Trojan.MulDrop6.63934

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000011] 'PackedCatalogItem' = '{25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33,32,...
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000012] 'PackedCatalogItem' = '{25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33,32,...
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000009] 'PackedCatalogItem' = '{25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33,32,...
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000010] 'PackedCatalogItem' = '{25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33,32,...
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000013] 'PackedCatalogItem' = '{25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33,32,...
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000003] 'LibraryPath' = '<SYSTEM32>\mswsock.dll'
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000004] 'LibraryPath' = '<SYSTEM32>\PrxerNsp.dll'
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000001] 'LibraryPath' = '<SYSTEM32>\mswsock.dll'
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000002] 'LibraryPath' = '<SYSTEM32>\winrnr.dll'
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000002] 'PackedCatalogItem' = '{25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33,32,...
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000003] 'PackedCatalogItem' = '{25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33,32,...
[<HKLM>\SOFTWARE\Classes\Proxifier.Document\shell\open\command] '' = '%ProgramFiles%\Proxifier\Proxifier.exe "%1"'
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001] 'PackedCatalogItem' = '{25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33,32,...
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000004] 'PackedCatalogItem' = '{25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33,32,...
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000007] 'PackedCatalogItem' = '{25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33,32,...
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000008] 'PackedCatalogItem' = '{25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33,32,...
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000005] 'PackedCatalogItem' = '{25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33,32,...
[<HKLM>\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000006] 'PackedCatalogItem' = '{25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33,32,...

Создает следующие сервисы:

[<HKLM>\SYSTEM\ControlSet001\Services\WS2IFSL] 'ImagePath' = '<DRIVERS>\ws2ifsl.sys'
[<HKLM>\SYSTEM\ControlSet001\Services\WS2IFSL] 'Start' = '00000001'

Вредоносные функции:

Запускает на исполнение:

'%TEMP%\is-67S96.tmp\is-ELD3M.tmp' /SL4 $200F4 "<Текущая директория>\bbipbonus\ProxifierSetup.exe" 632776 52736 /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-
'%ProgramFiles%\Proxifier\NetConf.exe' i
'<Текущая директория>\bbipbonus\setup.exe'
'<Текущая директория>\bbipbonus\ProxifierSetup.exe' /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-

Изменения в файловой системе:

Создает следующие файлы:

<SYSTEM32>\is-0ISE4.tmp
<SYSTEM32>\is-82RKO.tmp
%ProgramFiles%\Proxifier\is-I806E.tmp
%ProgramFiles%\Proxifier\is-BB77E.tmp
%ProgramFiles%\Proxifier\is-VSPLI.tmp
<SYSTEM32>\is-2QPN8.tmp
%ALLUSERSPROFILE%\Start Menu\Programs\Proxifier\Uninstall Proxifier.lnk
%ProgramFiles%\Proxifier\unins000.dat
%ALLUSERSPROFILE%\Start Menu\Programs\Proxifier\Proxy Checker.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\Proxifier\Proxifier.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\Proxifier\Network Configurator.lnk
%ProgramFiles%\Proxifier\is-3VK8R.tmp
<Текущая директория>\bbipbonus\ProxifierSetup.exe
<Текущая директория>\bbipbonus\bbipbonus.prx
<Текущая директория>\bbipbonus\setup.exe
<Текущая директория>\bbipbonus\Proxifier.exe
<Текущая директория>\bbipbonus\TeamViewerQS.exe
%TEMP%\~DFD133.tmp
%ProgramFiles%\Proxifier\is-PVM6H.tmp
%ProgramFiles%\Proxifier\is-61JGC.tmp
%TEMP%\is-GV7K7.tmp\_isetup\_shfoldr.dll
%TEMP%\is-67S96.tmp\is-ELD3M.tmp
%TEMP%\is-GV7K7.tmp\_isetup\_RegDLL.tmp

Удаляет следующие файлы:

%TEMP%\is-67S96.tmp\is-ELD3M.tmp
%TEMP%\is-GV7K7.tmp\_isetup\_shfoldr.dll
%TEMP%\is-GV7K7.tmp\_isetup\_RegDLL.tmp

Перемещает следующие файлы:

<SYSTEM32>\is-0ISE4.tmp в <SYSTEM32>\PrxerDrv.dll
%ProgramFiles%\Proxifier\is-I806E.tmp в %ProgramFiles%\Proxifier\Proxifier.chm
<SYSTEM32>\is-2QPN8.tmp в <SYSTEM32>\SPORDER.DLL
<SYSTEM32>\is-82RKO.tmp в <SYSTEM32>\PrxerNsp.dll
%ProgramFiles%\Proxifier\is-VSPLI.tmp в %ProgramFiles%\Proxifier\ProxyChecker.exe
%ProgramFiles%\Proxifier\is-61JGC.tmp в %ProgramFiles%\Proxifier\Proxifier.exe
%ProgramFiles%\Proxifier\is-PVM6H.tmp в %ProgramFiles%\Proxifier\unins000.exe
%ProgramFiles%\Proxifier\is-BB77E.tmp в %ProgramFiles%\Proxifier\Launcher.exe
%ProgramFiles%\Proxifier\is-3VK8R.tmp в %ProgramFiles%\Proxifier\NetConf.exe

Другое:

Ищет следующие окна: