Trojan.MulDrop5.47697

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'USB Security' = '%PROGRAM_FILES%\USB Disk Security\USBGuard.exe'

Вредоносные функции:

Создает и запускает на исполнение:

'%PROGRAM_FILES%\USB Disk Security\USBGuard.exe'
'%TEMP%\is-6DUU7.tmp\~uaeblfo.tmp' /SL5="$100E2,3457342,77824,C:\~uaeblfo.tmp" /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-
'C:\~uaeblfo.tmp' \VERYSILENT \SUPPRESSMSGBOXES \NORESTART \SP-

Изменения в файловой системе:

Создает следующие файлы:

%PROGRAM_FILES%\USB Disk Security\locales\is-OEL5C.tmp
%PROGRAM_FILES%\USB Disk Security\locales\is-SNON4.tmp
%PROGRAM_FILES%\USB Disk Security\locales\is-EA5RO.tmp
%PROGRAM_FILES%\USB Disk Security\locales\is-EB31S.tmp
%PROGRAM_FILES%\USB Disk Security\locales\is-PODNS.tmp
%PROGRAM_FILES%\USB Disk Security\locales\is-7VSKR.tmp
%PROGRAM_FILES%\USB Disk Security\locales\is-50GHM.tmp
%PROGRAM_FILES%\USB Disk Security\locales\is-1UKUV.tmp
%PROGRAM_FILES%\USB Disk Security\locales\is-M48IB.tmp
%PROGRAM_FILES%\USB Disk Security\locales\is-L41KR.tmp
%ALLUSERSPROFILE%\Start Menu\Programs\USB Disk Security\Help.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\USB Disk Security\USB Disk Security.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\USB Disk Security\Uninstall USB Disk Security.lnk
%PROGRAM_FILES%\USB Disk Security\unins000.dat
%ALLUSERSPROFILE%\Desktop\USB Disk Security.lnk
%PROGRAM_FILES%\USB Disk Security\locales\is-J3VLV.tmp
%PROGRAM_FILES%\USB Disk Security\locales\is-T6R60.tmp
%PROGRAM_FILES%\USB Disk Security\locales\is-LKPE2.tmp
%PROGRAM_FILES%\USB Disk Security\locales\is-2VH6L.tmp
%PROGRAM_FILES%\USB Disk Security\is-QKIFP.tmp
%PROGRAM_FILES%\USB Disk Security\locales\is-46IOG.tmp
%PROGRAM_FILES%\USB Disk Security\is-QGJ59.tmp
%PROGRAM_FILES%\USB Disk Security\is-ORC0V.tmp
%PROGRAM_FILES%\USB Disk Security\is-SA753.tmp
%PROGRAM_FILES%\USB Disk Security\is-T40JI.tmp
%PROGRAM_FILES%\USB Disk Security\is-3A4NF.tmp
C:\~uaeblfo.tmp
%TEMP%\aut1.tmp
%TEMP%\is-6DUU7.tmp\~uaeblfo.tmp
%PROGRAM_FILES%\USB Disk Security\is-QCATV.tmp
%TEMP%\is-CEBNQ.tmp\_isetup\_shfoldr.dll
%PROGRAM_FILES%\USB Disk Security\is-S8TI0.tmp
%PROGRAM_FILES%\USB Disk Security\is-TLPU0.tmp
%PROGRAM_FILES%\USB Disk Security\is-DK3E5.tmp
%PROGRAM_FILES%\USB Disk Security\locales\is-Q6IH4.tmp
%PROGRAM_FILES%\USB Disk Security\is-E6BK9.tmp
%PROGRAM_FILES%\USB Disk Security\is-MJTBU.tmp
%PROGRAM_FILES%\USB Disk Security\is-SGS18.tmp
%PROGRAM_FILES%\USB Disk Security\is-CV50I.tmp
%PROGRAM_FILES%\USB Disk Security\is-SA02L.tmp
%PROGRAM_FILES%\USB Disk Security\is-KAO41.tmp

Присваивает атрибут 'скрытый' для следующих файлов:

C:\~uaeblfo.tmp

Удаляет следующие файлы:

%TEMP%\is-6DUU7.tmp\~uaeblfo.tmp
C:\~uaeblfo.tmp
%TEMP%\aut1.tmp
%TEMP%\is-CEBNQ.tmp\_isetup\_shfoldr.dll

Перемещает следующие файлы:

%PROGRAM_FILES%\USB Disk Security\locales\is-M48IB.tmp в %PROGRAM_FILES%\USB Disk Security\locales\ukrainian.dll
%PROGRAM_FILES%\USB Disk Security\locales\is-L41KR.tmp в %PROGRAM_FILES%\USB Disk Security\locales\french.dll
%PROGRAM_FILES%\USB Disk Security\locales\is-OEL5C.tmp в %PROGRAM_FILES%\USB Disk Security\locales\thai.dll
%PROGRAM_FILES%\USB Disk Security\locales\is-SNON4.tmp в %PROGRAM_FILES%\USB Disk Security\locales\indonesian.dll
%PROGRAM_FILES%\USB Disk Security\locales\is-50GHM.tmp в %PROGRAM_FILES%\USB Disk Security\locales\russian.dll
%PROGRAM_FILES%\USB Disk Security\locales\is-46IOG.tmp в %PROGRAM_FILES%\USB Disk Security\locales\portuese.dll
%PROGRAM_FILES%\USB Disk Security\locales\is-1UKUV.tmp в %PROGRAM_FILES%\USB Disk Security\locales\japanese.dll
%PROGRAM_FILES%\USB Disk Security\locales\is-7VSKR.tmp в %PROGRAM_FILES%\USB Disk Security\locales\spanish.dll
%PROGRAM_FILES%\USB Disk Security\locales\is-LKPE2.tmp в %PROGRAM_FILES%\USB Disk Security\locales\msvcr80.dll
%PROGRAM_FILES%\USB Disk Security\locales\is-J3VLV.tmp в %PROGRAM_FILES%\USB Disk Security\locales\msvcp80.dll
%PROGRAM_FILES%\USB Disk Security\locales\is-2VH6L.tmp в %PROGRAM_FILES%\USB Disk Security\locales\chinese.dll
%PROGRAM_FILES%\USB Disk Security\is-QKIFP.tmp в %PROGRAM_FILES%\USB Disk Security\USBSet.exe
%PROGRAM_FILES%\USB Disk Security\locales\is-PODNS.tmp в %PROGRAM_FILES%\USB Disk Security\locales\arabic.dll
%PROGRAM_FILES%\USB Disk Security\locales\is-EA5RO.tmp в %PROGRAM_FILES%\USB Disk Security\locales\turkish.dll
%PROGRAM_FILES%\USB Disk Security\locales\is-T6R60.tmp в %PROGRAM_FILES%\USB Disk Security\locales\Microsoft.VC80.CRT.manifest
%PROGRAM_FILES%\USB Disk Security\locales\is-EB31S.tmp в %PROGRAM_FILES%\USB Disk Security\locales\vietnam.dll
%PROGRAM_FILES%\USB Disk Security\is-T40JI.tmp в %PROGRAM_FILES%\USB Disk Security\mfc80u.dll
%PROGRAM_FILES%\USB Disk Security\is-3A4NF.tmp в %PROGRAM_FILES%\USB Disk Security\BCGPStyle2010Blue150.dll
%PROGRAM_FILES%\USB Disk Security\is-MJTBU.tmp в %PROGRAM_FILES%\USB Disk Security\Microsoft.VC80.MFC.manifest
%PROGRAM_FILES%\USB Disk Security\is-SGS18.tmp в %PROGRAM_FILES%\USB Disk Security\Microsoft.VC80.CRT.manifest
%PROGRAM_FILES%\USB Disk Security\is-ORC0V.tmp в %PROGRAM_FILES%\USB Disk Security\USBGuard.exe
%PROGRAM_FILES%\USB Disk Security\is-QCATV.tmp в %PROGRAM_FILES%\USB Disk Security\unins000.exe
%PROGRAM_FILES%\USB Disk Security\is-SA753.tmp в %PROGRAM_FILES%\USB Disk Security\BCGCBPRO1500u80.dll
%PROGRAM_FILES%\USB Disk Security\is-QGJ59.tmp в %PROGRAM_FILES%\USB Disk Security\USBGuard.chm
%PROGRAM_FILES%\USB Disk Security\is-DK3E5.tmp в %PROGRAM_FILES%\USB Disk Security\log3.dmb
%PROGRAM_FILES%\USB Disk Security\is-S8TI0.tmp в %PROGRAM_FILES%\USB Disk Security\log2.dmb
%PROGRAM_FILES%\USB Disk Security\locales\is-Q6IH4.tmp в %PROGRAM_FILES%\USB Disk Security\locales\chinetw.dll
%PROGRAM_FILES%\USB Disk Security\is-E6BK9.tmp в %PROGRAM_FILES%\USB Disk Security\version.ini
%PROGRAM_FILES%\USB Disk Security\is-KAO41.tmp в %PROGRAM_FILES%\USB Disk Security\msvcr80.dll
%PROGRAM_FILES%\USB Disk Security\is-CV50I.tmp в %PROGRAM_FILES%\USB Disk Security\msvcp80.dll
%PROGRAM_FILES%\USB Disk Security\is-TLPU0.tmp в %PROGRAM_FILES%\USB Disk Security\log1.dmb
%PROGRAM_FILES%\USB Disk Security\is-SA02L.tmp в %PROGRAM_FILES%\USB Disk Security\log.dmb