Trojan.MulDrop5.9133

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'X Sticky Notes' = '%APPDATA%\TuYaPing\X Sticky Notes\Xstickynotes.exe'

Вредоносные функции:

Создает и запускает на исполнение:

'%APPDATA%\TuYaPing\X Sticky Notes\Xstickynotes.exe'

Запускает на исполнение:

'<SYSTEM32>\ping.exe' 127.0.0.1 -n 2

Изменения в файловой системе:

Создает следующие файлы:

%APPDATA%\TuYaPing\X Sticky Notes\Skin\b0012
%TEMP%\Temporary Directory 1 for tmp1.tmp.zip\X Sticky Notes\Skin\b0012
%TEMP%\Temporary Directory 1 for tmp1.tmp.zip\X Sticky Notes\Skin\b0013
%TEMP%\Temporary Directory 1 for tmp1.tmp.zip\X Sticky Notes\Skin\b0014
%APPDATA%\TuYaPing\X Sticky Notes\Skin\b0013
%TEMP%\Temporary Directory 1 for tmp1.tmp.zip\X Sticky Notes\Skin\b0010
%APPDATA%\TuYaPing\X Sticky Notes\Skin\b0009
%APPDATA%\TuYaPing\X Sticky Notes\Skin\b0010
%APPDATA%\TuYaPing\X Sticky Notes\Skin\b0011
%TEMP%\Temporary Directory 1 for tmp1.tmp.zip\X Sticky Notes\Skin\b0011
%APPDATA%\TuYaPing\X Sticky Notes\Skin\b0014
%TEMP%\Temporary Directory 1 for tmp1.tmp.zip\X Sticky Notes\Skin\b0018
%APPDATA%\TuYaPing\X Sticky Notes\Skin\b0017
%APPDATA%\TuYaPing\X Sticky Notes\Skin\b0018
%APPDATA%\TuYaPing\X Sticky Notes\Skin\b0019
%TEMP%\Temporary Directory 1 for tmp1.tmp.zip\X Sticky Notes\Skin\b0019
%APPDATA%\TuYaPing\X Sticky Notes\Skin\b0015
%TEMP%\Temporary Directory 1 for tmp1.tmp.zip\X Sticky Notes\Skin\b0015
%TEMP%\Temporary Directory 1 for tmp1.tmp.zip\X Sticky Notes\Skin\b0016
%TEMP%\Temporary Directory 1 for tmp1.tmp.zip\X Sticky Notes\Skin\b0017
%APPDATA%\TuYaPing\X Sticky Notes\Skin\b0016
%TEMP%\Temporary Directory 1 for tmp1.tmp.zip\X Sticky Notes\Skin\b0009
%APPDATA%\TuYaPing\X Sticky Notes\Skin\a0044
%TEMP%\Temporary Directory 1 for tmp1.tmp.zip\X Sticky Notes\Skin\a0044
%TEMP%\Temporary Directory 1 for tmp1.tmp.zip\X Sticky Notes\Skin\b0002
%TEMP%\Temporary Directory 1 for tmp1.tmp.zip\X Sticky Notes\Skin\b0003
%APPDATA%\TuYaPing\X Sticky Notes\Skin\b0002
%TEMP%\Temporary Directory 1 for tmp1.tmp.zip\X Sticky Notes\Skin\a0042
%APPDATA%\TuYaPing\X Sticky Notes\Skin\a0041
%APPDATA%\TuYaPing\X Sticky Notes\Skin\a0042
%APPDATA%\TuYaPing\X Sticky Notes\Skin\a0043
%TEMP%\Temporary Directory 1 for tmp1.tmp.zip\X Sticky Notes\Skin\a0043
%APPDATA%\TuYaPing\X Sticky Notes\Skin\b0003
%TEMP%\Temporary Directory 1 for tmp1.tmp.zip\X Sticky Notes\Skin\b0007
%APPDATA%\TuYaPing\X Sticky Notes\Skin\b0006
%APPDATA%\TuYaPing\X Sticky Notes\Skin\b0007
%APPDATA%\TuYaPing\X Sticky Notes\Skin\b0008
%TEMP%\Temporary Directory 1 for tmp1.tmp.zip\X Sticky Notes\Skin\b0008
%APPDATA%\TuYaPing\X Sticky Notes\Skin\b0004
%TEMP%\Temporary Directory 1 for tmp1.tmp.zip\X Sticky Notes\Skin\b0004
%TEMP%\Temporary Directory 1 for tmp1.tmp.zip\X Sticky Notes\Skin\b0005
%TEMP%\Temporary Directory 1 for tmp1.tmp.zip\X Sticky Notes\Skin\b0006
%APPDATA%\TuYaPing\X Sticky Notes\Skin\b0005
%TEMP%\Temporary Directory 1 for tmp1.tmp.zip\X Sticky Notes\Skin\b0020
%APPDATA%\TuYaPing\X Sticky Notes\Skin\b0034
%TEMP%\Temporary Directory 1 for tmp1.tmp.zip\X Sticky Notes\Skin\b0034
%TEMP%\Temporary Directory 1 for tmp1.tmp.zip\X Sticky Notes\Skin\b0035
%TEMP%\Temporary Directory 1 for tmp1.tmp.zip\X Sticky Notes\Skin\b0036
%APPDATA%\TuYaPing\X Sticky Notes\Skin\b0035
%TEMP%\Temporary Directory 1 for tmp1.tmp.zip\X Sticky Notes\Skin\b0032
%APPDATA%\TuYaPing\X Sticky Notes\Skin\b0031
%APPDATA%\TuYaPing\X Sticky Notes\Skin\b0032
%APPDATA%\TuYaPing\X Sticky Notes\Skin\b0033
%TEMP%\Temporary Directory 1 for tmp1.tmp.zip\X Sticky Notes\Skin\b0033
%APPDATA%\TuYaPing\X Sticky Notes\Skin\b0036
%TEMP%\Temporary Directory 1 for tmp1.tmp.zip\X Sticky Notes\Xstickynotes.exe
%APPDATA%\TuYaPing\X Sticky Notes\Skin\Image\5.jpg
%APPDATA%\TuYaPing\X Sticky Notes\Xstickynotes.exe
%HOMEPATH%\Desktop\X Sticky Notes.url
%HOMEPATH%\Start Menu\X Sticky Notes.url
%APPDATA%\TuYaPing\X Sticky Notes\Skin\b0037
%TEMP%\Temporary Directory 1 for tmp1.tmp.zip\X Sticky Notes\Skin\b0037
%TEMP%\Temporary Directory 1 for tmp1.tmp.zip\X Sticky Notes\Skin\c0000
%TEMP%\Temporary Directory 1 for tmp1.tmp.zip\X Sticky Notes\Skin\Image\5.jpg
%APPDATA%\TuYaPing\X Sticky Notes\Skin\c0000
%TEMP%\Temporary Directory 1 for tmp1.tmp.zip\X Sticky Notes\Skin\b0031
%APPDATA%\TuYaPing\X Sticky Notes\Skin\b0023
%TEMP%\Temporary Directory 1 for tmp1.tmp.zip\X Sticky Notes\Skin\b0023
%TEMP%\Temporary Directory 1 for tmp1.tmp.zip\X Sticky Notes\Skin\b0024
%TEMP%\Temporary Directory 1 for tmp1.tmp.zip\X Sticky Notes\Skin\b0025
%APPDATA%\TuYaPing\X Sticky Notes\Skin\b0024
%TEMP%\Temporary Directory 1 for tmp1.tmp.zip\X Sticky Notes\Skin\b0021
%APPDATA%\TuYaPing\X Sticky Notes\Skin\b0020
%APPDATA%\TuYaPing\X Sticky Notes\Skin\b0021
%APPDATA%\TuYaPing\X Sticky Notes\Skin\b0022
%TEMP%\Temporary Directory 1 for tmp1.tmp.zip\X Sticky Notes\Skin\b0022
%APPDATA%\TuYaPing\X Sticky Notes\Skin\b0025
%TEMP%\Temporary Directory 1 for tmp1.tmp.zip\X Sticky Notes\Skin\b0029
%APPDATA%\TuYaPing\X Sticky Notes\Skin\b0028
%APPDATA%\TuYaPing\X Sticky Notes\Skin\b0029
%APPDATA%\TuYaPing\X Sticky Notes\Skin\b0030
%TEMP%\Temporary Directory 1 for tmp1.tmp.zip\X Sticky Notes\Skin\b0030
%APPDATA%\TuYaPing\X Sticky Notes\Skin\b0026
%TEMP%\Temporary Directory 1 for tmp1.tmp.zip\X Sticky Notes\Skin\b0026
%TEMP%\Temporary Directory 1 for tmp1.tmp.zip\X Sticky Notes\Skin\b0027
%TEMP%\Temporary Directory 1 for tmp1.tmp.zip\X Sticky Notes\Skin\b0028
%APPDATA%\TuYaPing\X Sticky Notes\Skin\b0027
%TEMP%\Temporary Directory 1 for tmp1.tmp.zip\X Sticky Notes\Skin\a0041
%APPDATA%\TuYaPing\X Sticky Notes\Skin\a0011
%TEMP%\Temporary Directory 1 for tmp1.tmp.zip\X Sticky Notes\Skin\a0011
%TEMP%\Temporary Directory 1 for tmp1.tmp.zip\X Sticky Notes\Skin\a0012
%TEMP%\Temporary Directory 1 for tmp1.tmp.zip\X Sticky Notes\Skin\a0013
%APPDATA%\TuYaPing\X Sticky Notes\Skin\a0012
%TEMP%\Temporary Directory 1 for tmp1.tmp.zip\X Sticky Notes\Skin\a0009
%APPDATA%\TuYaPing\X Sticky Notes\Skin\a0008
%APPDATA%\TuYaPing\X Sticky Notes\Skin\a0009
%APPDATA%\TuYaPing\X Sticky Notes\Skin\a0010
%TEMP%\Temporary Directory 1 for tmp1.tmp.zip\X Sticky Notes\Skin\a0010
%APPDATA%\TuYaPing\X Sticky Notes\Skin\a0013
%TEMP%\Temporary Directory 1 for tmp1.tmp.zip\X Sticky Notes\Skin\a0017
%APPDATA%\TuYaPing\X Sticky Notes\Skin\a0016
%APPDATA%\TuYaPing\X Sticky Notes\Skin\a0017
%APPDATA%\TuYaPing\X Sticky Notes\Skin\a0018
%TEMP%\Temporary Directory 1 for tmp1.tmp.zip\X Sticky Notes\Skin\a0018
%APPDATA%\TuYaPing\X Sticky Notes\Skin\a0014
%TEMP%\Temporary Directory 1 for tmp1.tmp.zip\X Sticky Notes\Skin\a0014
%TEMP%\Temporary Directory 1 for tmp1.tmp.zip\X Sticky Notes\Skin\a0015
%TEMP%\Temporary Directory 1 for tmp1.tmp.zip\X Sticky Notes\Skin\a0016
%APPDATA%\TuYaPing\X Sticky Notes\Skin\a0015
%TEMP%\Temporary Directory 1 for tmp1.tmp.zip\X Sticky Notes\Skin\a0008
%APPDATA%\TuYaPing\X Sticky Notes\Skin\a0000
%TEMP%\Temporary Directory 1 for tmp1.tmp.zip\X Sticky Notes\Skin\a0000
%TEMP%\Temporary Directory 1 for tmp1.tmp.zip\X Sticky Notes\Skin\a0001
%TEMP%\Temporary Directory 1 for tmp1.tmp.zip\X Sticky Notes\Skin\a0002
%APPDATA%\TuYaPing\X Sticky Notes\Skin\a0001
%TEMP%\Temporary Directory 1 for tmp1.tmp.zip\X Sticky Notes\Core.dll
%TEMP%\tmp1.tmp.zip
%APPDATA%\TuYaPing\X Sticky Notes\Core.dll
%APPDATA%\TuYaPing\X Sticky Notes\rsa_pub.txt
%TEMP%\Temporary Directory 1 for tmp1.tmp.zip\X Sticky Notes\rsa_pub.txt
%APPDATA%\TuYaPing\X Sticky Notes\Skin\a0002
%TEMP%\Temporary Directory 1 for tmp1.tmp.zip\X Sticky Notes\Skin\a0006
%APPDATA%\TuYaPing\X Sticky Notes\Skin\a0005
%APPDATA%\TuYaPing\X Sticky Notes\Skin\a0006
%APPDATA%\TuYaPing\X Sticky Notes\Skin\a0007
%TEMP%\Temporary Directory 1 for tmp1.tmp.zip\X Sticky Notes\Skin\a0007
%APPDATA%\TuYaPing\X Sticky Notes\Skin\a0003
%TEMP%\Temporary Directory 1 for tmp1.tmp.zip\X Sticky Notes\Skin\a0003
%TEMP%\Temporary Directory 1 for tmp1.tmp.zip\X Sticky Notes\Skin\a0004
%TEMP%\Temporary Directory 1 for tmp1.tmp.zip\X Sticky Notes\Skin\a0005
%APPDATA%\TuYaPing\X Sticky Notes\Skin\a0004
%TEMP%\Temporary Directory 1 for tmp1.tmp.zip\X Sticky Notes\Skin\a0019
%APPDATA%\TuYaPing\X Sticky Notes\Skin\a0033
%TEMP%\Temporary Directory 1 for tmp1.tmp.zip\X Sticky Notes\Skin\a0033
%TEMP%\Temporary Directory 1 for tmp1.tmp.zip\X Sticky Notes\Skin\a0034
%TEMP%\Temporary Directory 1 for tmp1.tmp.zip\X Sticky Notes\Skin\a0035
%APPDATA%\TuYaPing\X Sticky Notes\Skin\a0034
%TEMP%\Temporary Directory 1 for tmp1.tmp.zip\X Sticky Notes\Skin\a0031
%APPDATA%\TuYaPing\X Sticky Notes\Skin\a0030
%APPDATA%\TuYaPing\X Sticky Notes\Skin\a0031
%APPDATA%\TuYaPing\X Sticky Notes\Skin\a0032
%TEMP%\Temporary Directory 1 for tmp1.tmp.zip\X Sticky Notes\Skin\a0032
%APPDATA%\TuYaPing\X Sticky Notes\Skin\a0035
%TEMP%\Temporary Directory 1 for tmp1.tmp.zip\X Sticky Notes\Skin\a0039
%APPDATA%\TuYaPing\X Sticky Notes\Skin\a0038
%APPDATA%\TuYaPing\X Sticky Notes\Skin\a0039
%APPDATA%\TuYaPing\X Sticky Notes\Skin\a0040
%TEMP%\Temporary Directory 1 for tmp1.tmp.zip\X Sticky Notes\Skin\a0040
%APPDATA%\TuYaPing\X Sticky Notes\Skin\a0036
%TEMP%\Temporary Directory 1 for tmp1.tmp.zip\X Sticky Notes\Skin\a0036
%TEMP%\Temporary Directory 1 for tmp1.tmp.zip\X Sticky Notes\Skin\a0037
%TEMP%\Temporary Directory 1 for tmp1.tmp.zip\X Sticky Notes\Skin\a0038
%APPDATA%\TuYaPing\X Sticky Notes\Skin\a0037
%TEMP%\Temporary Directory 1 for tmp1.tmp.zip\X Sticky Notes\Skin\a0030
%APPDATA%\TuYaPing\X Sticky Notes\Skin\a0022
%TEMP%\Temporary Directory 1 for tmp1.tmp.zip\X Sticky Notes\Skin\a0022
%TEMP%\Temporary Directory 1 for tmp1.tmp.zip\X Sticky Notes\Skin\a0023
%TEMP%\Temporary Directory 1 for tmp1.tmp.zip\X Sticky Notes\Skin\a0024
%APPDATA%\TuYaPing\X Sticky Notes\Skin\a0023
%TEMP%\Temporary Directory 1 for tmp1.tmp.zip\X Sticky Notes\Skin\a0020
%APPDATA%\TuYaPing\X Sticky Notes\Skin\a0019
%APPDATA%\TuYaPing\X Sticky Notes\Skin\a0020
%APPDATA%\TuYaPing\X Sticky Notes\Skin\a0021
%TEMP%\Temporary Directory 1 for tmp1.tmp.zip\X Sticky Notes\Skin\a0021
%APPDATA%\TuYaPing\X Sticky Notes\Skin\a0024
%TEMP%\Temporary Directory 1 for tmp1.tmp.zip\X Sticky Notes\Skin\a0028
%APPDATA%\TuYaPing\X Sticky Notes\Skin\a0027
%APPDATA%\TuYaPing\X Sticky Notes\Skin\a0028
%APPDATA%\TuYaPing\X Sticky Notes\Skin\a0029
%TEMP%\Temporary Directory 1 for tmp1.tmp.zip\X Sticky Notes\Skin\a0029
%APPDATA%\TuYaPing\X Sticky Notes\Skin\a0025
%TEMP%\Temporary Directory 1 for tmp1.tmp.zip\X Sticky Notes\Skin\a0025
%TEMP%\Temporary Directory 1 for tmp1.tmp.zip\X Sticky Notes\Skin\a0026
%TEMP%\Temporary Directory 1 for tmp1.tmp.zip\X Sticky Notes\Skin\a0027
%APPDATA%\TuYaPing\X Sticky Notes\Skin\a0026

Удаляет следующие файлы:

%TEMP%\tmp1.tmp.zip

Самоудаляется.

Другое:

Ищет следующие окна:

ClassName: 'Indicator' WindowName: '(null)'
ClassName: 'Shell_TrayWnd' WindowName: '(null)'

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней