Trojan.MulDrop6.52937

Техническая информация

Для обеспечения автозапуска и распространения:

Создает следующие сервисы:

[<HKLM>\SYSTEM\ControlSet001\Services\PrismXL] 'ImagePath' = '%CommonProgramFiles%\New Boundary\PrismXL\PRISMXL.SYS'
[<HKLM>\SYSTEM\ControlSet001\Services\PrismXL] 'Start' = '00000002'

Вредоносные функции:

Запускает на исполнение:

'%CommonProgramFiles%\New Boundary\PrismXL\PRISMXL.SYS'

Изменения в файловой системе:

Создает следующие файлы:

<SYSTEM32>\ltkrn12n.dll
<SYSTEM32>\ltisi12n.ocx
<SYSTEM32>\ltisi12n.dll
<SYSTEM32>\ltlst12n.dll
<SYSTEM32>\ltodb12n.ocx
<SYSTEM32>\ltocx12n.ocx
<SYSTEM32>\ltlst12n.ocx
<SYSTEM32>\ltimg12n.dll
<SYSTEM32>\ltdlg12n.dll
<SYSTEM32>\LTDIS12n.dll
<SYSTEM32>\ltdic12n.ocx
<SYSTEM32>\ltdlg12n.ocx
<SYSTEM32>\ltfil12n.DLL
<SYSTEM32>\ltefx12n.dll
<SYSTEM32>\ltdnc12n.ocx
<SYSTEM32>\pdfDLL32.dll
<SYSTEM32>\msxml3a.dll
<SYSTEM32>\Ltwvc12n.dll
<SYSTEM32>\TABCTL32.DEP
%ALLUSERSPROFILE%\Start Menu\Programs\Summation iBlaze®\Summation iBlaze® Version 2 December 2002 Client.lnk
%ALLUSERSPROFILE%\Desktop\Summation iBlaze® Version 2 December 2002 Client.lnk
<SYSTEM32>\TABCTL32.oca
<SYSTEM32>\LTWND12n.DLL
<SYSTEM32>\lttmb12n.dll
<SYSTEM32>\ltscr12n.ocx
<SYSTEM32>\ltscr12n.dll
<SYSTEM32>\lttmb12n.ocx
<SYSTEM32>\ltwen12n.dll
<SYSTEM32>\ltvec12n.ocx
<SYSTEM32>\lttwn12n.dll
%CommonProgramFiles%\InstallShield\Professional\RunTime\0700\Intel32\Setup.dll
%CommonProgramFiles%\InstallShield\Professional\RunTime\0700\Intel32\iuser.dll
%CommonProgramFiles%\InstallShield\Professional\RunTime\0700\Intel32\iscript.dll
%CommonProgramFiles%\InstallShield\Professional\RunTime\IsProBE.tlb
%ProgramFiles%\InstallShield Installation Information\{7221D5CB-A4E6-4FF8-B286-3534D674FF01}\data1.cab
%ProgramFiles%\InstallShield Installation Information\{7221D5CB-A4E6-4FF8-B286-3534D674FF01}\_setup.dll
%CommonProgramFiles%\InstallShield\Professional\RunTime\Objectps.dll
%CommonProgramFiles%\InstallShield\Professional\RunTime\0700\Intel32\iKernel.dll
%ALLUSERSPROFILE%\Application Data\Prism Pack\UNAPPLY\<Имя вируса>.PWR
%CommonProgramFiles%\New Boundary\PrismXL\PRISMXL.SYS
%TEMP%\PRISMXL.SYS
%ALLUSERSPROFILE%\Application Data\Prism Pack\UNAPPLY\<Имя вируса> 1.PWR
%CommonProgramFiles%\InstallShield\Professional\RunTime\0700\Intel32\IGdi.dll
%CommonProgramFiles%\InstallShield\Professional\RunTime\0700\Intel32\DotNetInstaller.exe
%CommonProgramFiles%\InstallShield\Professional\RunTime\0700\Intel32\ctor.dll
<SYSTEM32>\lffax12n.dll
<SYSTEM32>\LFCMP12n.DLL
<SYSTEM32>\lfbmp12n.dll
<SYSTEM32>\lfpdf12n.dll
<SYSTEM32>\LTDic12n.dll
<SYSTEM32>\ltann12n.dll
<SYSTEM32>\lftif12n.dll
<SYSTEM32>\hhactivex.dll
%ProgramFiles%\InstallShield Installation Information\{7221D5CB-A4E6-4FF8-B286-3534D674FF01}\setup.boot
%ProgramFiles%\InstallShield Installation Information\{7221D5CB-A4E6-4FF8-B286-3534D674FF01}\layout.bin
%ProgramFiles%\InstallShield Installation Information\{7221D5CB-A4E6-4FF8-B286-3534D674FF01}\data1.hdr
%ProgramFiles%\InstallShield Installation Information\{7221D5CB-A4E6-4FF8-B286-3534D674FF01}\setup.exe
%ProgramFiles%\InstallShield Installation Information\{7221D5CB-A4E6-4FF8-B286-3534D674FF01}\setup.inx
%ProgramFiles%\InstallShield Installation Information\{7221D5CB-A4E6-4FF8-B286-3534D674FF01}\setup.ini
%ProgramFiles%\InstallShield Installation Information\{7221D5CB-A4E6-4FF8-B286-3534D674FF01}\setup.ilg