Trojan.MulDrop5.50269

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'GamingWonderland Browser Plugin Loader' = '%PROGRAM_FILES%\GamingWonderland\bar\1.bin\gtbrmon.exe'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'GamingWonderland Search Scope Monitor' = '"%PROGRAM_FILES%\GamingWonderland\bar\1.bin\gtsrchmn.exe" /m=2 /w /h'

Создает следующие сервисы:

[<HKLM>\SYSTEM\ControlSet001\services\GamingWonderlandService] 'Start' = '00000002'

Вредоносные функции:

Создает и запускает на исполнение:

'%PROGRAM_FILES%\GamingWonderland\bar\1.bin\gtbrmon.exe'
'%PROGRAM_FILES%\GamingWonderland\bar\1.bin\gtbarsvc.exe'
'%PROGRAM_FILES%\GamingWonderland\bar\1.bin\gtHighIn.exe' gttpinst.dll,#5
'%PROGRAM_FILES%\GamingWonderland\bar\1.bin\gtbarsvc.exe' -install
'%TEMP%\00000598T8SETUP.EXE' /p=Z7/n="GamingWonderland"
'%PROGRAM_FILES%\GamingWonderland\bar\1.bin\gtsrchmn.exe' /m=2 /w /h /r
'%PROGRAM_FILES%\GamingWonderland\bar\1.bin\gtbarsvc.exe' -remove

Изменения в файловой системе:

Создает следующие файлы:

%PROGRAM_FILES%\GamingWonderland\bar\1.bin\gtskin.dll
%PROGRAM_FILES%\GamingWonderland\bar\1.bin\gtscript.dll
%PROGRAM_FILES%\GamingWonderland\bar\1.bin\T8RES.DLL
%PROGRAM_FILES%\GamingWonderland\bar\1.bin\gtsknlcr.dll
%PROGRAM_FILES%\GamingWonderland\bar\1.bin\gtSrchMn.exe
%PROGRAM_FILES%\GamingWonderland\bar\1.bin\gtSrcAs.dll
%PROGRAM_FILES%\GamingWonderland\bar\1.bin\gtskplay.exe
%PROGRAM_FILES%\GamingWonderland\bar\1.bin\gtPlugin.dll
%PROGRAM_FILES%\GamingWonderland\bar\1.bin\gtmsg.dll
%PROGRAM_FILES%\GamingWonderland\bar\1.bin\gtmlbtn.dll
%PROGRAM_FILES%\GamingWonderland\bar\1.bin\gtradio.dll
%PROGRAM_FILES%\GamingWonderland\bar\1.bin\gtregiet.dll
%PROGRAM_FILES%\GamingWonderland\bar\1.bin\gtreghk.dll
%PROGRAM_FILES%\GamingWonderland\bar\1.bin\gtregfft.dll
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\gtffxtbr@GamingWonderland.com\bootstrap.js
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\gtffxtbr@GamingWonderland.com\installKeys.js
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\gtffxtbr@GamingWonderland.com\chrome.manifest
%PROGRAM_FILES%\GamingWonderland\bar\Message\COMMON.T8S
%PROGRAM_FILES%\GamingWonderland\bar\Settings\s_pid.dat
%PROGRAM_FILES%\GamingWonderland\bar\IE9Mesg\COMMON.T8S
%PROGRAM_FILES%\GamingWonderland\bar\gen1\COMMON.T8S
%PROGRAM_FILES%\GamingWonderland\bar\1.bin\gtuabtn.dll
%PROGRAM_FILES%\GamingWonderland\bar\1.bin\gttpinst.dll
%PROGRAM_FILES%\GamingWonderland\bar\1.bin\T8TICKER.DLL
%PROGRAM_FILES%\GamingWonderland\bar\1.bin\chrome\gtffxtbr.jar
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\gtffxtbr@GamingWonderland.com\install.rdf
%APPDATA%\Roaming\Mozilla\Firefox\Profiles\fzv9i9tr.default\extensions\gtffxtbr@GamingWonderland.com\chrome\gtffxtbr.jar
%PROGRAM_FILES%\GamingWonderland\bar\1.bin\installKeys.js
%PROGRAM_FILES%\GamingWonderland\bar\1.bin\gtmedint.exe
%PROGRAM_FILES%\GamingWonderland\bar\1.bin\gtauxstb.dll
%PROGRAM_FILES%\GamingWonderland\bar\1.bin\NPgtStub.dll
%PROGRAM_FILES%\GamingWonderland\bar\1.bin\LOGO.BMP
%PROGRAM_FILES%\GamingWonderland\bar\1.bin\gtbar.dll
%PROGRAM_FILES%\GamingWonderland\bar\1.bin\gtbrstub.dll
%PROGRAM_FILES%\GamingWonderland\bar\1.bin\gtbrmon.exe
%PROGRAM_FILES%\GamingWonderland\bar\1.bin\gtbarsvc.exe
%PROGRAM_FILES%\GamingWonderland\bar\1.bin\BOOTSTRAP.JS
%TEMP%\00000598T8SETUP.EXE
%TEMP%\00000598T8SETUP.EX_
%PROGRAM_FILES%\GamingWonderland\bar\1.bin\CHROME.MANIFEST
%PROGRAM_FILES%\GamingWonderland\bar\1.bin\INSTALL.RDF
%PROGRAM_FILES%\GamingWonderland\bar\1.bin\CrExtPgt.exe
%PROGRAM_FILES%\GamingWonderland\bar\1.bin\CREXT.DLL
%PROGRAM_FILES%\GamingWonderland\bar\1.bin\gthtmlmu.dll
%PROGRAM_FILES%\GamingWonderland\bar\1.bin\T8HTML.DLL
%PROGRAM_FILES%\GamingWonderland\bar\1.bin\gthkstub.dll
%PROGRAM_FILES%\GamingWonderland\bar\1.bin\gthttpct.dll
%PROGRAM_FILES%\GamingWonderland\bar\1.bin\gtimpipe.exe
%PROGRAM_FILES%\GamingWonderland\bar\1.bin\gtieovr.dll
%PROGRAM_FILES%\GamingWonderland\bar\1.bin\gtidle.dll
%PROGRAM_FILES%\GamingWonderland\bar\1.bin\gtdyn.dll
%PROGRAM_FILES%\GamingWonderland\bar\1.bin\gtdlghk.dll
%PROGRAM_FILES%\GamingWonderland\bar\1.bin\gtdatact.dll
%PROGRAM_FILES%\GamingWonderland\bar\1.bin\T8EXTEX.DLL
%PROGRAM_FILES%\GamingWonderland\bar\1.bin\gthighin.exe
%PROGRAM_FILES%\GamingWonderland\bar\1.bin\gtfeedmg.dll
%PROGRAM_FILES%\GamingWonderland\bar\1.bin\T8EXTPEX.DLL