Trojan.MulDrop6.57344

Техническая информация

Вредоносные функции:

Запускает на исполнение:

'%TEMP%\7ZipSfx.000\IDM1.tmp' -d "%TEMP%\7ZipSfx.000\"
'%TEMP%\7ZipSfx.000\IDM118.tmp' -d
'<SYSTEM32>\taskkill.exe' /IM IDMan.exe /F
'%CommonProgramFiles%\~zlxszcg.ibo' -Silent -noBAK -SpeedUP -Delete
'<SYSTEM32>\taskkill.exe' /f /im IDMIntegrator64.exe
'<SYSTEM32>\taskkill.exe' /f /im IDMan.exe
'<SYSTEM32>\cmd.exe' /c start /wait "app" IDM118.tmp -d
'<SYSTEM32>\taskkill.exe' /f /im IEMonitor.exe

Изменения в файловой системе:

Создает следующие файлы:

%ProgramFiles%\Internet Download Manager\IEMonitor.exe
%ProgramFiles%\Internet Download Manager\idmfsa.dll
%ProgramFiles%\Internet Download Manager\idmmzcc.xpi
%ProgramFiles%\Internet Download Manager\scheduler.chm
%ProgramFiles%\Internet Download Manager\defexclist.txt
%ProgramFiles%\Internet Download Manager\IEGetVL2.htm
%ProgramFiles%\Internet Download Manager\IEGetVL.htm
%ProgramFiles%\Internet Download Manager\grabber.chm
%ProgramFiles%\Internet Download Manager\Toolbar\3d_largeHot_3.bmp
%ProgramFiles%\Internet Download Manager\Toolbar\3d_large_3.bmp
%ProgramFiles%\Internet Download Manager\Toolbar\3d_style_3.tbi
%ProgramFiles%\Internet Download Manager\Toolbar\3d_small_3.bmp
%ProgramFiles%\Internet Download Manager\IDMGrHlp.exe
%ProgramFiles%\Internet Download Manager\downlWithIDM.dll
%ProgramFiles%\Internet Download Manager\Toolbar\3d_smallHot_3.bmp
%ProgramFiles%\Internet Download Manager\idmbrbtn64.dll
%ProgramFiles%\Internet Download Manager\IDMShellExt64.dll
%ProgramFiles%\Internet Download Manager\idmtdi32.sys
%ProgramFiles%\Internet Download Manager\idmwfp64.sys
%ProgramFiles%\Internet Download Manager\Languages\idm_ru.lng
%ProgramFiles%\Internet Download Manager\idmwfp.cat
%ProgramFiles%\Internet Download Manager\idmtdi64.sys
%ProgramFiles%\Internet Download Manager\idmwfp32.sys
%ProgramFiles%\Internet Download Manager\Languages\idm_tr.lng
%ProgramFiles%\Internet Download Manager\idmftype.dll
%ProgramFiles%\Internet Download Manager\idmbrbtn.dll
%ProgramFiles%\Internet Download Manager\Languages\tips_tr.txt
%ProgramFiles%\Internet Download Manager\idmtdi.inf
%ProgramFiles%\Internet Download Manager\idmwfp.inf
%ProgramFiles%\Internet Download Manager\IDMShellExt.dll
%ProgramFiles%\Internet Download Manager\IEGetAll.htm
%ProgramFiles%\Internet Download Manager\IEExt.htm
%ProgramFiles%\Internet Download Manager\idmmkb.dll
%ProgramFiles%\Internet Download Manager\Languages\idm_fa.lng
%ProgramFiles%\Internet Download Manager\tutor.chm
%ProgramFiles%\Internet Download Manager\tips.txt
%ProgramFiles%\Internet Download Manager\idmtdi.cat
%ProgramFiles%\Internet Download Manager\IDMGetAll.dll
%ProgramFiles%\Internet Download Manager\license.txt
%ProgramFiles%\Internet Download Manager\Uninstall.exe
%TEMP%\7ZipSfx.000\IDMSetup2.log
%ProgramFiles%\Internet Download Manager\IDMIECC.dll
%ProgramFiles%\Internet Download Manager\idmantypeinfo.tlb
%ProgramFiles%\Internet Download Manager\IDMan.exe
%ProgramFiles%\Internet Download Manager\idman.chm
%ProgramFiles%\Internet Download Manager\Languages\tips_es.txt
%ProgramFiles%\Internet Download Manager\Languages\tips_de.txt
%ProgramFiles%\Internet Download Manager\Languages\tips_ar.txt
%ProgramFiles%\Internet Download Manager\Languages\tips_fr.txt
%ProgramFiles%\Internet Download Manager\Languages\tips_nl.txt
%ProgramFiles%\Internet Download Manager\Languages\tips_ptbr.txt
%ProgramFiles%\Internet Download Manager\Languages\tips_it.txt
%ProgramFiles%\Internet Download Manager\Languages\template.lng
%ProgramFiles%\Internet Download Manager\Languages\idm_es.lng
%ProgramFiles%\Internet Download Manager\Languages\idm_de.lng
%ProgramFiles%\Internet Download Manager\Languages\idm_ar.lng
%ProgramFiles%\Internet Download Manager\Languages\idm_fr.lng
%ProgramFiles%\Internet Download Manager\Languages\idm_nl.lng
%ProgramFiles%\Internet Download Manager\Languages\idm_ptbr.lng
%ProgramFiles%\Internet Download Manager\Languages\idm_it.lng
%ProgramFiles%\Internet Download Manager\idmindex.dll
%ProgramFiles%\Internet Download Manager\Toolbar\3d_largeHot_3_hdpi15.bmp
%ProgramFiles%\Internet Download Manager\Toolbar\3d_large_3_hdpi15.bmp
%ProgramFiles%\Internet Download Manager\Languages\inst_cht.lng
%ProgramFiles%\Internet Download Manager\Languages\inst_pt.lng
%ProgramFiles%\Internet Download Manager\Languages\inst_es.lng
%ProgramFiles%\Internet Download Manager\Languages\inst_hu.lng
%ProgramFiles%\Internet Download Manager\Languages\inst_pl.lng
%ProgramFiles%\Internet Download Manager\idmBroker.exe
%ProgramFiles%\Internet Download Manager\Languages\inst_cz.lng
%ProgramFiles%\Internet Download Manager\Languages\inst_id.lng
%ProgramFiles%\Internet Download Manager\Languages\inst_iw.lng
%ProgramFiles%\Internet Download Manager\Languages\inst_sk.lng
%ProgramFiles%\Internet Download Manager\Languages\inst_tr.lng
%ProgramFiles%\Internet Download Manager\MediumILStart.exe
%ProgramFiles%\Internet Download Manager\Languages\inst_uz.lng
%ProgramFiles%\Internet Download Manager\idmmzcc2.xpi
%ProgramFiles%\Internet Download Manager\idmcchandler7_64.dll
%ProgramFiles%\Internet Download Manager\Languages\inst_vn.lng
%TEMP%\UnSigner.exe
%ProgramFiles%\Internet Download Manager\IDMSetup2.log
%ProgramFiles%\Internet Download Manager\Languages\idm_iw.lng
%ProgramFiles%\Internet Download Manager\idmcchandler7.dll
%ProgramFiles%\Internet Download Manager\Languages\inst_gr.lng
%ProgramFiles%\Internet Download Manager\idmvconv.dll
%ProgramFiles%\Internet Download Manager\Languages\inst_bg.lng
%ProgramFiles%\Internet Download Manager\Languages\inst_al.lng
%ProgramFiles%\Internet Download Manager\idmmzcc7_64.dll
%ProgramFiles%\Internet Download Manager\idmmzcc7.dll
%ProgramFiles%\Internet Download Manager\Languages\inst_my.lng
%ProgramFiles%\Internet Download Manager\IDMFType.dat
%ProgramFiles%\Internet Download Manager\IDMIntegrator64.exe
%ProgramFiles%\Internet Download Manager\downlWithIDM64.dll
%ProgramFiles%\Internet Download Manager\IDMFType64.dll
%ProgramFiles%\Internet Download Manager\Languages\template_inst.lng
%ProgramFiles%\Internet Download Manager\IDMNetMon64.dll
%ProgramFiles%\Internet Download Manager\IDMNetMon.dll
%ProgramFiles%\Internet Download Manager\IDMGetAll64.dll
%ProgramFiles%\Internet Download Manager\Languages\tips_th.txt
%ProgramFiles%\Internet Download Manager\Languages\idm_th.lng
%ProgramFiles%\Internet Download Manager\Languages\tips_ru.txt
%ProgramFiles%\Internet Download Manager\Languages\idm_pl.lng
%ProgramFiles%\Internet Download Manager\IDMIECC64.dll
%ProgramFiles%\Internet Download Manager\Languages\tips_fa.txt
%ProgramFiles%\Internet Download Manager\Languages\tips_pl.txt
%ProgramFiles%\Internet Download Manager\Languages\inst_chn.lng
%ProgramFiles%\Internet Download Manager\IDMGCExt.crx
%ProgramFiles%\Internet Download Manager\Languages\inst_fa.lng
%ProgramFiles%\Internet Download Manager\Languages\inst_th.lng
%ProgramFiles%\Internet Download Manager\Languages\inst_dk.lng
%ProgramFiles%\Internet Download Manager\idmvs.dll
%ProgramFiles%\Internet Download Manager\Languages\inst_ua.lng
%ProgramFiles%\Internet Download Manager\Languages\inst_de.lng
%ProgramFiles%\Internet Download Manager\Languages\inst_src.lng
%ProgramFiles%\Internet Download Manager\Languages\inst_fr.lng
%ProgramFiles%\Internet Download Manager\Languages\inst_ru.lng
%ProgramFiles%\Internet Download Manager\Languages\inst_ar.lng
%ProgramFiles%\Internet Download Manager\Languages\inst_kr.lng
%ProgramFiles%\Internet Download Manager\Languages\inst_it.lng
%ProgramFiles%\Internet Download Manager\Languages\inst_ptbr.lng
%CommonProgramFiles%\~zlxszcg.ibo
%TEMP%\7ZipSfx.000\IDM28.tmp
%TEMP%\7ZipSfx.000\IDM27.tmp
%TEMP%\7ZipSfx.000\IDM26.tmp
%TEMP%\7ZipSfx.000\IDM29.tmp
%TEMP%\7ZipSfx.000\IDM31.tmp
%TEMP%\7ZipSfx.000\IDM30.tmp
%TEMP%\7ZipSfx.000\IDM3.tmp
%TEMP%\7ZipSfx.000\IDM25.tmp
%TEMP%\7ZipSfx.000\IDM20.tmp
%TEMP%\7ZipSfx.000\IDM2.tmp
%TEMP%\7ZipSfx.000\IDM19.tmp
%TEMP%\7ZipSfx.000\IDM21.tmp
%TEMP%\7ZipSfx.000\IDM24.tmp
%TEMP%\7ZipSfx.000\IDM23.tmp
%TEMP%\7ZipSfx.000\IDM22.tmp
%TEMP%\7ZipSfx.000\IDM41.tmp
%TEMP%\7ZipSfx.000\IDM40.tmp
%TEMP%\7ZipSfx.000\IDM4.tmp
%TEMP%\7ZipSfx.000\IDM42.tmp
%TEMP%\7ZipSfx.000\IDM45.tmp
%TEMP%\7ZipSfx.000\IDM44.tmp
%TEMP%\7ZipSfx.000\IDM43.tmp
%TEMP%\7ZipSfx.000\IDM39.tmp
%TEMP%\7ZipSfx.000\IDM34.tmp
%TEMP%\7ZipSfx.000\IDM33.tmp
%TEMP%\7ZipSfx.000\IDM32.tmp
%TEMP%\7ZipSfx.000\IDM35.tmp
%TEMP%\7ZipSfx.000\IDM38.tmp
%TEMP%\7ZipSfx.000\IDM37.tmp
%TEMP%\7ZipSfx.000\IDM36.tmp
%TEMP%\7ZipSfx.000\IDM107.tmp
%TEMP%\7ZipSfx.000\IDM106.tmp
%TEMP%\7ZipSfx.000\IDM105.tmp
%TEMP%\7ZipSfx.000\IDM108.tmp
%TEMP%\7ZipSfx.000\IDM110.tmp
%TEMP%\7ZipSfx.000\IDM11.tmp
%TEMP%\7ZipSfx.000\IDM109.tmp
%TEMP%\7ZipSfx.000\IDM104.tmp
%TEMP%\7ZipSfx.000\IDM10.tmp
%TEMP%\7ZipSfx.000\IDM1.tmp
%TEMP%\7ZipSfx.000\IDM0.tmp
%TEMP%\7ZipSfx.000\IDM100.tmp
%TEMP%\7ZipSfx.000\IDM103.tmp
%TEMP%\7ZipSfx.000\IDM102.tmp
%TEMP%\7ZipSfx.000\IDM101.tmp
%TEMP%\7ZipSfx.000\IDM14.tmp
%TEMP%\7ZipSfx.000\IDM13.tmp
%TEMP%\7ZipSfx.000\IDM12.tmp
%TEMP%\7ZipSfx.000\IDM15.tmp
%TEMP%\7ZipSfx.000\IDM18.tmp
%TEMP%\7ZipSfx.000\IDM17.tmp
%TEMP%\7ZipSfx.000\IDM16.tmp
%TEMP%\7ZipSfx.000\IDM118.tmp
%TEMP%\7ZipSfx.000\IDM113.tmp
%TEMP%\7ZipSfx.000\IDM112.tmp
%TEMP%\7ZipSfx.000\IDM111.tmp
%TEMP%\7ZipSfx.000\IDM114.tmp
%TEMP%\7ZipSfx.000\IDM117.tmp
%TEMP%\7ZipSfx.000\IDM116.tmp
%TEMP%\7ZipSfx.000\IDM115.tmp
%TEMP%\7ZipSfx.000\IDM82.tmp
%TEMP%\7ZipSfx.000\IDM81.tmp
%TEMP%\7ZipSfx.000\IDM80.tmp
%TEMP%\7ZipSfx.000\IDM83.tmp
%TEMP%\7ZipSfx.000\IDM86.tmp
%TEMP%\7ZipSfx.000\IDM85.tmp
%TEMP%\7ZipSfx.000\IDM84.tmp
%TEMP%\7ZipSfx.000\IDM8.tmp
%TEMP%\7ZipSfx.000\IDM75.tmp
%TEMP%\7ZipSfx.000\IDM74.tmp
%TEMP%\7ZipSfx.000\IDM73.tmp
%TEMP%\7ZipSfx.000\IDM76.tmp
%TEMP%\7ZipSfx.000\IDM79.tmp
%TEMP%\7ZipSfx.000\IDM78.tmp
%TEMP%\7ZipSfx.000\IDM77.tmp
%TEMP%\7ZipSfx.000\IDM96.tmp
%TEMP%\7ZipSfx.000\IDM95.tmp
%TEMP%\7ZipSfx.000\IDM94.tmp
%TEMP%\7ZipSfx.000\IDM97.tmp
%TEMP%\aut1.tmp
%TEMP%\7ZipSfx.000\IDM99.tmp
%TEMP%\7ZipSfx.000\IDM98.tmp
%TEMP%\7ZipSfx.000\IDM93.tmp
%TEMP%\7ZipSfx.000\IDM89.tmp
%TEMP%\7ZipSfx.000\IDM88.tmp
%TEMP%\7ZipSfx.000\IDM87.tmp
%TEMP%\7ZipSfx.000\IDM9.tmp
%TEMP%\7ZipSfx.000\IDM92.tmp
%TEMP%\7ZipSfx.000\IDM91.tmp
%TEMP%\7ZipSfx.000\IDM90.tmp
%TEMP%\7ZipSfx.000\IDM55.tmp
%TEMP%\7ZipSfx.000\IDM54.tmp
%TEMP%\7ZipSfx.000\IDM53.tmp
%TEMP%\7ZipSfx.000\IDM56.tmp
%TEMP%\7ZipSfx.000\IDM59.tmp
%TEMP%\7ZipSfx.000\IDM58.tmp
%TEMP%\7ZipSfx.000\IDM57.tmp
%TEMP%\7ZipSfx.000\IDM52.tmp
%TEMP%\7ZipSfx.000\IDM48.tmp
%TEMP%\7ZipSfx.000\IDM47.tmp
%TEMP%\7ZipSfx.000\IDM46.tmp
%TEMP%\7ZipSfx.000\IDM49.tmp
%TEMP%\7ZipSfx.000\IDM51.tmp
%TEMP%\7ZipSfx.000\IDM50.tmp
%TEMP%\7ZipSfx.000\IDM5.tmp
%TEMP%\7ZipSfx.000\IDM69.tmp
%TEMP%\7ZipSfx.000\IDM68.tmp
%TEMP%\7ZipSfx.000\IDM67.tmp
%TEMP%\7ZipSfx.000\IDM7.tmp
%TEMP%\7ZipSfx.000\IDM72.tmp
%TEMP%\7ZipSfx.000\IDM71.tmp
%TEMP%\7ZipSfx.000\IDM70.tmp
%TEMP%\7ZipSfx.000\IDM66.tmp
%TEMP%\7ZipSfx.000\IDM61.tmp
%TEMP%\7ZipSfx.000\IDM60.tmp
%TEMP%\7ZipSfx.000\IDM6.tmp
%TEMP%\7ZipSfx.000\IDM62.tmp
%TEMP%\7ZipSfx.000\IDM65.tmp
%TEMP%\7ZipSfx.000\IDM64.tmp
%TEMP%\7ZipSfx.000\IDM63.tmp

Присваивает атрибут 'скрытый' для следующих файлов:

%CommonProgramFiles%\~zlxszcg.ibo

Удаляет следующие файлы:

%TEMP%\aut1.tmp

Другое:

Ищет следующие окна:

ClassName: '' WindowName: 'IDM agent for click monitoring in IE-based browsers'
ClassName: 'Shell_TrayWnd' WindowName: ''
ClassName: '' WindowName: ''

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней