Trojan.MulDrop5.33563

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'USB Security' = '%PROGRAM_FILES%\USB Disk Security\USBGuard.exe'

Вредоносные функции:

Создает и запускает на исполнение:

'%TEMP%\is-U7KVD.tmp\Setup.tmp' /SL5="$10106,4750658,54272,%TEMP%\RarSFX0\Setup.exe" /SILENT
'%TEMP%\RarSFX0\Setup.exe' /SILENT

Изменения в файловой системе:

Создает следующие файлы:

%PROGRAM_FILES%\USB Disk Security\is-PRK9P.tmp
%PROGRAM_FILES%\USB Disk Security\is-EIMLJ.tmp
%PROGRAM_FILES%\USB Disk Security\is-E53BR.tmp
%PROGRAM_FILES%\USB Disk Security\is-P70J2.tmp
%PROGRAM_FILES%\USB Disk Security\is-6BT87.tmp
%PROGRAM_FILES%\USB Disk Security\is-TGPU9.tmp
%PROGRAM_FILES%\USB Disk Security\is-18GPH.tmp
%ALLUSERSPROFILE%\Desktop\USB Disk Security.lnk
%PROGRAM_FILES%\USB Disk Security\unins000.dat
%PROGRAM_FILES%\USB Disk Security\is-JVF3B.tmp
%PROGRAM_FILES%\USB Disk Security\is-HBF23.tmp
%PROGRAM_FILES%\USB Disk Security\is-81HA4.tmp
%TEMP%\is-3QFH2.tmp\_isetup\_shfoldr.dll
%TEMP%\is-3QFH2.tmp\_isetup\_isdecmp.dll
%PROGRAM_FILES%\USB Disk Security\is-GCA07.tmp
%TEMP%\RarSFX0\Setup.exe
%TEMP%\is-U7KVD.tmp\Setup.tmp
%TEMP%\is-3QFH2.tmp\_isetup\_RegDLL.tmp
%PROGRAM_FILES%\USB Disk Security\is-0V8HU.tmp
%PROGRAM_FILES%\USB Disk Security\is-70MBR.tmp
%PROGRAM_FILES%\USB Disk Security\is-GJLUM.tmp
%PROGRAM_FILES%\USB Disk Security\is-SG40A.tmp
%PROGRAM_FILES%\USB Disk Security\is-9KQ61.tmp
%PROGRAM_FILES%\USB Disk Security\is-BHLSQ.tmp

Удаляет следующие файлы:

%TEMP%\is-U7KVD.tmp\Setup.tmp
%TEMP%\RarSFX0\Setup.exe
%TEMP%\is-3QFH2.tmp\_isetup\_shfoldr.dll
%TEMP%\is-3QFH2.tmp\_isetup\_isdecmp.dll
%TEMP%\is-3QFH2.tmp\_isetup\_RegDLL.tmp

Перемещает следующие файлы:

%PROGRAM_FILES%\USB Disk Security\is-EIMLJ.tmp в %PROGRAM_FILES%\USB Disk Security\USBGuardUpdate.dat
%PROGRAM_FILES%\USB Disk Security\is-E53BR.tmp в %PROGRAM_FILES%\USB Disk Security\log.dmb
%PROGRAM_FILES%\USB Disk Security\is-TGPU9.tmp в %PROGRAM_FILES%\USB Disk Security\msvcr80.dll
%PROGRAM_FILES%\USB Disk Security\is-PRK9P.tmp в %PROGRAM_FILES%\USB Disk Security\USBGuardUpdate.exe
%PROGRAM_FILES%\USB Disk Security\is-81HA4.tmp в %PROGRAM_FILES%\USB Disk Security\log3.dmb
%PROGRAM_FILES%\USB Disk Security\is-18GPH.tmp в %PROGRAM_FILES%\USB Disk Security\version.ini
%PROGRAM_FILES%\USB Disk Security\is-JVF3B.tmp в %PROGRAM_FILES%\USB Disk Security\log1.dmb
%PROGRAM_FILES%\USB Disk Security\is-HBF23.tmp в %PROGRAM_FILES%\USB Disk Security\log2.dmb
%PROGRAM_FILES%\USB Disk Security\is-6BT87.tmp в %PROGRAM_FILES%\USB Disk Security\msvcp80.dll
%PROGRAM_FILES%\USB Disk Security\is-9KQ61.tmp в %PROGRAM_FILES%\USB Disk Security\USBGuard.chm
%PROGRAM_FILES%\USB Disk Security\is-BHLSQ.tmp в %PROGRAM_FILES%\USB Disk Security\BCGCBPRO1500u80.dll
%PROGRAM_FILES%\USB Disk Security\is-GCA07.tmp в %PROGRAM_FILES%\USB Disk Security\unins000.exe
%PROGRAM_FILES%\USB Disk Security\is-SG40A.tmp в %PROGRAM_FILES%\USB Disk Security\USBGuard.exe
%PROGRAM_FILES%\USB Disk Security\is-GJLUM.tmp в %PROGRAM_FILES%\USB Disk Security\Microsoft.VC80.CRT.manifest
%PROGRAM_FILES%\USB Disk Security\is-P70J2.tmp в %PROGRAM_FILES%\USB Disk Security\Microsoft.VC80.MFC.manifest
%PROGRAM_FILES%\USB Disk Security\is-0V8HU.tmp в %PROGRAM_FILES%\USB Disk Security\BCGPStyle2010Blue150.dll
%PROGRAM_FILES%\USB Disk Security\is-70MBR.tmp в %PROGRAM_FILES%\USB Disk Security\mfc80u.dll