Trojan.MulDrop5.8327

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKLM>\SOFTWARE\Classes\MSProgramGroup\Shell\Open\Command] '' = '<SYSTEM32>\grpconv.exe %1'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] 'GrpConv' = 'grpconv -o'

Вредоносные функции:

Запускает на исполнение:

'<SYSTEM32>\grpconv.exe' -o
'<SYSTEM32>\regsvr32.exe' <SYSTEM32>\macromed\director\swdir.dll /s
'<SYSTEM32>\rundll32.exe' setupapi,InstallHinfSection DefaultInstall 132 %TEMP%\swdir.inf
'<SYSTEM32>\runonce.exe' -r

Изменения в файловой системе:

Создает следующие файлы:

<SYSTEM32>\Macromed\Shockwave\Xtras\SET1B.tmp
<SYSTEM32>\Macromed\Shockwave\Xtras\SET1A.tmp
<SYSTEM32>\Macromed\Shockwave\Xtras\SET1C.tmp
<SYSTEM32>\Macromed\Shockwave\Xtras\SET1E.tmp
<SYSTEM32>\Macromed\Shockwave\Xtras\SET1D.tmp
<SYSTEM32>\Macromed\Shockwave\Xtras\SET16.tmp
<SYSTEM32>\Macromed\Shockwave\Xtras\SET15.tmp
<SYSTEM32>\Macromed\Shockwave\Xtras\SET17.tmp
<SYSTEM32>\Macromed\Shockwave\Xtras\SET19.tmp
<SYSTEM32>\Macromed\Shockwave\Xtras\SET18.tmp
<SYSTEM32>\Macromed\Shockwave\Xtras\SET25.tmp
<SYSTEM32>\Macromed\Shockwave\Xtras\SET24.tmp
<SYSTEM32>\Macromed\Shockwave\Xtras\SET26.tmp
<SYSTEM32>\Macromed\Shockwave\Shockwave Log
%WINDIR%\inf\SET29.tmp
<SYSTEM32>\Macromed\Shockwave\Xtras\SET20.tmp
<SYSTEM32>\Macromed\Shockwave\Xtras\SET1F.tmp
<SYSTEM32>\Macromed\Shockwave\Xtras\SET21.tmp
<SYSTEM32>\Macromed\Shockwave\Xtras\SET23.tmp
<SYSTEM32>\Macromed\Shockwave\Xtras\SET22.tmp
<SYSTEM32>\Macromed\Director\SET7.tmp
<SYSTEM32>\Macromed\Director\SET6.tmp
<SYSTEM32>\Macromed\Director\SET8.tmp
<SYSTEM32>\Macromed\Shockwave\SETA.tmp
<SYSTEM32>\Macromed\Shockwave\SET9.tmp
%TEMP%\swdir.inf
%TEMP%\swdir.cab
<SYSTEM32>\Macromed\Director\SET3.tmp
<SYSTEM32>\Macromed\Director\SET5.tmp
<SYSTEM32>\Macromed\Director\SET4.tmp
<SYSTEM32>\Macromed\Shockwave\Xtras\SET11.tmp
<SYSTEM32>\Macromed\Shockwave\Xtras\SET10.tmp
<SYSTEM32>\Macromed\Shockwave\Xtras\SET12.tmp
<SYSTEM32>\Macromed\Shockwave\Xtras\SET14.tmp
<SYSTEM32>\Macromed\Shockwave\Xtras\SET13.tmp
<SYSTEM32>\Macromed\Shockwave\SETC.tmp
<SYSTEM32>\Macromed\Shockwave\SETB.tmp
<SYSTEM32>\Macromed\Shockwave\Xtras\SETD.tmp
<SYSTEM32>\Macromed\Shockwave\Xtras\SETF.tmp
<SYSTEM32>\Macromed\Shockwave\Xtras\SETE.tmp

Удаляет следующие файлы:

<SYSTEM32>\Macromed\Shockwave\Xtras\SET1D.tmp
<SYSTEM32>\Macromed\Shockwave\Xtras\SET1F.tmp
<SYSTEM32>\Macromed\Shockwave\Xtras\SET1B.tmp
<SYSTEM32>\Macromed\Shockwave\Xtras\SET17.tmp
<SYSTEM32>\Macromed\Shockwave\Xtras\SET19.tmp
%TEMP%\swdir.cab
%TEMP%\swdir.inf
<SYSTEM32>\Macromed\Shockwave\Xtras\SET25.tmp
<SYSTEM32>\Macromed\Shockwave\Xtras\SET21.tmp
<SYSTEM32>\Macromed\Shockwave\Xtras\SET23.tmp
<SYSTEM32>\Macromed\Shockwave\SET9.tmp
<SYSTEM32>\Macromed\Shockwave\SETB.tmp
<SYSTEM32>\Macromed\Director\SET7.tmp
<SYSTEM32>\Macromed\Director\SET3.tmp
<SYSTEM32>\Macromed\Director\SET5.tmp
<SYSTEM32>\Macromed\Shockwave\Xtras\SET13.tmp
<SYSTEM32>\Macromed\Shockwave\Xtras\SET15.tmp
<SYSTEM32>\Macromed\Shockwave\Xtras\SET11.tmp
<SYSTEM32>\Macromed\Shockwave\Xtras\SETD.tmp
<SYSTEM32>\Macromed\Shockwave\Xtras\SETF.tmp

Перемещает следующие файлы:

<SYSTEM32>\Macromed\Shockwave\Xtras\SET1C.tmp в <SYSTEM32>\Macromed\Shockwave\Xtras\Netlingo.x32
<SYSTEM32>\Macromed\Shockwave\Xtras\SET1E.tmp в <SYSTEM32>\Macromed\Shockwave\Xtras\Prefs.x32
<SYSTEM32>\Macromed\Shockwave\Xtras\SET18.tmp в <SYSTEM32>\Macromed\Shockwave\Xtras\Multiusr.x32
<SYSTEM32>\Macromed\Shockwave\Xtras\SET1A.tmp в <SYSTEM32>\Macromed\Shockwave\Xtras\Netfile.x32
<SYSTEM32>\Macromed\Shockwave\Xtras\SET20.tmp в <SYSTEM32>\Macromed\Shockwave\Xtras\Swadcmpr.x32
<SYSTEM32>\Macromed\Shockwave\Xtras\SET26.tmp в <SYSTEM32>\Macromed\Shockwave\Xtras\TextXtra.x32
%WINDIR%\inf\SET29.tmp в %WINDIR%\inf\swdir.inf
<SYSTEM32>\Macromed\Shockwave\Xtras\SET22.tmp в <SYSTEM32>\Macromed\Shockwave\Xtras\Swastrm.x32
<SYSTEM32>\Macromed\Shockwave\Xtras\SET24.tmp в <SYSTEM32>\Macromed\Shockwave\Xtras\textass.x32
<SYSTEM32>\Macromed\Shockwave\Xtras\SET16.tmp в <SYSTEM32>\Macromed\Shockwave\Xtras\MacroMix.x32
<SYSTEM32>\Macromed\Director\SET8.tmp в <SYSTEM32>\Macromed\Director\M5if32.dll
<SYSTEM32>\Macromed\Shockwave\SETA.tmp в <SYSTEM32>\Macromed\Shockwave\iml32.dll
<SYSTEM32>\Macromed\Director\SET4.tmp в <SYSTEM32>\Macromed\Director\SwDir.dll
<SYSTEM32>\Macromed\Director\SET6.tmp в <SYSTEM32>\Macromed\Director\M5drvr32.exe
<SYSTEM32>\Macromed\Shockwave\SETC.tmp в <SYSTEM32>\Macromed\Shockwave\dirapi.dll
<SYSTEM32>\Macromed\Shockwave\Xtras\SET12.tmp в <SYSTEM32>\Macromed\Shockwave\Xtras\fontass.x32
<SYSTEM32>\Macromed\Shockwave\Xtras\SET14.tmp в <SYSTEM32>\Macromed\Shockwave\Xtras\FontXtra.x32
<SYSTEM32>\Macromed\Shockwave\Xtras\SETE.tmp в <SYSTEM32>\Macromed\Shockwave\Xtras\CBrowser.x32
<SYSTEM32>\Macromed\Shockwave\Xtras\SET10.tmp в <SYSTEM32>\Macromed\Shockwave\Xtras\flashass.x32