Trojan.MulDrop4.29781

Техническая информация

Вредоносные функции:

Создает и запускает на исполнение:

%TEMP%\RarSFX0\setup.exe /s /v"/qb"

Запускает на исполнение:

<SYSTEM32>\msiexec.exe /V
<SYSTEM32>\msiexec.exe /i "%TEMP%\{0F33EA9B-EFFA-4D85-BA6D-EB78AB210C26}\b6setup.msi" /qb SETUPEXEDIR="%TEMP%\RarSFX0" SETUPEXENAME="setup.exe"
<SYSTEM32>\cmd.exe /c ""%TEMP%\RarSFX0\auto.bat" "

Изменения в файловой системе:

Создает следующие файлы:

C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\OBJECTS.DATA
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING2.MAP
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING1.MAP
C:\Config.Msi\358b3.rbs
%PROGRAM_FILES%\Abadisoft Group\Broom 6.0\broom.exe
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\RestorePointSize
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\OBJECTS.MAP
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\$WinMgmt.CFG
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP15\drivetable.txt
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\INDEX.BTR
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING.VER
%WINDIR%\Installer\MSI6.tmp
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\INDEX.MAP
%ALLUSERSPROFILE%\Start Menu\Programs\Abadisoft Group\Broom 6.0 Setup\broom.lnk
%PROGRAM_FILES%\Abadisoft Group\Broom 6.0\shlib.dll
%PROGRAM_FILES%\Abadisoft Group\Broom 6.0\sheller.exe
%ALLUSERSPROFILE%\Desktop\broom.lnk
%WINDIR%\Installer\{6606E32D-288C-4FF6-9EC8-E7961954B028}\sheller.exe_1B26E449AAFD4CBCB8A36B6AA5247327.exe
%WINDIR%\Installer\{6606E32D-288C-4FF6-9EC8-E7961954B028}\sheller.exe1_389CBC0CD8794E79A17D093EEC69E347.exe
%WINDIR%\Installer\{6606E32D-288C-4FF6-9EC8-E7961954B028}\ARPPRODUCTICON.exe
%PROGRAM_FILES%\Abadisoft Group\Broom 6.0\db.xml
%PROGRAM_FILES%\Abadisoft Group\Broom 6.0\bscan.pdb
%PROGRAM_FILES%\Abadisoft Group\Broom 6.0\broom.pdb
%PROGRAM_FILES%\Abadisoft Group\Broom 6.0\init.ini
%PROGRAM_FILES%\Abadisoft Group\Broom 6.0\bscan.exe
%PROGRAM_FILES%\Abadisoft Group\Broom 6.0\sheller.pdb
%PROGRAM_FILES%\Abadisoft Group\Broom 6.0\shell.exe - Shortcut.lnk
%TEMP%\_is5.tmp
%TEMP%\~3.tmp
%TEMP%\_is4.tmp
%TEMP%\{0F33EA9B-EFFA-4D85-BA6D-EB78AB210C26}\b6setup.msi
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-18
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\rp.log
%WINDIR%\Installer\358b0.msi
%TEMP%\_is1.tmp
%TEMP%\RarSFX0\setup.exe
%TEMP%\RarSFX0\auto.bat
%TEMP%\{0F33EA9B-EFFA-4D85-BA6D-EB78AB210C26}\Setup.INI
%TEMP%\{0F33EA9B-EFFA-4D85-BA6D-EB78AB210C26}\0x0409.ini
%TEMP%\_is2.tmp
%TEMP%\{0F33EA9B-EFFA-4D85-BA6D-EB78AB210C26}\_ISMSIDEL.INI
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SYSTEM
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SOFTWARE
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SECURITY
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SAM
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\drivetable.txt
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\domain.txt
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\ComDb.Dat
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-20
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-19
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-19
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-20
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_.DEFAULT
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-21-2052111302-484763869-725345543-1003
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-21-2052111302-484763869-725345543-1003