Trojan.MulDrop38.18536

Техническая информация

Для обеспечения автозапуска и распространения

Модифицирует следующие ключи реестра

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Shell' = 'explorer.exe, <Полный путь к файлу>'

Изменения в файловой системе

Создает следующие файлы

%TEMP%\_mei7082\sdl2.dll
%TEMP%\_mei7082\sdl2_image.dll
%TEMP%\_mei7082\sdl2_mixer.dll
%TEMP%\_mei7082\sdl2_ttf.dll
%TEMP%\_mei7082\vcruntime140.dll
%TEMP%\_mei7082\vcruntime140_1.dll
%TEMP%\_mei7082\_asyncio.pyd
%TEMP%\_mei7082\_bz2.pyd
%TEMP%\_mei7082\_ctypes.pyd
%TEMP%\_mei7082\_decimal.pyd
%TEMP%\_mei7082\_hashlib.pyd
%TEMP%\_mei7082\_lzma.pyd
%TEMP%\_mei7082\_multiprocessing.pyd
%TEMP%\_mei7082\_overlapped.pyd
%TEMP%\_mei7082\_queue.pyd
%TEMP%\_mei7082\_socket.pyd
%TEMP%\_mei7082\_ssl.pyd
%TEMP%\_mei7082\_wmi.pyd
%TEMP%\_mei7082\base_library.zip
%TEMP%\_mei7082\freetype.dll
%TEMP%\_mei7082\image.jpeg
%TEMP%\_mei7082\libcrypto-3.dll
%TEMP%\_mei7082\libffi-8.dll
%TEMP%\_mei7082\libjpeg-9.dll
%TEMP%\_mei7082\libmodplug-1.dll
%TEMP%\_mei7082\libogg-0.dll
%TEMP%\_mei7082\libopus-0.dll
%TEMP%\_mei7082\libopusfile-0.dll
%TEMP%\_mei7082\libpng16-16.dll
%TEMP%\_mei7082\libssl-3.dll
%TEMP%\_mei7082\libtiff-5.dll
%TEMP%\_mei7082\libwebp-7.dll
%TEMP%\_mei7082\portmidi.dll
%TEMP%\_mei7082\pyexpat.pyd
%TEMP%\_mei7082\pygame\sdl2.dll
%TEMP%\_mei7082\pygame\sdl2_image.dll
%TEMP%\_mei7082\pygame\sdl2_mixer.dll
%TEMP%\_mei7082\pygame\sdl2_ttf.dll
%TEMP%\_mei7082\pygame\_freetype.cp312-win_amd64.pyd
%TEMP%\_mei7082\pygame\base.cp312-win_amd64.pyd
%TEMP%\_mei7082\pygame\bufferproxy.cp312-win_amd64.pyd
%TEMP%\_mei7082\pygame\color.cp312-win_amd64.pyd
%TEMP%\_mei7082\pygame\constants.cp312-win_amd64.pyd
%TEMP%\_mei7082\pygame\display.cp312-win_amd64.pyd
%TEMP%\_mei7082\pygame\draw.cp312-win_amd64.pyd
%TEMP%\_mei7082\pygame\event.cp312-win_amd64.pyd
%TEMP%\_mei7082\pygame\font.cp312-win_amd64.pyd
%TEMP%\_mei7082\pygame\freesansbold.ttf
%TEMP%\_mei7082\pygame\freetype.dll
%TEMP%\_mei7082\pygame\image.cp312-win_amd64.pyd
%TEMP%\_mei7082\pygame\imageext.cp312-win_amd64.pyd
%TEMP%\_mei7082\pygame\joystick.cp312-win_amd64.pyd
%TEMP%\_mei7082\pygame\key.cp312-win_amd64.pyd
%TEMP%\_mei7082\pygame\libjpeg-9.dll
%TEMP%\_mei7082\pygame\libogg-0.dll
%TEMP%\_mei7082\pygame\libopus-0.dll
%TEMP%\_mei7082\pygame\libpng16-16.dll
%TEMP%\_mei7082\pygame\mask.cp312-win_amd64.pyd
%TEMP%\_mei7082\pygame\math.cp312-win_amd64.pyd
%TEMP%\_mei7082\pygame\mixer.cp312-win_amd64.pyd
%TEMP%\_mei7082\pygame\mixer_music.cp312-win_amd64.pyd
%TEMP%\_mei7082\pygame\mouse.cp312-win_amd64.pyd
%TEMP%\_mei7082\pygame\pixelarray.cp312-win_amd64.pyd
%TEMP%\_mei7082\pygame\pixelcopy.cp312-win_amd64.pyd
%TEMP%\_mei7082\pygame\pygame_icon.bmp
%TEMP%\_mei7082\pygame\rect.cp312-win_amd64.pyd
%TEMP%\_mei7082\pygame\rwobject.cp312-win_amd64.pyd
%TEMP%\_mei7082\pygame\scrap.cp312-win_amd64.pyd
%TEMP%\_mei7082\pygame\surface.cp312-win_amd64.pyd
%TEMP%\_mei7082\pygame\surflock.cp312-win_amd64.pyd
%TEMP%\_mei7082\pygame\time.cp312-win_amd64.pyd
%TEMP%\_mei7082\pygame\transform.cp312-win_amd64.pyd
%TEMP%\_mei7082\pygame\zlib1.dll
%TEMP%\_mei7082\python312.dll
%TEMP%\_mei7082\select.pyd
%TEMP%\_mei7082\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\installer
%TEMP%\_mei7082\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\license
%TEMP%\_mei7082\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\metadata
%TEMP%\_mei7082\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\record
%TEMP%\_mei7082\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\wheel
%TEMP%\_mei7082\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\top_level.txt
%TEMP%\_mei7082\setuptools\_vendor\jaraco\text\lorem ipsum.txt
%TEMP%\_mei7082\sound.mp3
%TEMP%\_mei7082\unicodedata.pyd
%TEMP%\_mei7082\zlib1.dll