Trojan.MulDrop5.37174

Техническая информация

Вредоносные функции:

Создает и запускает на исполнение:

'%WINDIR%\Leadcore DTM8100 MuxService\MuxService.exe' -u

Запускает на исполнение:

'<SYSTEM32>\cmd.exe' /c uninstall.bat

Изменения в файловой системе:

Создает следующие файлы:

%WINDIR%\Leadcore DTM8100 MuxService\~GLH000d.TMP
%WINDIR%\Leadcore DTM8100 MuxService\~GLH000e.TMP
%WINDIR%\Leadcore DTM8100 MuxService\~GLH000f.TMP
%WINDIR%\Leadcore DTM8100 MuxService\~GLH000a.TMP
%WINDIR%\Leadcore DTM8100 MuxService\~GLH000b.TMP
%WINDIR%\Leadcore DTM8100 MuxService\~GLH000c.TMP
%WINDIR%\Leadcore DTM8100 MuxService\~GLH0010.TMP
%WINDIR%\Leadcore DTM8100 MuxService\~GLH0014.TMP
%WINDIR%\Leadcore DTM8100 MuxService\~GLH0015.TMP
<SYSTEM32>\~GLH0016.TMP
%WINDIR%\Leadcore DTM8100 MuxService\~GLH0011.TMP
%WINDIR%\Leadcore DTM8100 MuxService\~GLH0012.TMP
%WINDIR%\Leadcore DTM8100 MuxService\~GLH0013.TMP
%TEMP%\~GLH0000.TMP
%WINDIR%\Leadcore DTM8100 MuxService\~GLH0001.TMP
%WINDIR%\Leadcore DTM8100 MuxService\~GLH0002.TMP
%TEMP%\GLC1.tmp
%TEMP%\GLJ2.tmp
%TEMP%\GLK3.tmp
%WINDIR%\Leadcore DTM8100 MuxService\~GLH0003.TMP
%WINDIR%\Leadcore DTM8100 MuxService\~GLH0007.TMP
%WINDIR%\Leadcore DTM8100 MuxService\~GLH0008.TMP
%WINDIR%\Leadcore DTM8100 MuxService\~GLH0009.TMP
%WINDIR%\Leadcore DTM8100 MuxService\~GLH0004.TMP
%WINDIR%\Leadcore DTM8100 MuxService\~GLH0005.TMP
%WINDIR%\Leadcore DTM8100 MuxService\~GLH0006.TMP

Перемещает следующие файлы:

%WINDIR%\Leadcore DTM8100 MuxService\~GLH000f.TMP в %WINDIR%\Leadcore DTM8100 MuxService\Usb_dtm8100.inf
%WINDIR%\Leadcore DTM8100 MuxService\~GLH0010.TMP в %WINDIR%\Leadcore DTM8100 MuxService\Usb_dtm8100_old.inf
%WINDIR%\Leadcore DTM8100 MuxService\~GLH000e.TMP в %WINDIR%\Leadcore DTM8100 MuxService\version.txt
%WINDIR%\Leadcore DTM8100 MuxService\~GLH000c.TMP в %WINDIR%\Leadcore DTM8100 MuxService\MuxUI.exe
%WINDIR%\Leadcore DTM8100 MuxService\~GLH000d.TMP в %WINDIR%\Leadcore DTM8100 MuxService\ACE+TAO+CIAO_COPYING.txt
%WINDIR%\Leadcore DTM8100 MuxService\~GLH0011.TMP в %WINDIR%\Leadcore DTM8100 MuxService\Vcom_dtm8100.inf
%WINDIR%\Leadcore DTM8100 MuxService\~GLH0015.TMP в %WINDIR%\Leadcore DTM8100 MuxService\UninstallOld3.EXE
<SYSTEM32>\~GLH0016.TMP в <SYSTEM32>\MuxUserApi.dll
%WINDIR%\Leadcore DTM8100 MuxService\~GLH0014.TMP в %WINDIR%\Leadcore DTM8100 MuxService\UninstallOld2.EXE
%WINDIR%\Leadcore DTM8100 MuxService\~GLH0012.TMP в %WINDIR%\Leadcore DTM8100 MuxService\Modem_dtm8100.inf
%WINDIR%\Leadcore DTM8100 MuxService\~GLH0013.TMP в %WINDIR%\Leadcore DTM8100 MuxService\UninstallOld.EXE
%WINDIR%\Leadcore DTM8100 MuxService\~GLH000b.TMP в %WINDIR%\Leadcore DTM8100 MuxService\MuxService.exe
%WINDIR%\Leadcore DTM8100 MuxService\~GLH0003.TMP в %WINDIR%\Leadcore DTM8100 MuxService\start.bat
%WINDIR%\Leadcore DTM8100 MuxService\~GLH0004.TMP в %WINDIR%\Leadcore DTM8100 MuxService\install.bat
%WINDIR%\Leadcore DTM8100 MuxService\~GLH0002.TMP в %WINDIR%\Leadcore DTM8100 MuxService\stop.bat
%TEMP%\~GLH0000.TMP в %TEMP%\GLF5.tmp
%WINDIR%\Leadcore DTM8100 MuxService\~GLH0001.TMP в %WINDIR%\Leadcore DTM8100 MuxService\KillProcess.exe
%WINDIR%\Leadcore DTM8100 MuxService\~GLH0005.TMP в %WINDIR%\Leadcore DTM8100 MuxService\uninstall.bat
%WINDIR%\Leadcore DTM8100 MuxService\~GLH0009.TMP в %WINDIR%\Leadcore DTM8100 MuxService\MuxManager.exe
%WINDIR%\Leadcore DTM8100 MuxService\~GLH000a.TMP в %WINDIR%\Leadcore DTM8100 MuxService\MuxService.dll
%WINDIR%\Leadcore DTM8100 MuxService\~GLH0008.TMP в %WINDIR%\Leadcore DTM8100 MuxService\MuxLoader.exe
%WINDIR%\Leadcore DTM8100 MuxService\~GLH0006.TMP в %WINDIR%\Leadcore DTM8100 MuxService\InfInstall.exe
%WINDIR%\Leadcore DTM8100 MuxService\~GLH0007.TMP в %WINDIR%\Leadcore DTM8100 MuxService\ace.dll