Trojan.MulDrop3.24170

Техническая информация

Вредоносные функции:

Запускает на исполнение:

<SYSTEM32>\msiexec.exe -Embedding 53BAADDF3415D9719117059624767DFC
<SYSTEM32>\msiexec.exe -Embedding 57A4325A58CFC0C1C18CDFAA27B7D099 M Global\MSI0000
<SYSTEM32>\msiexec.exe /quiet /i "%ALLUSERSPROFILE%\Application Data\ReadOnlyInstaller.msi" LTVID={E57BA2BC-D091-404C-963C-D737D2F7618E}
<SYSTEM32>\msiexec.exe /V

Изменения в файловой системе:

Создает следующие файлы:

%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\wecarereminder@bryan\chrome\wecarereminder.jar
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\wecarereminder@bryan\components\WCVisitedHash.xpt
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\wecarereminder@bryan\ltvid.xml
%ALLUSERSPROFILE%\Application Data\WeCareReminder\aspca.bmp
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\wecarereminder@bryan\META-INF\zigbert.sf
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\wecarereminder@bryan\components\WCVisitedHash.js
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\wecarereminder@bryan\components\WCVisitedHash.idl
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\wecarereminder@bryan\components\WCR_MerchantHash.idl
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\wecarereminder@bryan\components\WCR_MerchantHash.js
%ALLUSERSPROFILE%\Application Data\WeCareReminder\MerchantHash.txt
%WINDIR%\Installer\MSIC.tmp
%WINDIR%\Installer\{1CCF681C-C203-49B3-83F4-A54F0F944416}\icon.ico
%ALLUSERSPROFILE%\Application Data\uninstaller.exe
%WINDIR%\Installer\MSID.tmp
%WINDIR%\Installer\MSIA.tmp
%ALLUSERSPROFILE%\Application Data\WeCareReminder\ReminderHelper.exe
%ALLUSERSPROFILE%\Application Data\WeCareReminder\IEHelperv2.5.0PS.dll
%WINDIR%\Installer\MSI9.tmp
%ALLUSERSPROFILE%\Application Data\WeCareReminder\WCAutoUpdate.exe
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\wecarereminder@bryan\components\WCR_MerchantHash.xpt
%WINDIR%\Installer\MSI5.tmp
%WINDIR%\Installer\MSI4.tmp
%WINDIR%\Installer\MSI7.tmp
%WINDIR%\Installer\MSI6.tmp
%ALLUSERSPROFILE%\Application Data\ReadOnlyInstaller.msi
%TEMP%\nso2.tmp\System.dll
%WINDIR%\Installer\MSI3.tmp
%WINDIR%\Installer\19c6a.msi
C:\Config.Msi\19c6d.rbs
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\wecarereminder@bryan\META-INF\zigbert.rsa
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\wecarereminder@bryan\components\httpModifyListener.js
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\wecarereminder@bryan\install.rdf
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\wecarereminder@bryan\META-INF\manifest.mf
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\wecarereminder@bryan\MerchHash.txt
%ALLUSERSPROFILE%\Application Data\WeCareReminder\IEHelperv2.5.0.dll
%ALLUSERSPROFILE%\Application Data\WeCareReminder\wecarereminderro.crx
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\wecarereminder@bryan\defaults\preferences\wecarereminder.js
%APPDATA%\Mozilla\Firefox\Profiles\cwdgt0y8.default\extensions\wecarereminder@bryan\chrome.manifest