Trojan.MulDrop2.43525

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Kaseya Agent Service Helper' = '"%PROGRAM_FILES%\Kaseya\Agent\KaUsrTsk.exe"'

Создает следующие сервисы:

[<HKLM>\SYSTEM\ControlSet001\Services\KaseyaAgent] 'Start' = '00000002'
[<HKLM>\SYSTEM\ControlSet001\Services\KaseyaAgent] 'ImagePath' = '"%PROGRAM_FILES%\Kaseya\Agent\AgentMon.exe"'

Вредоносные функции:

Создает и запускает на исполнение:

%PROGRAM_FILES%\Kaseya\Agent\AgentMon.exe
%PROGRAM_FILES%\Kaseya\Agent\KaUsrTsk.exe
%CommonProgramFiles%\InstallShield\Engine\6\Intel 32\IKernel.exe /REGSERVER -Embedding -RegServer

Изменения в файловой системе:

Создает следующие файлы:

%PROGRAM_FILES%\InstallShield Installation Information\{48C76121-4F90-11D5-9884-0050BA85A903}\Setup.ini
%PROGRAM_FILES%\InstallShield Installation Information\{48C76121-4F90-11D5-9884-0050BA85A903}\setu6a39.rra
%PROGRAM_FILES%\InstallShield Installation Information\{48C76121-4F90-11D5-9884-0050BA85A903}\Setu6a1a.rra
%ALLUSERSPROFILE%\Start Menu\Programs\Kaseya\Kaseya Agent.lnk
%PROGRAM_FILES%\Kaseya\Agent\Agen6da4.rra
%PROGRAM_FILES%\Kaseya\Agent\KaUs6d66.rra
%PROGRAM_FILES%\Kaseya\Agent\KPrt6d46.rra
%TEMP%\pft3.tmp\setup.log
%TEMP%\{48c76121-4f90-11d5-9884-0050ba85a903}\_IsR6085.rra
%TEMP%\{48c76121-4f90-11d5-9884-0050ba85a903}\defa6037.rra
%PROGRAM_FILES%\InstallShield Installation Information\{48C76121-4F90-11D5-9884-0050BA85A903}\layo696e.rra
%PROGRAM_FILES%\InstallShield Installation Information\{48C76121-4F90-11D5-9884-0050BA85A903}\Setu69fb.rra
%PROGRAM_FILES%\InstallShield Installation Information\{48C76121-4F90-11D5-9884-0050BA85A903}\data69ad.rra
%PROGRAM_FILES%\InstallShield Installation Information\{48C76121-4F90-11D5-9884-0050BA85A903}\data698d.rra
<DRIVERS>\KaPF70d1.rra
%PROGRAM_FILES%\Kaseya\Agent\Kase7034.rra
%PROGRAM_FILES%\Kaseya\Agent\Kase7015.rra
<DRIVERS>\Kase70e0.rra
%PROGRAM_FILES%\Kaseya\Agent\KaseyaD.ini
<DRIVERS>\kase711f.rra
<DRIVERS>\kapf7100.rra
%PROGRAM_FILES%\Kaseya\Agent\Psap6e7f.rra
%PROGRAM_FILES%\Kaseya\Agent\spor6e60.rra
%PROGRAM_FILES%\Kaseya\Agent\kGet6e12.rra
%PROGRAM_FILES%\Kaseya\Agent\KEve6e9e.rra
<SYSTEM32>\kase6f69.rra
%PROGRAM_FILES%\Kaseya\Agent\KAge6eec.rra
%PROGRAM_FILES%\Kaseya\Agent\LogP6ecd.rra
%TEMP%\pft3.tmp\Setup.exe
%TEMP%\pft3.tmp\Setup.bmp
%TEMP%\pft3.tmp\data1.hdr
%TEMP%\pft3.tmp\setup.iss
%TEMP%\pft3.tmp\Setup.ini
%TEMP%\pft3.tmp\layout.bin
%TEMP%\pft3.tmp\data2.cab
%TEMP%\KaseyaD.ini
%TEMP%\KAgentSilent.exe
%TEMP%\KASetup.log
%TEMP%\ext2.tmp
%TEMP%\pft3.tmp\data1.cab
%TEMP%\pft3.tmp\pftw1.pkg
%TEMP%\plf1.tmp
%TEMP%\{48c76121-4f90-11d5-9884-0050ba85a903}\setu5eb0.rra
%CommonProgramFiles%\InstallShield\IScript\iscr4fbc.rra
%CommonProgramFiles%\InstallShield\Engine\6\Intel 32\iuse4c8f.rra
%TEMP%\{48c76121-4f90-11d5-9884-0050ba85a903}\KSet5f0e.rra
%TEMP%\{48c76121-4f90-11d5-9884-0050ba85a903}\isrt5fe9.rra
%TEMP%\{48c76121-4f90-11d5-9884-0050ba85a903}\valu5f9a.rra
%TEMP%\{48c76121-4f90-11d5-9884-0050ba85a903}\Psap5f3d.rra
%TEMP%\IEC4.tmp
%TEMP%\pft3.tmp\ikernel.ex_
%TEMP%\pft3.tmp\setup.inx
%CommonProgramFiles%\InstallShield\Engine\6\Intel 32\temp.000
%CommonProgramFiles%\InstallShield\Engine\6\Intel 32\obje4c03.rra
%CommonProgramFiles%\InstallShield\Engine\6\Intel 32\ctor47bd.rra
%CommonProgramFiles%\InstallShield\Engine\6\Intel 32\core4711.rra