Trojan.MulDrop8.22340

Technical Information

To ensure autorun and distribution:

Creates the following services:

[<HKLM>\SYSTEM\ControlSet001\Services\ASInsHelp] 'Start' = '00000002'
[<HKLM>\SYSTEM\ControlSet001\Services\ASInsHelp] 'ImagePath' = '<DRIVERS>\AsInsHelp32.sys'

Modifies file system:

Creates the following files:

%TEMP%\7zS06B149E1\2.03.03_A1.md5
%TEMP%\7zS06B149E1\Drv\Io\AsIO64.sys
%TEMP%\7zS06B149E1\Drv\Io\AsIO32.sys
%TEMP%\7zS06B149E1\Drv\Io\AsIO.dll
%TEMP%\7zS06B149E1\Drv\AXSP\axIns.exe
%TEMP%\7zS06B149E1\Drv\AXSP\atkexComSvc.exe
%TEMP%\7zS06B149E1\Drv\AXSP\ATKEX.dll
%TEMP%\7zS06B149E1\Drv\AsInstallDrv.exe
%TEMP%\7zS06B149E1\Drv\AsInsHelp64.sys
%TEMP%\7zS06B149E1\Drv\AsInsHelp32.sys
%TEMP%\7zS06B149E1\Drv\AsInsHelp.dll
%TEMP%\7zS06B149E1\Drv\asacpiex.dll
%TEMP%\7zS06B149E1\Drv\AsAcpi.dll
%TEMP%\7zS06B149E1\Drv\Acpi64\WINVISTA\Asacpi.sys
%TEMP%\7zS06B149E1\Drv\Io\AsIoUnins.exe
%TEMP%\7zS06B149E1\Drv\Io\AsIoIns.exe
%TEMP%\7zS06B149E1\Drv\Acpi64\AsAcpiIns.exe
%TEMP%\7zS06B149E1\Drv\Acpi\WINVISTA\AsAcpi.sys
%TEMP%\7zS06B149E1\Drv\Acpi\Win7\Asacpi.sys
%TEMP%\7zS06B149E1\Drv\Acpi\WIN2000\asacpi.sys
%TEMP%\7zS06B149E1\Drv\Acpi\AsAcpiIns.exe
%TEMP%\7zS06B149E1\AXSP\axIns.exe
%TEMP%\7zS06B149E1\AXSP\atkexComSvc.exe
%TEMP%\7zS06B149E1\AXSP\ATKEX.dll
%TEMP%\7zS06B149E1\AsusSetup.exe
%TEMP%\7zS06B149E1\AsSysCtrlSrvcHelp.dll
%TEMP%\7zS06B149E1\AsSysCtrlService\AsSysCtrlSrvcIns.exe
%TEMP%\7zS06B149E1\AsSysCtrlService\AsSysCtrlSrvcHelp.dll
%TEMP%\7zS06B149E1\AsSysCtrlService\AsSysCtrlService.exe
%TEMP%\7zS06B149E1\Drv\Acpi64\WIN7\Asacpi.sys
%TEMP%\7zS06B149E1\Drv\Acpi64\WIN7\asacpi.cat
%TEMP%\7zS06B149E1\Drv\MFC42.DLL
<DRIVERS>\MFDLL\MFC42D.DLL
<DRIVERS>\MFDLL\MFC42.DLL
<DRIVERS>\AsInsHelp64.sys
<DRIVERS>\AsInsHelp32.sys
%TEMP%\{ABB5B6B0-68E6-4F87-8F1D-A9A2A3A77355}\_IsR6363.rra
%TEMP%\{ABB5B6B0-68E6-4F87-8F1D-A9A2A3A77355}\defa6315.rra
%TEMP%\{ABB5B6B0-68E6-4F87-8F1D-A9A2A3A77355}\isrt62c7.rra
%TEMP%\{ABB5B6B0-68E6-4F87-8F1D-A9A2A3A77355}\valu625a.rra
%TEMP%\{ABB5B6B0-68E6-4F87-8F1D-A9A2A3A77355}\Upda61bd.rra
%TEMP%\{ABB5B6B0-68E6-4F87-8F1D-A9A2A3A77355}\asac6121.rra
%TEMP%\{ABB5B6B0-68E6-4F87-8F1D-A9A2A3A77355}\AsAc60f2.rra
%TEMP%\{ABB5B6B0-68E6-4F87-8F1D-A9A2A3A77355}\ACPI60b4.rra
%TEMP%\{ABB5B6B0-68E6-4F87-8F1D-A9A2A3A77355}\setu6037.rra
%CommonProgramFiles%\InstallShield\IScript\iscr5951.rra
%CommonProgramFiles%\InstallShield\Engine\6\Intel 32\iuse575d.rra
%CommonProgramFiles%\InstallShield\Engine\6\Intel 32\obje56f0.rra
%CommonProgramFiles%\InstallShield\Engine\6\Intel 32\ctor5559.rra
%CommonProgramFiles%\InstallShield\Engine\6\Intel 32\core54fc.rra
%TEMP%\50e5.rra
%CommonProgramFiles%\InstallShield\Engine\6\Intel 32\temp.000
%TEMP%\IEC1.tmp
%TEMP%\7zS06B149E1\Setup.exe
%TEMP%\7zS06B149E1\Io\AsIoUnins.exe
%TEMP%\7zS06B149E1\Io\AsIoIns.exe
%TEMP%\7zS06B149E1\Io\AsIO64.sys
%TEMP%\7zS06B149E1\Io\AsIO32.sys
%TEMP%\7zS06B149E1\Io\AsIO.dll
%TEMP%\7zS06B149E1\Drv\MSVCRTD.DLL
%TEMP%\7zS06B149E1\Drv\msvcrt.dll
%TEMP%\7zS06B149E1\AsSysCtrlService\asacpiex.dll
%TEMP%\7zS06B149E1\Drv\Acpi64\win2000\Asacpi.sys
%TEMP%\7zS06B149E1\AsSysCtrlService\AsAcpi.dll
%TEMP%\7zS06B149E1\AsFlashInstall.dll
%TEMP%\7zS06B149E1\Acpi64\WINVISTA\Asacpi.sys
%TEMP%\7zS06B149E1\AsSysCtrlService\AsSysCtrlSrvcIns.exe.manifest
%TEMP%\7zS06B149E1\Drv\Acpi\WINVISTA\AsAcpi.inf
%TEMP%\7zS06B149E1\Drv\Acpi\WINVISTA\asacpi.cat
%TEMP%\7zS06B149E1\Drv\Acpi\Win7\AsAcpi.inf
%TEMP%\7zS06B149E1\Drv\Acpi\Win7\asacpi.cat
%TEMP%\7zS06B149E1\Drv\Acpi\WIN2000\ATK2000.INF
%TEMP%\7zS06B149E1\Drv\Acpi\WIN2000\ATK2000.CAT
%TEMP%\7zS06B149E1\Drv\Acpi\install.ini
%TEMP%\7zS06B149E1\data2.cab
%TEMP%\7zS06B149E1\data1.hdr
%TEMP%\7zS06B149E1\data1.cab
%TEMP%\7zS06B149E1\AXSP\axIns.ini
%TEMP%\7zS06B149E1\AsusSetup.ini
%TEMP%\7zS06B149E1\AsSysCtrlService\config.ini
%TEMP%\7zS06B149E1\Acpi64\WINVISTA\AsAcpi.inf
%TEMP%\7zS06B149E1\Drv\Acpi64\win2000\asacpi.cat
%TEMP%\7zS06B149E1\Acpi64\WINVISTA\asacpi.cat
%TEMP%\7zS06B149E1\Acpi64\WIN7\AsAcpi.inf
%TEMP%\7zS06B149E1\Acpi64\WIN7\asacpi.cat
%TEMP%\7zS06B149E1\Acpi64\win2000\AsAcpi.inf
%TEMP%\7zS06B149E1\Acpi64\win2000\asacpi.cat
%TEMP%\7zS06B149E1\Acpi64\install.ini
%TEMP%\7zS06B149E1\Acpi\WINVISTA\AsAcpi.inf
%TEMP%\7zS06B149E1\Acpi\WINVISTA\asacpi.cat
%TEMP%\7zS06B149E1\Acpi\Win7\AsAcpi.inf
%TEMP%\7zS06B149E1\Acpi\Win7\asacpi.cat
%TEMP%\7zS06B149E1\Acpi\WIN2000\ATK2000.INF
%TEMP%\7zS06B149E1\Acpi\WIN2000\ATK2000.CAT
%TEMP%\7zS06B149E1\Acpi\install.ini
<DRIVERS>\MFDLL\msvcrt.dll
%TEMP%\7zS06B149E1\Drv\MFC42D.DLL
%TEMP%\7zS06B149E1\Drv\Acpi64\win2000\AsAcpi.inf
%TEMP%\7zS06B149E1\Drv\Acpi64\WINVISTA\asacpi.cat
%TEMP%\7zS06B149E1\Drv\Acpi64\install.ini
%TEMP%\7zS06B149E1\Acpi64\WIN7\Asacpi.sys
%TEMP%\7zS06B149E1\Acpi64\win2000\Asacpi.sys
%TEMP%\7zS06B149E1\Acpi64\AsAcpiIns.exe
%TEMP%\7zS06B149E1\Acpi\WINVISTA\AsAcpi.sys
%TEMP%\7zS06B149E1\Acpi\Win7\Asacpi.sys
%TEMP%\7zS06B149E1\Acpi\WIN2000\asacpi.sys
%TEMP%\7zS06B149E1\Acpi\AsAcpiIns.exe
%TEMP%\7zS06B149E1\usetup.iss
%TEMP%\7zS06B149E1\TChinese.ini
%TEMP%\7zS06B149E1\Spanish.ini
%TEMP%\7zS06B149E1\setup.iss
%TEMP%\7zS06B149E1\setup.inx
%TEMP%\7zS06B149E1\Setup.ini
%TEMP%\7zS06B149E1\Setup.exe.manifest
%TEMP%\7zS06B149E1\SChinese.ini
%TEMP%\7zS06B149E1\Russian.ini
%TEMP%\7zS06B149E1\layout.bin
%TEMP%\7zS06B149E1\Japanese.ini
%TEMP%\7zS06B149E1\Io\Version.ini
%TEMP%\7zS06B149E1\Io\AsIO.VXD
%TEMP%\7zS06B149E1\ikernel.ex_
%TEMP%\7zS06B149E1\German.ini
%TEMP%\7zS06B149E1\French.ini
%TEMP%\7zS06B149E1\English.ini
%TEMP%\7zS06B149E1\Drv\Io\Version.ini
%TEMP%\7zS06B149E1\Drv\Io\AsIO.VXD
%TEMP%\7zS06B149E1\Drv\AXSP\axIns.ini
%TEMP%\7zS06B149E1\Drv\Acpi64\WINVISTA\AsAcpi.inf
%TEMP%\7zS06B149E1\Drv\Acpi64\WIN7\AsAcpi.inf
<DRIVERS>\MFDLL\MSVCRTD.DLL

Deletes the following files:

%TEMP%\IEC1.tmp
%TEMP%\7zS06B149E1\Drv\Io\AsIO.VXD
%TEMP%\7zS06B149E1\Drv\Io\AsIO.dll
%TEMP%\7zS06B149E1\Drv\AXSP\axIns.ini
%TEMP%\7zS06B149E1\Drv\AXSP\axIns.exe
%TEMP%\7zS06B149E1\Drv\AXSP\atkexComSvc.exe
%TEMP%\7zS06B149E1\Drv\AXSP\ATKEX.dll
%TEMP%\7zS06B149E1\Drv\AsInstallDrv.exe
%TEMP%\7zS06B149E1\Drv\AsInsHelp64.sys
%TEMP%\7zS06B149E1\Drv\AsInsHelp32.sys
%TEMP%\7zS06B149E1\Drv\AsInsHelp.dll
%TEMP%\7zS06B149E1\Drv\asacpiex.dll
%TEMP%\7zS06B149E1\Drv\AsAcpi.dll
%TEMP%\7zS06B149E1\Drv\Acpi64\WINVISTA\AsAcpi.inf
%TEMP%\7zS06B149E1\Drv\Io\AsIO64.sys
%TEMP%\7zS06B149E1\Drv\Acpi64\WINVISTA\asacpi.cat
%TEMP%\7zS06B149E1\Drv\Acpi64\WIN7\Asacpi.sys
%TEMP%\7zS06B149E1\Drv\Acpi64\WIN7\AsAcpi.inf
%TEMP%\7zS06B149E1\Drv\Acpi64\WIN7\asacpi.cat
%TEMP%\7zS06B149E1\Drv\Acpi64\win2000\Asacpi.sys
%TEMP%\7zS06B149E1\Drv\Acpi64\win2000\AsAcpi.inf
%TEMP%\7zS06B149E1\Drv\Acpi64\win2000\asacpi.cat
%TEMP%\7zS06B149E1\Drv\Acpi64\install.ini
%TEMP%\7zS06B149E1\Drv\Acpi64\AsAcpiIns.exe
%TEMP%\7zS06B149E1\Drv\Acpi\WINVISTA\AsAcpi.sys
%TEMP%\7zS06B149E1\Drv\Acpi\WINVISTA\AsAcpi.inf
%TEMP%\7zS06B149E1\Drv\Acpi64\WINVISTA\Asacpi.sys
%TEMP%\7zS06B149E1\AsusSetup.exe
%TEMP%\7zS06B149E1\Drv\Io\AsIoIns.exe
%TEMP%\7zS06B149E1\Spanish.ini
%TEMP%\7zS06B149E1\setup.iss
%TEMP%\7zS06B149E1\setup.inx
%TEMP%\7zS06B149E1\Setup.ini
%TEMP%\7zS06B149E1\Setup.exe.manifest
%TEMP%\7zS06B149E1\Setup.exe
%TEMP%\7zS06B149E1\SChinese.ini
%TEMP%\7zS06B149E1\Russian.ini
%TEMP%\7zS06B149E1\layout.bin
%TEMP%\7zS06B149E1\Japanese.ini
%TEMP%\7zS06B149E1\Io\Version.ini
%TEMP%\7zS06B149E1\Io\AsIoUnins.exe
%TEMP%\7zS06B149E1\Drv\Acpi\WINVISTA\asacpi.cat
%TEMP%\7zS06B149E1\Drv\Io\AsIO32.sys
%TEMP%\7zS06B149E1\Io\AsIO32.sys
%TEMP%\7zS06B149E1\Io\AsIO.VXD
%TEMP%\7zS06B149E1\Io\AsIO.dll
%TEMP%\7zS06B149E1\ikernel.ex_
%TEMP%\7zS06B149E1\German.ini
%TEMP%\7zS06B149E1\French.ini
%TEMP%\7zS06B149E1\English.ini
%TEMP%\7zS06B149E1\Drv\MSVCRTD.DLL
%TEMP%\7zS06B149E1\Drv\msvcrt.dll
%TEMP%\7zS06B149E1\Drv\MFC42D.DLL
%TEMP%\7zS06B149E1\Drv\MFC42.DLL
%TEMP%\7zS06B149E1\Drv\Io\Version.ini
%TEMP%\7zS06B149E1\Io\AsIO64.sys
%TEMP%\7zS06B149E1\Drv\Io\AsIoUnins.exe
%TEMP%\7zS06B149E1\Drv\Acpi\Win7\Asacpi.sys
%TEMP%\7zS06B149E1\Drv\Acpi\Win7\AsAcpi.inf
%TEMP%\7zS06B149E1\Drv\Acpi\Win7\asacpi.cat
%TEMP%\7zS06B149E1\Acpi\install.ini
%TEMP%\7zS06B149E1\Acpi64\win2000\asacpi.cat
%TEMP%\7zS06B149E1\Acpi64\install.ini
%TEMP%\7zS06B149E1\Acpi64\AsAcpiIns.exe
%TEMP%\7zS06B149E1\Acpi\WINVISTA\AsAcpi.sys
%TEMP%\7zS06B149E1\Acpi\WINVISTA\AsAcpi.inf
%TEMP%\7zS06B149E1\Acpi\WINVISTA\asacpi.cat
%TEMP%\7zS06B149E1\Acpi\Win7\Asacpi.sys
%TEMP%\7zS06B149E1\Acpi\Win7\AsAcpi.inf
%TEMP%\7zS06B149E1\Acpi\Win7\asacpi.cat
%TEMP%\7zS06B149E1\Acpi\WIN2000\ATK2000.INF
%TEMP%\7zS06B149E1\Acpi\WIN2000\ATK2000.CAT
%TEMP%\7zS06B149E1\TChinese.ini
%TEMP%\7zS06B149E1\Acpi64\win2000\Asacpi.sys
%TEMP%\7zS06B149E1\Acpi\AsAcpiIns.exe
%TEMP%\7zS06B149E1\2.03.03_A1.md5
%TEMP%\50e5.rra
%TEMP%\{ABB5B6B0-68E6-4F87-8F1D-A9A2A3A77355}\setup.inx
%TEMP%\{ABB5B6B0-68E6-4F87-8F1D-A9A2A3A77355}\ACPIWMI.dll
%TEMP%\{ABB5B6B0-68E6-4F87-8F1D-A9A2A3A77355}\AsAcpi.dll
%TEMP%\{ABB5B6B0-68E6-4F87-8F1D-A9A2A3A77355}\asacpiex.dll
%TEMP%\{ABB5B6B0-68E6-4F87-8F1D-A9A2A3A77355}\UpdateHelper.dll
%TEMP%\{ABB5B6B0-68E6-4F87-8F1D-A9A2A3A77355}\value.shl
%TEMP%\{ABB5B6B0-68E6-4F87-8F1D-A9A2A3A77355}\isrt.dll
%TEMP%\{ABB5B6B0-68E6-4F87-8F1D-A9A2A3A77355}\default.pal
%TEMP%\{ABB5B6B0-68E6-4F87-8F1D-A9A2A3A77355}\_IsRes.dll
%TEMP%\7zS06B149E1\Acpi\WIN2000\asacpi.sys
%TEMP%\7zS06B149E1\Io\AsIoIns.exe
%TEMP%\7zS06B149E1\Acpi64\WIN7\asacpi.cat
%TEMP%\7zS06B149E1\Acpi64\WINVISTA\asacpi.cat
%TEMP%\7zS06B149E1\Acpi64\WIN7\AsAcpi.inf
%TEMP%\7zS06B149E1\Drv\Acpi\WIN2000\ATK2000.INF
%TEMP%\7zS06B149E1\Drv\Acpi\WIN2000\ATK2000.CAT
%TEMP%\7zS06B149E1\Drv\Acpi\WIN2000\asacpi.sys
%TEMP%\7zS06B149E1\Drv\Acpi\install.ini
%TEMP%\7zS06B149E1\Drv\Acpi\AsAcpiIns.exe
%TEMP%\7zS06B149E1\data2.cab
%TEMP%\7zS06B149E1\data1.hdr
%TEMP%\7zS06B149E1\data1.cab
%TEMP%\7zS06B149E1\AXSP\axIns.ini
%TEMP%\7zS06B149E1\AXSP\axIns.exe
%TEMP%\7zS06B149E1\AXSP\atkexComSvc.exe
%TEMP%\7zS06B149E1\Acpi64\WIN7\Asacpi.sys
%TEMP%\7zS06B149E1\AXSP\ATKEX.dll
%TEMP%\7zS06B149E1\Acpi64\win2000\AsAcpi.inf
%TEMP%\7zS06B149E1\AsSysCtrlSrvcHelp.dll
%TEMP%\7zS06B149E1\AsSysCtrlService\config.ini
%TEMP%\7zS06B149E1\AsSysCtrlService\AsSysCtrlSrvcIns.exe.manifest
%TEMP%\7zS06B149E1\AsSysCtrlService\AsSysCtrlSrvcIns.exe
%TEMP%\7zS06B149E1\AsSysCtrlService\AsSysCtrlSrvcHelp.dll
%TEMP%\7zS06B149E1\AsSysCtrlService\AsSysCtrlService.exe
%TEMP%\7zS06B149E1\AsSysCtrlService\asacpiex.dll
%TEMP%\7zS06B149E1\AsSysCtrlService\AsAcpi.dll
%TEMP%\7zS06B149E1\AsFlashInstall.dll
%TEMP%\7zS06B149E1\Acpi64\WINVISTA\Asacpi.sys
%TEMP%\7zS06B149E1\Acpi64\WINVISTA\AsAcpi.inf
%TEMP%\7zS06B149E1\AsusSetup.ini
%TEMP%\7zS06B149E1\usetup.iss

Moves the following files:

from %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\temp.000 to %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\IKernel.exe
from %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\core54fc.rra to %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\corecomp.ini
from %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\ctor5559.rra to %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\ctor.dll
from %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\obje56f0.rra to %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\objectps.dll
from %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\iuse575d.rra to %CommonProgramFiles%\InstallShield\Engine\6\Intel 32\iuser.dll
from %CommonProgramFiles%\InstallShield\IScript\iscr5951.rra to %CommonProgramFiles%\InstallShield\IScript\iscript.dll
from %TEMP%\{ABB5B6B0-68E6-4F87-8F1D-A9A2A3A77355}\setu6037.rra to %TEMP%\{ABB5B6B0-68E6-4F87-8F1D-A9A2A3A77355}\setup.inx
from %TEMP%\{ABB5B6B0-68E6-4F87-8F1D-A9A2A3A77355}\ACPI60b4.rra to %TEMP%\{ABB5B6B0-68E6-4F87-8F1D-A9A2A3A77355}\ACPIWMI.dll
from %TEMP%\{ABB5B6B0-68E6-4F87-8F1D-A9A2A3A77355}\AsAc60f2.rra to %TEMP%\{ABB5B6B0-68E6-4F87-8F1D-A9A2A3A77355}\AsAcpi.dll
from %TEMP%\{ABB5B6B0-68E6-4F87-8F1D-A9A2A3A77355}\asac6121.rra to %TEMP%\{ABB5B6B0-68E6-4F87-8F1D-A9A2A3A77355}\asacpiex.dll
from %TEMP%\{ABB5B6B0-68E6-4F87-8F1D-A9A2A3A77355}\Upda61bd.rra to %TEMP%\{ABB5B6B0-68E6-4F87-8F1D-A9A2A3A77355}\UpdateHelper.dll
from %TEMP%\{ABB5B6B0-68E6-4F87-8F1D-A9A2A3A77355}\valu625a.rra to %TEMP%\{ABB5B6B0-68E6-4F87-8F1D-A9A2A3A77355}\value.shl
from %TEMP%\{ABB5B6B0-68E6-4F87-8F1D-A9A2A3A77355}\isrt62c7.rra to %TEMP%\{ABB5B6B0-68E6-4F87-8F1D-A9A2A3A77355}\isrt.dll
from %TEMP%\{ABB5B6B0-68E6-4F87-8F1D-A9A2A3A77355}\defa6315.rra to %TEMP%\{ABB5B6B0-68E6-4F87-8F1D-A9A2A3A77355}\default.pal
from %TEMP%\{ABB5B6B0-68E6-4F87-8F1D-A9A2A3A77355}\_IsR6363.rra to %TEMP%\{ABB5B6B0-68E6-4F87-8F1D-A9A2A3A77355}\_IsRes.dll

Miscellaneous:

Creates and executes the following:

'%TEMP%\7zS06B149E1\Setup.exe'
'%CommonProgramFiles%\InstallShield\Engine\6\Intel 32\IKernel.exe' -RegServer
'%CommonProgramFiles%\InstallShield\Engine\6\Intel 32\IKernel.exe' 32\IKernel.exe -Embedding
'%CommonProgramFiles%\InstallShield\Engine\6\Intel 32\IKernel.exe' /REGSERVER
'%TEMP%\7zS06B149E1\Drv\AsInstallDrv.exe'

Технологии

Термины

Обучение и просвещение

Мифы

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней