Trojan.MulDrop5.41996

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKLM>\SOFTWARE\Classes\AAALogoProject\shell\open\command] '' = '"%PROGRAM_FILES%\AAALOGO\ALOGO.EXE" "%1"'

Вредоносные функции:

Создает и запускает на исполнение:

'%TEMP%\is-O2ORM.tmp\setup_retail.tmp' /SL5="$10108,7802041,54272,%TEMP%\RarSFX0\setup_retail.exe" /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-
'%TEMP%\RarSFX0\setup_retail.exe' /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-

Изменения в файловой системе:

Создает следующие файлы:

%PROGRAM_FILES%\AAALOGO\tmpf\is-I9QAB.tmp
%PROGRAM_FILES%\AAALOGO\tmpf\is-TSNBV.tmp
%PROGRAM_FILES%\AAALOGO\tmpf\is-PD9I6.tmp
%PROGRAM_FILES%\AAALOGO\tmpf\is-8IJ4E.tmp
%PROGRAM_FILES%\AAALOGO\tmpf\is-BP5RU.tmp
%PROGRAM_FILES%\AAALOGO\tmpf\is-AVSIG.tmp
%PROGRAM_FILES%\AAALOGO\tmpf\is-RLMRO.tmp
%PROGRAM_FILES%\AAALOGO\tmpf\is-IE4HC.tmp
%PROGRAM_FILES%\AAALOGO\aaa_logo.url
%APPDATA%\Microsoft\Internet Explorer\Quick Launch\AAA Logo.lnk
%PROGRAM_FILES%\AAALOGO\unins000.dat
%PROGRAM_FILES%\AAALOGO\get_last.url
%ALLUSERSPROFILE%\Start Menu\Programs\AAA Logo\AAA Logo on the Web.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\AAA Logo\AAA Logo.lnk
%HOMEPATH%\Desktop\AAA Logo.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\AAA Logo\Download the latest version.lnk
%PROGRAM_FILES%\AAALOGO\tmpf\is-DJLTL.tmp
%PROGRAM_FILES%\AAALOGO\is-1K4UD.tmp
%PROGRAM_FILES%\AAALOGO\is-HML1R.tmp
%PROGRAM_FILES%\AAALOGO\fonts\is-SFHON.tmp
%PROGRAM_FILES%\AAALOGO\is-RGFAD.tmp
%TEMP%\is-O2ORM.tmp\setup_retail.tmp
%TEMP%\RarSFX0\setup_retail.exe
%PROGRAM_FILES%\AAALOGO\is-5DNO6.tmp
%TEMP%\is-E59PA.tmp\_isetup\_shfoldr.dll
%PROGRAM_FILES%\AAALOGO\data\is-QQS6T.tmp
%PROGRAM_FILES%\AAALOGO\data\is-34CV5.tmp
%PROGRAM_FILES%\AAALOGO\tmpf\is-V57PH.tmp
%PROGRAM_FILES%\AAALOGO\tmpf\is-PI22V.tmp
%PROGRAM_FILES%\AAALOGO\data\is-LNSHF.tmp
%PROGRAM_FILES%\AAALOGO\data\is-3SERF.tmp
%PROGRAM_FILES%\AAALOGO\data\is-VP9B8.tmp
%PROGRAM_FILES%\AAALOGO\data\is-NNM8N.tmp

Удаляет следующие файлы:

%TEMP%\RarSFX0\setup_retail.exe
%TEMP%\is-O2ORM.tmp\setup_retail.tmp
%TEMP%\is-E59PA.tmp\_isetup\_shfoldr.dll

Перемещает следующие файлы:

%PROGRAM_FILES%\AAALOGO\tmpf\is-AVSIG.tmp в %PROGRAM_FILES%\AAALOGO\tmpf\crt.dat
%PROGRAM_FILES%\AAALOGO\tmpf\is-BP5RU.tmp в %PROGRAM_FILES%\AAALOGO\tmpf\emb.dat
%PROGRAM_FILES%\AAALOGO\tmpf\is-DJLTL.tmp в %PROGRAM_FILES%\AAALOGO\tmpf\clr.dat
%PROGRAM_FILES%\AAALOGO\tmpf\is-PI22V.tmp в %PROGRAM_FILES%\AAALOGO\tmpf\bsa.dat
%PROGRAM_FILES%\AAALOGO\tmpf\is-V57PH.tmp в %PROGRAM_FILES%\AAALOGO\tmpf\bst.dat
%PROGRAM_FILES%\AAALOGO\tmpf\is-IE4HC.tmp в %PROGRAM_FILES%\AAALOGO\tmpf\ena.dat
%PROGRAM_FILES%\AAALOGO\tmpf\is-8IJ4E.tmp в %PROGRAM_FILES%\AAALOGO\tmpf\min.dat
%PROGRAM_FILES%\AAALOGO\tmpf\is-PD9I6.tmp в %PROGRAM_FILES%\AAALOGO\tmpf\mon.dat
%PROGRAM_FILES%\AAALOGO\tmpf\is-I9QAB.tmp в %PROGRAM_FILES%\AAALOGO\tmpf\let.dat
%PROGRAM_FILES%\AAALOGO\tmpf\is-RLMRO.tmp в %PROGRAM_FILES%\AAALOGO\tmpf\ent.dat
%PROGRAM_FILES%\AAALOGO\tmpf\is-TSNBV.tmp в %PROGRAM_FILES%\AAALOGO\tmpf\ill.dat
%PROGRAM_FILES%\AAALOGO\is-RGFAD.tmp в %PROGRAM_FILES%\AAALOGO\aaalogo.chm
%PROGRAM_FILES%\AAALOGO\fonts\is-SFHON.tmp в %PROGRAM_FILES%\AAALOGO\fonts\fonts.txt
%PROGRAM_FILES%\AAALOGO\is-1K4UD.tmp в %PROGRAM_FILES%\AAALOGO\license.txt
%PROGRAM_FILES%\AAALOGO\is-5DNO6.tmp в %PROGRAM_FILES%\AAALOGO\unins000.exe
%PROGRAM_FILES%\AAALOGO\is-HML1R.tmp в %PROGRAM_FILES%\AAALOGO\alogo.exe
%PROGRAM_FILES%\AAALOGO\data\is-3SERF.tmp в %PROGRAM_FILES%\AAALOGO\data\gset.dat
%PROGRAM_FILES%\AAALOGO\data\is-34CV5.tmp в %PROGRAM_FILES%\AAALOGO\data\stdfs.dat
%PROGRAM_FILES%\AAALOGO\data\is-QQS6T.tmp в %PROGRAM_FILES%\AAALOGO\data\style.dat
%PROGRAM_FILES%\AAALOGO\data\is-VP9B8.tmp в %PROGRAM_FILES%\AAALOGO\data\outm.dat
%PROGRAM_FILES%\AAALOGO\data\is-LNSHF.tmp в %PROGRAM_FILES%\AAALOGO\data\ires.dat
%PROGRAM_FILES%\AAALOGO\data\is-NNM8N.tmp в %PROGRAM_FILES%\AAALOGO\data\outj.dat