Trojan.MulDrop2.144

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'pbmini' = '%PROGRAM_FILES%\pcast\PodcastbarMini\PodcastBarMiniStater.exe'
[<HKLM>\SOFTWARE\Classes\pcast\shell\open\command] '' = '%PROGRAM_FILES%\pcast\PodcastbarMini\PodcastBarMini.exe "%1"'
[<HKLM>\SOFTWARE\Classes\pcast\shell\open\command] '' = '%PROGRAM_FILES%\pcast\PodcastbarMini\PODCAS~2.EXE "%1"'

Создает или изменяет следующие файлы:

%HOMEPATH%\Start Menu\Programs\Startup\ІҐ°ФНшВзµзКУ.lnk

Вредоносные функции:

Для обхода брандмауэра удаляет или модифицирует следующие ключи реестра:

[<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%PROGRAM_FILES%\pcast\PodcastbarMini\PodcastBarMini.exe' = '%PROGRAM_FILES%\pcast\PodcastbarMini\PodcastBarMini.exe:*:Enabled:Share Streaming'
[<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%PROGRAM_FILES%\pcast\PodcastbarMini\PODCAS~2.EXE' = '%PROGRAM_FILES%\pcast\PodcastbarMini\PODCAS~2.EXE:*:Enabled:Share Streaming'
[<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%PROGRAM_FILES%\pcast\PodcastbarMini\PODCAS~1.EXE' = '%PROGRAM_FILES%\pcast\PodcastbarMini\PODCAS~1.EXE:*:Enabled:Share Streaming'

Создает и запускает на исполнение:

'%PROGRAM_FILES%\pcast\PodcastbarMini\PodcastBarMini.exe'
'%PROGRAM_FILES%\pcast\PodcastbarMini\PodcastBarMiniStarter.exe'

Изменения в файловой системе:

Создает следующие файлы:

%PROGRAM_FILES%\pcast\PodcastbarMini\html\images\player_title.gif
%PROGRAM_FILES%\pcast\PodcastbarMini\html\images\player_sound_float.gif
%PROGRAM_FILES%\pcast\PodcastbarMini\html\images\player_right.gif
%PROGRAM_FILES%\pcast\PodcastbarMini\html\images\player_top.gif
%PROGRAM_FILES%\pcast\PodcastbarMini\html\images\player_title_dot.gif
%PROGRAM_FILES%\pcast\PodcastbarMini\html\images\player_title.png
%PROGRAM_FILES%\pcast\PodcastbarMini\html\images\player_outleft.png
%PROGRAM_FILES%\pcast\PodcastbarMini\html\images\player_left.gif
%PROGRAM_FILES%\pcast\PodcastbarMini\html\images\player_button_stop.png
%PROGRAM_FILES%\pcast\PodcastbarMini\html\images\player_button_sound_on.png
%PROGRAM_FILES%\pcast\PodcastbarMini\html\images\player_outleft.gif
%PROGRAM_FILES%\pcast\PodcastbarMini\html\images\player_mainbg.png
%PROGRAM_FILES%\pcast\PodcastbarMini\html\images\player_mainbg.gif
%HOMEPATH%\Start Menu\Programs\ІҐ°ФНшВзµзКУ\ІҐ°ФНшВзµзКУ.lnk
%TEMP%\pca2.tmp
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\rss[1].xml
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\friendsite[1].html
%TEMP%\tem3.tmp
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\pcast_install[1].html
%PROGRAM_FILES%\pcast\PodcastbarMini\rss.xml
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\programview[1].html
%PROGRAM_FILES%\pcast\PodcastbarMini\ІҐ°ФНшВзµзКУНкГА°ж.url
%APPDATA%\Microsoft\Internet Explorer\Quick Launch\ІҐ°ФНшВзµзКУ.lnk
%HOMEPATH%\Desktop\ІҐ°ФНшВзµзКУ.lnk
%PROGRAM_FILES%\pcast\PodcastbarMini\uninst.exe
%HOMEPATH%\Start Menu\Programs\ІҐ°ФНшВзµзКУ\·ГОКОТГЗµДНшХѕ.url
%HOMEPATH%\Start Menu\Programs\ІҐ°ФНшВзµзКУ\Р¶ФШ.lnk
%PROGRAM_FILES%\pcast\PodcastbarMini\html\player_loading.html
%PROGRAM_FILES%\pcast\PodcastbarMini\html\player.html
%PROGRAM_FILES%\pcast\PodcastbarMini\html\loading.html
%PROGRAM_FILES%\pcast\PodcastbarMini\html\images\player_bottom.gif
%PROGRAM_FILES%\pcast\PodcastbarMini\html\images\loading.gif
%PROGRAM_FILES%\pcast\PodcastbarMini\html\images\itvplay_style01.css
%PROGRAM_FILES%\pcast\PodcastbarMini\pbmini.config.xml
%PROGRAM_FILES%\pcast\PodcastbarMini\PodcastBarMiniObj.dll
%PROGRAM_FILES%\pcast\PodcastbarMini\PodcastBarMiniStarter.exe
%PROGRAM_FILES%\pcast\PodcastbarMini\version.ini
%PROGRAM_FILES%\pcast\PodcastbarMini\pCastCtl.dll
%PROGRAM_FILES%\pcast\PodcastbarMini\PcastUpdate.dll
%PROGRAM_FILES%\pcast\PodcastbarMini\PodcastBarMini.exe
%PROGRAM_FILES%\pcast\PodcastbarMini\html\images\player_bottominfo.gif
%PROGRAM_FILES%\pcast\PodcastbarMini\html\images\player_button_rtitle.png
%PROGRAM_FILES%\pcast\PodcastbarMini\html\images\player_button_right.png
%PROGRAM_FILES%\pcast\PodcastbarMini\html\images\player_button_play_on.png
%PROGRAM_FILES%\pcast\PodcastbarMini\html\images\player_button_sound_off.png
%PROGRAM_FILES%\pcast\PodcastbarMini\html\images\player_button_sound.png
%PROGRAM_FILES%\pcast\PodcastbarMini\html\images\player_button_sbg.png
%PROGRAM_FILES%\pcast\PodcastbarMini\html\images\player_button_play_off.png
%PROGRAM_FILES%\pcast\PodcastbarMini\html\images\player_button_homepage.png
%PROGRAM_FILES%\pcast\PodcastbarMini\html\images\player_button_help.png
%PROGRAM_FILES%\pcast\PodcastbarMini\html\images\player_button_full.png
%PROGRAM_FILES%\pcast\PodcastbarMini\html\images\player_button_play.png
%PROGRAM_FILES%\pcast\PodcastbarMini\html\images\player_button_mini.png
%PROGRAM_FILES%\pcast\PodcastbarMini\html\images\player_button_left.png

Сетевая активность:

Подключается к:

're#.##ast.dudu.com':80
'p-##.io8.org':8080
'it#.mop.com':80
'pc####l.dudu.com':80
'localhost':1042

TCP:

Запросы HTTP GET:

it#.mop.com/rss.xml?ti###########
re#.##ast.dudu.com/rep/pcast_install.html?L8###############################################################################################################################################
it#.mop.com/main/mini_player/friendsite.html
pc####l.dudu.com/pcastbarup/rls/updateprogmini.php?ve#########################
it#.mop.com/main/mini_player/programview.html

UDP: