Trojan.MulDrop2.31363

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKLM>\SOFTWARE\Microsoft\Command Processor] 'AutoRun' = ''

Вредоносные функции:

Создает и запускает на исполнение:

C:\sUBs\TSF\vfind.exe -m -td -r ""C:\Documents and Settings\*"" -m -td -r *
C:\sUBs\TSF\nircmd.exe WIN CLOSE CLASS "cabinetwclass" SYSREFRESH INTL
C:\sUBs\TSF\swreg.exe COPY "HKCU\software\microsoft\command processor" "HKCU\software\microsoft\command processor_ComboFixBackUp" /S COPY "HKU\.DEFAULT\control panel\international" "HKU\.DEFAULT\control panel\international_ComboFixBackUp" /S COPY "HKCU\control panel\international" "HKCU\control panel\international_ComboFixBackUp" /S QUERY HKLM\software\swearware import region.reg COPY "HKLM\software\microsoft\command processor" "HKLM\software\microsoft\command processor_ComboFixBackUp" /S QUERY "HKLM\software\microsoft\command processor_ComboFixBackUp" QUERY "HKLM\software\microsoft\Windows\currentversion\explorer\user shell folders" QUERY "HKCU\software\microsoft\Windows\currentversion\explorer\user shell folders" DELETE "HKCU\software\microsoft\Windows\currentversion\policies\system" /V "disableregistrytools" /F QUERY hklm\system\currentcontrolset\enum\root\system QUERY "hklm\software\microsoft\windows\currentversion\internet settings\activex cache" QUERY "HKU\.DEFAULT\software\microsoft\windows\currentversion\explorer\shell folders"
<Текущая директория>\nircmd.exe KILLPROCESS ntp.exe WIN CLOSE ITITLE "AutoScan" KILLPROCESS ComboFix.exe KILLPROCESS thguard.exe
<Текущая директория>\swreg.exe QUERY "HKLM\system\currentcontrolset\control\session manager\environment" /V ComSpec QUERY "HKLM\system\currentcontrolset\control\session manager\environment" /V path QUERY "HKCU\software\microsoft\command processor" /V enableextensions

Запускает на исполнение:

<SYSTEM32>\find.exe /I "reg_"
<SYSTEM32>\attrib.exe -H -R -S -A ""%TEMP%\bt6816.bat""
<SYSTEM32>\find.exe "Windows 2000"
<SYSTEM32>\chcp.com 437
<SYSTEM32>\find.exe /I "ComboFix"
<SYSTEM32>\find.exe /I "reg_sz"
<SYSTEM32>\findstr.exe /I /L "%SystemRoot%\System32\cmd.exe <SYSTEM32>\cmd.exe"
<SYSTEM32>\chcp.com
<SYSTEM32>\find.exe "(0x1)"
<SYSTEM32>\find.exe "Windows XP"
<SYSTEM32>\findstr.exe /I /L "%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\wbem <SYSTEM32>;%WINDIR%;<SYSTEM32>\wbem"
<SYSTEM32>\find.exe /I "reg_expand_sz"
<SYSTEM32>\find.exe /I "Path"