Trojan.MulDrop6.63415

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'USB Security' = '%ProgramFiles%\USB Disk Security\USBGuard.exe'

Вредоносные функции:

Запускает на исполнение:

'%TEMP%\is-2S44V.tmp\setup.tmp' /SL5="$40036,4058717,147456,%TEMP%\7ZipSfx.000\setup.exe" /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-
'%TEMP%\7ZipSfx.000\setup.exe' /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-

Изменения в файловой системе:

Создает следующие файлы:

%ProgramFiles%\USB Disk Security\is-AKCGT.tmp
%ProgramFiles%\USB Disk Security\is-PQDAN.tmp
%ProgramFiles%\USB Disk Security\is-28OD0.tmp
%ProgramFiles%\USB Disk Security\is-I0FHG.tmp
%ProgramFiles%\USB Disk Security\is-KNDFT.tmp
%ProgramFiles%\USB Disk Security\is-E6MI6.tmp
%ALLUSERSPROFILE%\Start Menu\Programs\USB Disk Security\Uninstall USB Disk Security.lnk
%ALLUSERSPROFILE%\Desktop\USB Disk Security.lnk
%ProgramFiles%\USB Disk Security\unins000.dat
%ProgramFiles%\USB Disk Security\is-NAQUK.tmp
%ALLUSERSPROFILE%\Start Menu\Programs\USB Disk Security\USB Disk Security.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\USB Disk Security\Help.lnk
%ProgramFiles%\USB Disk Security\is-IGB98.tmp
%ProgramFiles%\USB Disk Security\is-TQQMV.tmp
%ProgramFiles%\USB Disk Security\is-PRKJN.tmp
%ProgramFiles%\USB Disk Security\is-PMMFN.tmp
%TEMP%\7ZipSfx.000\setup.exe
%TEMP%\is-2S44V.tmp\setup.tmp
%TEMP%\is-0K8DR.tmp\_isetup\_shfoldr.dll
%ProgramFiles%\USB Disk Security\is-ABF4D.tmp
%ProgramFiles%\USB Disk Security\is-JN9VG.tmp
%ProgramFiles%\USB Disk Security\is-33TL8.tmp
%ProgramFiles%\USB Disk Security\is-C59P3.tmp
%ProgramFiles%\USB Disk Security\is-3O3Q3.tmp
%ProgramFiles%\USB Disk Security\is-I1DQE.tmp

Удаляет следующие файлы:

%TEMP%\7ZipSfx.000\setup.exe
%TEMP%\is-2S44V.tmp\setup.tmp
%TEMP%\is-0K8DR.tmp\_isetup\_shfoldr.dll

Перемещает следующие файлы:

%ProgramFiles%\USB Disk Security\is-KNDFT.tmp в %ProgramFiles%\USB Disk Security\USBGuardUpdate.dat
%ProgramFiles%\USB Disk Security\is-E6MI6.tmp в %ProgramFiles%\USB Disk Security\log.dmb
%ProgramFiles%\USB Disk Security\is-IGB98.tmp в %ProgramFiles%\USB Disk Security\msvcr80.dll
%ProgramFiles%\USB Disk Security\is-I0FHG.tmp в %ProgramFiles%\USB Disk Security\USBGuardUpdate.exe
%ProgramFiles%\USB Disk Security\is-28OD0.tmp в %ProgramFiles%\USB Disk Security\log3.dmb
%ProgramFiles%\USB Disk Security\is-NAQUK.tmp в %ProgramFiles%\USB Disk Security\version.ini
%ProgramFiles%\USB Disk Security\is-AKCGT.tmp в %ProgramFiles%\USB Disk Security\log1.dmb
%ProgramFiles%\USB Disk Security\is-PQDAN.tmp в %ProgramFiles%\USB Disk Security\log2.dmb
%ProgramFiles%\USB Disk Security\is-33TL8.tmp в %ProgramFiles%\USB Disk Security\msvcp80.dll
%ProgramFiles%\USB Disk Security\is-PMMFN.tmp в %ProgramFiles%\USB Disk Security\USBGuard.chm
%ProgramFiles%\USB Disk Security\is-C59P3.tmp в %ProgramFiles%\USB Disk Security\BCGCBPRO1500u80.dll
%ProgramFiles%\USB Disk Security\is-TQQMV.tmp в %ProgramFiles%\USB Disk Security\unins000.exe
%ProgramFiles%\USB Disk Security\is-PRKJN.tmp в %ProgramFiles%\USB Disk Security\USBGuard.exe
%ProgramFiles%\USB Disk Security\is-ABF4D.tmp в %ProgramFiles%\USB Disk Security\Microsoft.VC80.CRT.manifest
%ProgramFiles%\USB Disk Security\is-JN9VG.tmp в %ProgramFiles%\USB Disk Security\Microsoft.VC80.MFC.manifest
%ProgramFiles%\USB Disk Security\is-3O3Q3.tmp в %ProgramFiles%\USB Disk Security\BCGPStyle2010Blue150.dll
%ProgramFiles%\USB Disk Security\is-I1DQE.tmp в %ProgramFiles%\USB Disk Security\mfc80u.dll