Trojan.MulDrop11.20709

Добавлен в вирусную базу Dr.Web: 2019-10-11

Описание добавлено: 2019-10-13

Technical Information

Modifies file system

Creates the following files

<SYSTEM32>\gameloader1.exe
<SYSTEM32>\ГҐГ§ВјВµВ»ГіГГµГ№Г§Г¦Гё\ВіВѕГ«ГЇВёВµГ°Г¦ВЅГ—.ink
C:\dbghelp.dll

Sets the 'hidden' attribute to the following files

<SYSTEM32>\ГҐГ§ВјВµВ»ГіГГµГ№Г§Г¦Гё\ВіВѕГ«ГЇВёВµГ°Г¦ВЅГ—.lnk

Deletes the following files

C:\dbghelp.dll

Moves the following files

from <SYSTEM32>\ГҐГ§ВјВµВ»ГіГГµГ№Г§Г¦Гё\ВіВѕГ«ГЇВёВµГ°Г¦ВЅГ—.ink to <SYSTEM32>\ГҐГ§ВјВµВ»ГіГГµГ№Г§Г¦Гё\ВіВѕГ«ГЇВёВµГ°Г¦ВЅГ—.lnk
from <SYSTEM32>\gameloader1.exe to %TEMP%\1346986\...\temporaryfile

Substitutes the following files

C:\dbghelp.dll

Network activity

UDP

DNS ASK 67##nn.com

Miscellaneous

Searches for the following windows

ClassName: 'MS_AutodialMonitor' WindowName: ''
ClassName: 'MS_WebcheckMonitor' WindowName: ''

Creates and executes the following

'<SYSTEM32>\gameloader1.exe'
'<SYSTEM32>\cacls.exe' \TGuard\TerSafe.dll /e /p administrators:F' (with hidden window)
'<SYSTEM32>\cacls.exe' \TGuard\TerSafe.dll /e /p administrators Users:F' (with hidden window)
'<SYSTEM32>\cacls.exe' \TGuard\TerSafe.dll /e /p Administrator:F' (with hidden window)
'<SYSTEM32>\cacls.exe' \TGuard\TerSafe.dll /e /p Users:F' (with hidden window)
'<SYSTEM32>\cacls.exe' \TGuard\TerSafe.dll /e /p Everyone:F' (with hidden window)
'<SYSTEM32>\cacls.exe' \TCLS\TenProtect\TP\TPHelper\TenProtect\TerSafe.dll /e /p administrators Users:F' (with hidden window)
'<SYSTEM32>\cacls.exe' \TCLS\TenProtect\TP\TPHelper\TenProtect\TerSafe.dll /e /p SYSTEM:F' (with hidden window)
'<SYSTEM32>\cacls.exe' \TCLS\TenProtect\TP\TPHelper\TenProtect\TerSafe.dll /e /p administrators:F' (with hidden window)
'<SYSTEM32>\cacls.exe' \TCLS\TenProtect\TP\TPHelper\TenProtect\TerSafe.dll /e /p Administrator:F' (with hidden window)
'<SYSTEM32>\cacls.exe' \TCLS\TenProtect\TP\TPHelper\TenProtect\TerSafe.dll /e /p Users:F' (with hidden window)
'<SYSTEM32>\cacls.exe' \TCLS\TenProtect\TP\TPHelper\TenProtect\TerSafe.dll /e /p Everyone:F' (with hidden window)
'<SYSTEM32>\cacls.exe' \TCLS\TenProtect\TP\TPHelper\TerSafe.dll /e /p administrators Users:F' (with hidden window)
'<SYSTEM32>\cacls.exe' \TCLS\TenProtect\TP\TPHelper\TerSafe.dll /e /p SYSTEM:F' (with hidden window)
'<SYSTEM32>\cacls.exe' \TCLS\TenProtect\TP\TPHelper\TerSafe.dll /e /p administrators:F' (with hidden window)
'<SYSTEM32>\cacls.exe' \TCLS\TenProtect\TP\TPHelper\TerSafe.dll /e /p Users:F' (with hidden window)
'<SYSTEM32>\cacls.exe' \TerSafe.dll /e /p Everyone:F' (with hidden window)
'<SYSTEM32>\cacls.exe' \TCLS\TenProtect\TP\TPHelper\TerSafe.dll /e /p Everyone:F' (with hidden window)
'<SYSTEM32>\cacls.exe' \TerSafe.dll /e /p administrators:F' (with hidden window)
'<SYSTEM32>\cacls.exe' \TerSafe.dll /e /p Administrator:F' (with hidden window)
'<SYSTEM32>\cacls.exe' \crossfire.exe /e /p administrators Users:F' (with hidden window)
'<SYSTEM32>\cacls.exe' \crossfire.exe /e /p SYSTEM:F' (with hidden window)
'<SYSTEM32>\cacls.exe' \crossfire.exe /e /p Users:F' (with hidden window)
'<SYSTEM32>\cacls.exe' \crossfire.exe /e /p Administrator:F' (with hidden window)
'<SYSTEM32>\cacls.exe' \crossfire.exe /e /p administrators:F' (with hidden window)
'<SYSTEM32>\cacls.exe' \crossfire.exe /e /p Everyone:F' (with hidden window)
'<SYSTEM32>\cacls.exe' \awesomium_process.exe /e /p administrators Users:F' (with hidden window)
'<SYSTEM32>\cacls.exe' \awesomium_process.exe /e /p SYSTEM:F' (with hidden window)
'<SYSTEM32>\cacls.exe' \awesomium_process.exe /e /p administrators:F' (with hidden window)
'<SYSTEM32>\cacls.exe' \awesomium_process.exe /e /p Administrator:F' (with hidden window)
'<SYSTEM32>\cacls.exe' \awesomium_process.exe /e /p Users:F' (with hidden window)
'<SYSTEM32>\cacls.exe' \awesomium_process.exe /e /p Everyone:F' (with hidden window)
'<SYSTEM32>\cacls.exe' \TerSafe.dll /e /p administrators Users:F' (with hidden window)
'<SYSTEM32>\cacls.exe' \TerSafe.dll /e /p SYSTEM:F' (with hidden window)
'<SYSTEM32>\cacls.exe' \TerSafe.dll /e /p Users:F' (with hidden window)
'<SYSTEM32>\cacls.exe' \TGuard\TerSafe.dll /e /p SYSTEM:F' (with hidden window)
'<SYSTEM32>\cacls.exe' \TCLS\TenProtect\TP\TPHelper\TerSafe.dll /e /p Administrator:F' (with hidden window)

Executes the following

'<SYSTEM32>\cacls.exe' \crossfire.exe /e /p administrators Users:F
'<SYSTEM32>\cacls.exe' \TGuard\TerSafe.dll /e /p Administrator:F
'<SYSTEM32>\cacls.exe' \TGuard\TerSafe.dll /e /p Users:F
'<SYSTEM32>\cacls.exe' \TGuard\TerSafe.dll /e /p Everyone:F
'<SYSTEM32>\cacls.exe' \TCLS\TenProtect\TP\TPHelper\TenProtect\TerSafe.dll /e /p administrators Users:F
'<SYSTEM32>\cacls.exe' \TCLS\TenProtect\TP\TPHelper\TenProtect\TerSafe.dll /e /p SYSTEM:F
'<SYSTEM32>\cacls.exe' \TGuard\TerSafe.dll /e /p administrators:F
'<SYSTEM32>\cacls.exe' \TGuard\TerSafe.dll /e /p administrators Users:F
'<SYSTEM32>\cacls.exe' \TCLS\TenProtect\TP\TPHelper\TenProtect\TerSafe.dll /e /p administrators:F
'<SYSTEM32>\cacls.exe' \TCLS\TenProtect\TP\TPHelper\TenProtect\TerSafe.dll /e /p Everyone:F
'<SYSTEM32>\cacls.exe' \TCLS\TenProtect\TP\TPHelper\TerSafe.dll /e /p administrators Users:F
'<SYSTEM32>\cacls.exe' \TCLS\TenProtect\TP\TPHelper\TerSafe.dll /e /p SYSTEM:F
'<SYSTEM32>\cacls.exe' \TCLS\TenProtect\TP\TPHelper\TerSafe.dll /e /p administrators:F
'<SYSTEM32>\cacls.exe' \TCLS\TenProtect\TP\TPHelper\TerSafe.dll /e /p Users:F
'<SYSTEM32>\cacls.exe' \TCLS\TenProtect\TP\TPHelper\TenProtect\TerSafe.dll /e /p Administrator:F
'<SYSTEM32>\cacls.exe' \TCLS\TenProtect\TP\TPHelper\TenProtect\TerSafe.dll /e /p Users:F
'<SYSTEM32>\cacls.exe' \TerSafe.dll /e /p Everyone:F
'<SYSTEM32>\cacls.exe' \TerSafe.dll /e /p administrators:F
'<SYSTEM32>\cacls.exe' \TGuard\TerSafe.dll /e /p SYSTEM:F
'<SYSTEM32>\cacls.exe' \crossfire.exe /e /p Users:F
'<SYSTEM32>\cacls.exe' \crossfire.exe /e /p Administrator:F
'<SYSTEM32>\cacls.exe' \crossfire.exe /e /p administrators:F
'<SYSTEM32>\cacls.exe' \crossfire.exe /e /p Everyone:F
'<SYSTEM32>\cacls.exe' \awesomium_process.exe /e /p administrators Users:F
'<SYSTEM32>\cacls.exe' \awesomium_process.exe /e /p SYSTEM:F
'<SYSTEM32>\cacls.exe' \crossfire.exe /e /p SYSTEM:F
'<SYSTEM32>\cacls.exe' \awesomium_process.exe /e /p administrators:F
'<SYSTEM32>\cacls.exe' \awesomium_process.exe /e /p Users:F
'<SYSTEM32>\cacls.exe' \awesomium_process.exe /e /p Everyone:F
'<SYSTEM32>\cacls.exe' \TerSafe.dll /e /p administrators Users:F
'<SYSTEM32>\cacls.exe' \TerSafe.dll /e /p SYSTEM:F
'<SYSTEM32>\cacls.exe' \TerSafe.dll /e /p Users:F
'<SYSTEM32>\cacls.exe' \TerSafe.dll /e /p Administrator:F
'<SYSTEM32>\cacls.exe' \awesomium_process.exe /e /p Administrator:F
'<SYSTEM32>\cacls.exe' \TCLS\TenProtect\TP\TPHelper\TerSafe.dll /e /p Everyone:F
'<SYSTEM32>\cacls.exe' \TCLS\TenProtect\TP\TPHelper\TerSafe.dll /e /p Administrator:F

Технології

Терміни

Навчання

Міфи

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней