL.tmp в <DRIVERS>\FSPFltd.sys
%PROGRAM_FILES%\Hide Folders 2009\is-CNN1A.tmp в %PROGRAM_FILES%\Hide Folders 2009\Homepage.url
%PROGRAM_FILES%\Hide Folders 2009\is-EE32B.tmp в %PROGRAM_FILES%\Hide Folders 2009\license.txt
%PROGRAM_FILES%\Hide Folders 2009\is-ONR54.tmp в %PROGRAM_FILES%\Hide Folders 2009\whatsnew.txt