Trojan.MulDrop5.46181

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKLM>\SOFTWARE\Classes\CLSID\{51EB1DB7-A8EE-4A95-8C11-2BE13BBAAFD4}\Shell\Open\Command] '' = '<SYSTEM32>\LicenseConsole.exe'

Создает следующие сервисы:

[<HKLM>\SYSTEM\ControlSet001\Services\LicenseManager] 'Start' = '00000002'

Вредоносные функции:

Для обхода брандмауэра удаляет или модифицирует следующие ключи реестра:

[<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '<SYSTEM32>\LicenseMan.exe' = '<SYSTEM32>\LicenseMan.exe:*:Enabled:LicenseMan'

Создает и запускает на исполнение:

'<SYSTEM32>\LicenseMan.exe'
'<SYSTEM32>\LicenseMan.exe' /install /silent
'%TEMP%\LicenseMan\LicenseSetup.exe'

Запускает на исполнение:

'<SYSTEM32>\ipconfig.exe' /all
'<SYSTEM32>\cmd.exe' /c <SYSTEM32>\WIPReport.bat

Изменения в файловой системе:

Создает следующие файлы:

<SYSTEM32>\WIPReport.bat
<SYSTEM32>\FUNCTION.DAT
%TEMP%\LicenseMan\WordTable.wt
%TEMP%\LicenseMan\midas.dll
%TEMP%\LicenseMan\RefreshLicense\RefreshLicense_sfx.exe
<SYSTEM32>\HARD_LICENSEINFO.DAT
<SYSTEM32>\HARD_LICENSEINFO.IDX
<SYSTEM32>\LICENSEINFO.IDX
<SYSTEM32>\FUNCTION.IDX
<SYSTEM32>\LICENSEINFO.DAT
%TEMP%\LicenseMan\LicenseMan\SoftGuardC.dll
%TEMP%\LicenseMan\LicenseMan\UnInsLicense.exe
%TEMP%\LicenseMan\LicenseMan\RstartL.exe
%TEMP%\LicenseMan\LicenseMan\NewKeyPro\SngReg.exe
%TEMP%\LicenseMan\LicenseMan\ReInsLicense.exe
%TEMP%\LicenseMan\LicenseSetup.exe
%TEMP%\LicenseMan\LicenseSetup_Cht.ini
%TEMP%\LicenseMan\LicenseMan\WordTable.wt
%TEMP%\LicenseMan\LicenseMan\USB\USBKEY32.DLL
%TEMP%\LicenseMan\LicenseMan\USBKEY32.DLL
<SYSTEM32>\WintonDrivers\Keypro8\Sllacs32.dll
<SYSTEM32>\WintonDrivers\Keypro8\Sllprosv.exe
<SYSTEM32>\WintonDrivers\Keypro8\SLACS32.DLL
<SYSTEM32>\USBKEY32.DLL
<SYSTEM32>\WintonDrivers\Keypro8\REGISTER.EXE
<SYSTEM32>\WintonDrivers\Keypro9\SLPSVDR.sys
<SYSTEM32>\WintonDrivers\Keypro9\SLACS32.DLL
<SYSTEM32>\WintonDrivers\Keypro9\Register.exe
<SYSTEM32>\WintonDrivers\Keypro8\SLLPSVDR.SYS
<SYSTEM32>\WintonDrivers\Keypro8\SLNTLDR.EXE
<SYSTEM32>\LICENSEINFO_EXT.DAT
<SYSTEM32>\LICENSEINFO_EXT.IDX
<SYSTEM32>\LICENSECUSTINFO.IDX
<SYSTEM32>\LICENSECUSTINFO.DAT
<SYSTEM32>\LICENSECUSTINFO.BLB
<SYSTEM32>\SoftGuardC.dll
<SYSTEM32>\LicenseTestProg.exe
<SYSTEM32>\LicenseConsole.exe
<SYSTEM32>\LicenseMan.exe
<SYSTEM32>\WIPReport.txt
%TEMP%\LicenseMan\LicenseMan\NewKeyPro\SLP1KDR.SYS
%TEMP%\LicenseMan\LicenseMan\Keypro8\SLACS32.DLL
%TEMP%\LicenseMan\LicenseMan\Keypro8\Sllacs32.dll
%TEMP%\LicenseMan\LicenseMan\Keypro8\REGISTER.EXE
%TEMP%\LicenseMan\LicenseMan\HARD_LICENSELINK.DAT
%TEMP%\LicenseMan\LicenseMan\HARD_LICENSELINK.IDX
%TEMP%\LicenseMan\LicenseMan\Keypro9\Register.exe
%TEMP%\LicenseMan\LicenseMan\Keypro9\SLACS32.DLL
%TEMP%\LicenseMan\LicenseMan\Keypro8\SLNTLDR.EXE
%TEMP%\LicenseMan\LicenseMan\Keypro8\Sllprosv.exe
%TEMP%\LicenseMan\LicenseMan\Keypro8\SLLPSVDR.SYS
%TEMP%\LicenseMan\Function\LICENSELIST.IDX
%TEMP%\LicenseMan\history.txt
%TEMP%\LicenseMan\Function\LICENSELIST.DAT
%TEMP%\LicenseMan\Function\FUNCTION.DAT
%TEMP%\LicenseMan\Function\FUNCTION.IDX
%TEMP%\LicenseMan\LicenseMan\HARD_LICENSEINFO_CHS.DAT
%TEMP%\LicenseMan\LicenseMan\HARD_LICENSEINFO_CHS.IDX
%TEMP%\LicenseMan\LicenseMan\HARD_LICENSEINFO.IDX
%TEMP%\LicenseMan\LicenseMan\borlndmm.dll
%TEMP%\LicenseMan\LicenseMan\HARD_LICENSEINFO.DAT
%TEMP%\LicenseMan\LicenseMan\LicenseManErr.log
%TEMP%\LicenseMan\LicenseMan\LicenseTestProg.exe
%TEMP%\LicenseMan\LicenseMan\LicenseMan.exe
%TEMP%\LicenseMan\LicenseMan\LICENSELINK.IDX
%TEMP%\LicenseMan\LicenseMan\LicenseMan.cpl
%TEMP%\LicenseMan\LicenseMan\NewKeyPro\SLACS32.DLL
%TEMP%\LicenseMan\LicenseMan\NewKeyPro\SLP.VXD
%TEMP%\LicenseMan\LicenseMan\NewKeyPro\Help_T.chm
%TEMP%\LicenseMan\LicenseMan\LicenseView.exe
%TEMP%\LicenseMan\LicenseMan\midas.dll
%TEMP%\LicenseMan\LicenseMan\LICENSECUSTINFO.DAT
%TEMP%\LicenseMan\LicenseMan\LICENSECUSTINFO.IDX
%TEMP%\LicenseMan\LicenseMan\LICENSECUSTINFO.BLB
%TEMP%\LicenseMan\LicenseMan\Keypro9\SLPSVDR.sys
%TEMP%\LicenseMan\LicenseMan\LicenseConsole.exe
%TEMP%\LicenseMan\LicenseMan\LICENSEINFO_EXT.IDX
%TEMP%\LicenseMan\LicenseMan\LICENSELINK.DAT
%TEMP%\LicenseMan\LicenseMan\LICENSEINFO_EXT.DAT
%TEMP%\LicenseMan\LicenseMan\LICENSEINFO.DAT
%TEMP%\LicenseMan\LicenseMan\LICENSEINFO.IDX

Другое:

Ищет следующие окна:

ClassName: '' WindowName: '???????T-???v???z?? v4.9'
ClassName: '' WindowName: '¤е¤¤ёк°T-±ВЕvєЮІzы v4.9'
ClassName: '' WindowName: '???????T-???v???z?? v5.0'
ClassName: '' WindowName: '¤е¤¤ёк°T-±ВЕvєЮІzы v4.8'
ClassName: '' WindowName: '???????T-???v???z?? v4.7'
ClassName: '' WindowName: '¤е¤¤ёк°T-±ВЕvєЮІzы v4.7'
ClassName: '' WindowName: '???????T-???v???z?? v4.8'
ClassName: '' WindowName: '¤е¤¤ёк°T-±ВЕvєЮІzы v5.0'
ClassName: '' WindowName: '???????T-???v???z?? v5.3'
ClassName: '' WindowName: '¤е¤¤ёк°T-±ВЕvєЮІzы v5.3'
ClassName: '' WindowName: '???????T-???v???z?? v5.4'
ClassName: '' WindowName: '¤е¤¤ёк°T-±ВЕvєЮІzы v5.2'
ClassName: '' WindowName: '???????T-???v???z?? v5.1'
ClassName: '' WindowName: '¤е¤¤ёк°T-±ВЕvєЮІzы v5.1'
ClassName: '' WindowName: '???????T-???v???z?? v5.2'
ClassName: '' WindowName: '¤е¤¤ёк°T-±ВЕvєЮІzы v4.6'
ClassName: '' WindowName: '???????T-???v???z?? v4.1'
ClassName: '' WindowName: '¤е¤¤ёк°T-±ВЕvєЮІzы v4.1'
ClassName: '' WindowName: '???????T-???v???z?? v4.2'
ClassName: '' WindowName: '¤е¤¤ёк°T-±ВЕvєЮІzы v4.0'
ClassName: '' WindowName: '???????T-???v???z?? v3.9'
ClassName: '' WindowName: '¤е¤¤ёк°T-±ВЕvєЮІzы v3.9'
ClassName: '' WindowName: '???????T-???v???z?? v4.0'
ClassName: '' WindowName: '¤е¤¤ёк°T-±ВЕvєЮІzы v4.2'
ClassName: '' WindowName: '???????T-???v???z?? v4.5'
ClassName: '' WindowName: '¤е¤¤ёк°T-±ВЕvєЮІzы v4.5'
ClassName: '' WindowName: '???????T-???v???z?? v4.6'
ClassName: '' WindowName: '¤е¤¤ёк°T-±ВЕvєЮІzы v4.4'
ClassName: '' WindowName: '???????T-???v???z?? v4.3'
ClassName: '' WindowName: '¤е¤¤ёк°T-±ВЕvєЮІzы v4.3'
ClassName: '' WindowName: '???????T-???v???z?? v4.4'
ClassName: '' WindowName: '¤е¤¤ёк°T-±ВЕvєЮІzы v6.4'
ClassName: '' WindowName: '???????T-???v???z?? v6.5'
ClassName: '' WindowName: '¤е¤¤ёк°T-±ВЕvєЮІzы v6.5'
ClassName: '' WindowName: '???????T-???v???z?? v6.4'
ClassName: '' WindowName: '¤е¤¤ёк°T-±ВЕvєЮІzы v6.2'
ClassName: '' WindowName: '???????T-???v???z?? v6.3'
ClassName: '' WindowName: '¤е¤¤ёк°T-±ВЕvєЮІzы v6.3'
ClassName: '' WindowName: '???????T-???v???z?? v6.6'
ClassName: '' WindowName: '¤е¤¤ёк°T-±ВЕvєЮІzы v6.8'
ClassName: '' WindowName: '???????T-???v???z?? v6.9'
ClassName: '' WindowName: '¤е¤¤ёк°T-±ВЕvєЮІzы v6.9'
ClassName: '' WindowName: '???????T-???v???z?? v6.8'
ClassName: '' WindowName: '¤е¤¤ёк°T-±ВЕvєЮІzы v6.6'
ClassName: '' WindowName: '???????T-???v???z?? v6.7'
ClassName: '' WindowName: '¤е¤¤ёк°T-±ВЕvєЮІzы v6.7'
ClassName: '' WindowName: '???????T-???v???z?? v6.2'
ClassName: '' WindowName: '¤е¤¤ёк°T-±ВЕvєЮІzы v5.6'
ClassName: '' WindowName: '???????T-???v???z?? v5.7'
ClassName: '' WindowName: '¤е¤¤ёк°T-±ВЕvєЮІzы v5.7'
ClassName: '' WindowName: '???????T-???v???z?? v5.6'
ClassName: '' WindowName: '¤е¤¤ёк°T-±ВЕvєЮІzы v5.4'
ClassName: '' WindowName: '???????T-???v???z?? v5.5'
ClassName: '' WindowName: '¤е¤¤ёк°T-±ВЕvєЮІzы v5.5'
ClassName: '' WindowName: '???????T-???v???z?? v5.8'
ClassName: '' WindowName: '¤е¤¤ёк°T-±ВЕvєЮІzы v6.0'
ClassName: '' WindowName: '???????T-???v???z?? v6.1'
ClassName: '' WindowName: '¤е¤¤ёк°T-±ВЕvєЮІzы v6.1'
ClassName: '' WindowName: '???????T-???v???z?? v6.0'
ClassName: '' WindowName: '¤е¤¤ёк°T-±ВЕvєЮІzы v5.8'
ClassName: '' WindowName: '???????T-???v???z?? v5.9'
ClassName: '' WindowName: '¤е¤¤ёк°T-±ВЕvєЮІzы v5.9'
ClassName: '' WindowName: '???????T-???v???z?? v1.8'
ClassName: '' WindowName: '¤е¤¤ёк°T-±ВЕvєЮІzы v1.8'
ClassName: '' WindowName: '???????T-???v???z?? v1.9'
ClassName: '' WindowName: '¤е¤¤ёк°T-±ВЕvєЮІzы v1.7'
ClassName: '' WindowName: '???????T-???v???z?? v1.6'
ClassName: '' WindowName: '¤е¤¤ёк°T-±ВЕvєЮІzы v1.6'
ClassName: '' WindowName: '???????T-???v???z?? v1.7'
ClassName: '' WindowName: '¤е¤¤ёк°T-±ВЕvєЮІzы v1.9'
ClassName: '' WindowName: '???????T-???v???z?? v2.2'
ClassName: '' WindowName: '¤е¤¤ёк°T-±ВЕvєЮІzы v2.2'
ClassName: '' WindowName: '???????T-???v???z?? v2.3'
ClassName: '' WindowName: '¤е¤¤ёк°T-±ВЕvєЮІzы v2.1'
ClassName: '' WindowName: '???????T-???v???z?? v2.0'
ClassName: '' WindowName: '¤е¤¤ёк°T-±ВЕvєЮІzы v2.0'
ClassName: '' WindowName: '???????T-???v???z?? v2.1'
ClassName: '' WindowName: '¤е¤¤ёк°T-±ВЕvєЮІzы v1.5'
ClassName: '' WindowName: '???????T-???v???z?? v1.0'
ClassName: '' WindowName: '¤е¤¤ёк°T-±ВЕvєЮІzы v1.0'
ClassName: '' WindowName: '???????T-???v???z?? v1.1'
ClassName: '' WindowName: '¤е¤¤ёк°T-±ВЕvєЮІzы'
ClassName: 'EDIT' WindowName: ''
ClassName: 'Shell_TrayWnd' WindowName: ''
ClassName: '' WindowName: '???????T-???v???z??'
ClassName: '' WindowName: '¤е¤¤ёк°T-±ВЕvєЮІzы v1.1'
ClassName: '' WindowName: '???????T-???v???z?? v1.4'
ClassName: '' WindowName: '¤е¤¤ёк°T-±ВЕvєЮІzы v1.4'
ClassName: '' WindowName: '???????T-???v???z?? v1.5'
ClassName: '' WindowName: '¤е¤¤ёк°T-±ВЕvєЮІzы v1.3'
ClassName: '' WindowName: '???????T-???v???z?? v1.2'
ClassName: '' WindowName: '¤е¤¤ёк°T-±ВЕvєЮІzы v1.2'
ClassName: '' WindowName: '???????T-???v???z?? v1.3'
ClassName: '' WindowName: '¤е¤¤ёк°T-±ВЕvєЮІzы v3.3'
ClassName: '' WindowName: '???????T-???v???z?? v3.4'
ClassName: '' WindowName: '¤е¤¤ёк°T-±ВЕvєЮІzы v3.4'
ClassName: '' WindowName: '???????T-???v???z?? v3.3'
ClassName: '' WindowName: '¤е¤¤ёк°T-±ВЕvєЮІzы v3.1'
ClassName: '' WindowName: '???????T-???v???z?? v3.2'
ClassName: '' WindowName: '¤е¤¤ёк°T-±ВЕvєЮІzы v3.2'
ClassName: '' WindowName: '???????T-???v???z?? v3.5'
ClassName: '' WindowName: '¤е¤¤ёк°T-±ВЕvєЮІzы v3.7'
ClassName: '' WindowName: '???????T-???v???z?? v3.8'
ClassName: '' WindowName: '¤е¤¤ёк°T-±ВЕvєЮІzы v3.8'
ClassName: '' WindowName: '???????T-???v???z?? v3.7'
ClassName: '' WindowName: '¤е¤¤ёк°T-±ВЕvєЮІzы v3.5'
ClassName: '' WindowName: '???????T-???v???z?? v3.6'
ClassName: '' WindowName: '¤е¤¤ёк°T-±ВЕvєЮІzы v3.6'
ClassName: '' WindowName: '???????T-???v???z?? v3.1'
ClassName: '' WindowName: '¤е¤¤ёк°T-±ВЕvєЮІzы v2.5'
ClassName: '' WindowName: '???????T-???v???z?? v2.6'
ClassName: '' WindowName: '¤е¤¤ёк°T-±ВЕvєЮІzы v2.6'
ClassName: '' WindowName: '???????T-???v???z?? v2.5'
ClassName: '' WindowName: '¤е¤¤ёк°T-±ВЕvєЮІzы v2.3'
ClassName: '' WindowName: '???????T-???v???z?? v2.4'
ClassName: '' WindowName: '¤е¤¤ёк°T-±ВЕvєЮІzы v2.4'
ClassName: '' WindowName: '???????T-???v???z?? v2.7'
ClassName: '' WindowName: '¤е¤¤ёк°T-±ВЕvєЮІzы v2.9'
ClassName: '' WindowName: '???????T-???v???z?? v3.0'
ClassName: '' WindowName: '¤е¤¤ёк°T-±ВЕvєЮІzы v3.0'
ClassName: '' WindowName: '???????T-???v???z?? v2.9'
ClassName: '' WindowName: '¤е¤¤ёк°T-±ВЕvєЮІzы v2.7'
ClassName: '' WindowName: '???????T-???v???z?? v2.8'
ClassName: '' WindowName: '¤е¤¤ёк°T-±ВЕvєЮІzы v2.8'

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней