Trojan.MulDrop4.30796

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKLM>\SOFTWARE\Classes\WinRAR.REV\shell\open\command] '' = '"%PROGRAM_FILES%\WinRAR\WinRAR.exe" "%1"'
[<HKLM>\SOFTWARE\Classes\WinRAR.ZIP\shell\open\command] '' = '"%PROGRAM_FILES%\WinRAR\WinRAR.exe" "%1"'
[<HKLM>\SOFTWARE\Classes\WinRAR\shell\open\command] '' = '"%PROGRAM_FILES%\WinRAR\WinRAR.exe" "%1"'

Вредоносные функции:

Создает и запускает на исполнение:

%TEMP%\RarSFX0\Temi.exe
%TEMP%\RarSFX0\Settings.exe
%TEMP%\RarSFX0\Crack.exe
%TEMP%\RarSFX0\wrar371it.exe /S
%PROGRAM_FILES%\WinRAR\Uninstall.Exe /setup

Запускает на исполнение:

%WINDIR%\regedit.exe /S Settings.reg
<SYSTEM32>\cmd.exe /c ""%TEMP%\RarSFX1\install.cmd" "

Изменения в файловой системе:

Создает следующие файлы:

%HOMEPATH%\Dati applicazioni\WinRAR\Themes\Vista_Ultimate_48x48\RAR.ico
%HOMEPATH%\Dati applicazioni\WinRAR\Themes\Vista_Ultimate_48x48\RARSmall.bmp
%HOMEPATH%\Dati applicazioni\WinRAR\Themes\Vista_Ultimate_48x48\PasswordOn.ico
%HOMEPATH%\Dati applicazioni\WinRAR\Themes\Vista_Ultimate_48x48\PasswordOff.ico
%ALLUSERSPROFILE%\Start Menu\Programs\WinRAR\Manuale di RAR in modalita carattere.lnk
%HOMEPATH%\Dati applicazioni\WinRAR\Themes\Vista_Ultimate_48x48\REV.ico
%HOMEPATH%\Dati applicazioni\WinRAR\Themes\Vista_Ultimate_48x48\SortDown.bmp
%HOMEPATH%\Dati applicazioni\WinRAR\Themes\Vista_Ultimate_48x48\SortUp.bmp
%HOMEPATH%\Dati applicazioni\WinRAR\Themes\Vista_Ultimate_48x48\SFXLogo.bmp
%HOMEPATH%\Dati applicazioni\WinRAR\Themes\Vista_Ultimate_48x48\Setup.ico
%HOMEPATH%\Dati applicazioni\WinRAR\Themes\Vista_Ultimate_48x48\SFX.ico
%ALLUSERSPROFILE%\Start Menu\Programs\WinRAR\Guida a WinRAR.lnk
%HOMEPATH%\Dati applicazioni\WinRAR\Themes\Vista_Ultimate_48x48\DragCopy.cur
%HOMEPATH%\Dati applicazioni\WinRAR\Themes\Vista_Ultimate_48x48\DragMove.cur
%HOMEPATH%\Start Menu\Programs\WinRAR\Guida a WinRAR.lnk
%HOMEPATH%\Dati applicazioni\WinRAR\Themes\Vista_Ultimate_48x48\DiskOff.ico
%HOMEPATH%\Dati applicazioni\WinRAR\Themes\Vista_Ultimate_48x48\DiskOn.ico
%HOMEPATH%\Start Menu\Programs\WinRAR\Manuale di RAR in modalita carattere.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\WinRAR\WinRAR.lnk
%HOMEPATH%\Dati applicazioni\WinRAR\Themes\Vista_Ultimate_48x48\FolderUp.bmp
%HOMEPATH%\Dati applicazioni\WinRAR\Themes\Vista_Ultimate_48x48\File.ico
%HOMEPATH%\Dati applicazioni\WinRAR\Themes\Vista_Ultimate_48x48\DragNo.cur
%HOMEPATH%\Dati applicazioni\WinRAR\Themes\Vista_Ultimate_48x48\Estimate.bmp
%HOMEPATH%\Dati applicazioni\WinRAR\Themes\Vista_Ultimate_48x48\Toolbar\Add.bmp
%HOMEPATH%\Dati applicazioni\WinRAR\Themes\Vista_Ultimate_48x48\Toolbar\Test.bmp
%HOMEPATH%\Dati applicazioni\WinRAR\Themes\Vista_Ultimate_48x48\Toolbar\View.bmp
%HOMEPATH%\Dati applicazioni\WinRAR\Themes\Vista_Ultimate_48x48\Toolbar\SFX.bmp
%HOMEPATH%\Dati applicazioni\WinRAR\Themes\Vista_Ultimate_48x48\Toolbar\Repair.bmp
%HOMEPATH%\Dati applicazioni\WinRAR\Themes\Vista_Ultimate_48x48\Toolbar\Report.bmp
%HOMEPATH%\Dati applicazioni\WinRAR\Themes\Vista_Ultimate_48x48\Toolbar\VirusScan.bmp
%TEMP%\RarSFX1\Install.cmd
%TEMP%\RarSFX1\Settings.reg
%HOMEPATH%\Dati applicazioni\WinRAR\Themes\Vista_Ultimate_48x48\WizardLogo.bmp
%HOMEPATH%\Dati applicazioni\WinRAR\Themes\Vista_Ultimate_48x48\Toolbar\Wizard.bmp
%HOMEPATH%\Dati applicazioni\WinRAR\Themes\Vista_Ultimate_48x48\WinRAR_theme_description.txt
%HOMEPATH%\Dati applicazioni\WinRAR\Themes\Vista_Ultimate_48x48\Toolbar\Protect.bmp
%HOMEPATH%\Dati applicazioni\WinRAR\Themes\Vista_Ultimate_48x48\Toolbar\Delete.bmp
%HOMEPATH%\Dati applicazioni\WinRAR\Themes\Vista_Ultimate_48x48\Toolbar\Exit.bmp
%HOMEPATH%\Dati applicazioni\WinRAR\Themes\Vista_Ultimate_48x48\Toolbar\Convert.bmp
%HOMEPATH%\Dati applicazioni\WinRAR\Themes\Vista_Ultimate_48x48\Toolbar\Benchmark.bmp
%HOMEPATH%\Dati applicazioni\WinRAR\Themes\Vista_Ultimate_48x48\Toolbar\Comment.bmp
%HOMEPATH%\Dati applicazioni\WinRAR\Themes\Vista_Ultimate_48x48\Toolbar\Extract.bmp
%HOMEPATH%\Dati applicazioni\WinRAR\Themes\Vista_Ultimate_48x48\Toolbar\Lock.bmp
%HOMEPATH%\Dati applicazioni\WinRAR\Themes\Vista_Ultimate_48x48\Toolbar\Print.bmp
%HOMEPATH%\Dati applicazioni\WinRAR\Themes\Vista_Ultimate_48x48\Toolbar\Info.bmp
%HOMEPATH%\Dati applicazioni\WinRAR\Themes\Vista_Ultimate_48x48\Toolbar\ExtractTo.bmp
%HOMEPATH%\Dati applicazioni\WinRAR\Themes\Vista_Ultimate_48x48\Toolbar\Find.bmp
%PROGRAM_FILES%\WinRAR\Ordina.htm
%PROGRAM_FILES%\WinRAR\RarFiles.Lst
%PROGRAM_FILES%\WinRAR\Ordin.htm
%PROGRAM_FILES%\WinRAR\Rar.Txt
%PROGRAM_FILES%\WinRAR\SorgUnRAR.Txt
%PROGRAM_FILES%\WinRAR\Uninstall.Lst
%PROGRAM_FILES%\WinRAR\UnRAR.exe
%PROGRAM_FILES%\WinRAR\WinRAR.exe
%PROGRAM_FILES%\WinRAR\Uninstall.Exe
%PROGRAM_FILES%\WinRAR\RAR.exe
%PROGRAM_FILES%\WinRAR\RarExtLoader.exe
%PROGRAM_FILES%\WinRAR\Novita.Txt
%TEMP%\RarSFX0\Temi.exe
%PROGRAM_FILES%\WinRAR\File_Id.Diz
%TEMP%\RarSFX0\Settings.exe
%TEMP%\RarSFX0\wrar371it.exe
%TEMP%\RarSFX0\Crack.exe
%PROGRAM_FILES%\WinRAR\Formats\Descript.ion
%PROGRAM_FILES%\WinRAR\Licenza.Txt
%PROGRAM_FILES%\WinRAR\NoteTecniche.Txt
%PROGRAM_FILES%\WinRAR\Leggimi_1a.Txt
%PROGRAM_FILES%\WinRAR\Descript.ion
%PROGRAM_FILES%\WinRAR\Leggimi.Txt
%PROGRAM_FILES%\WinRAR\Formats\7zxa.dll
%PROGRAM_FILES%\WinRAR\Default.SFX
%PROGRAM_FILES%\WinRAR\WinCon.SFX
%PROGRAM_FILES%\WinRAR\Formats\z.fmt
%PROGRAM_FILES%\WinRAR\Formats\tar.fmt
%PROGRAM_FILES%\WinRAR\Formats\uue.fmt
%PROGRAM_FILES%\WinRAR\ZIP.SFX
%HOMEPATH%\Start Menu\Programs\WinRAR\WinRAR.lnk
%HOMEPATH%\Dati applicazioni\WinRAR\Themes\Vista_Ultimate_48x48\AboutLogo.bmp
%PROGRAM_FILES%\WinRAR\rarreg.key
%PROGRAM_FILES%\WinRAR\rarnew.dat
%PROGRAM_FILES%\WinRAR\zipnew.dat
%PROGRAM_FILES%\WinRAR\Formats\lzh.fmt
%PROGRAM_FILES%\WinRAR\winrar.chm
%PROGRAM_FILES%\WinRAR\Formats\7z.fmt
%PROGRAM_FILES%\WinRAR\Formats\UNACEV2.DLL
%PROGRAM_FILES%\WinRAR\RarExt.dll
%PROGRAM_FILES%\WinRAR\RarExt64.dll
%PROGRAM_FILES%\WinRAR\Formats\ace.fmt
%PROGRAM_FILES%\WinRAR\Formats\gz.fmt
%PROGRAM_FILES%\WinRAR\Formats\iso.fmt
%PROGRAM_FILES%\WinRAR\Formats\cab.fmt
%PROGRAM_FILES%\WinRAR\Formats\arj.fmt
%PROGRAM_FILES%\WinRAR\Formats\bz2.fmt