Trojan.MulDrop3.60966

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'MAAgent' = '%PROGRAM_FILES%\MarkAny\ContentSAFER\MAAgent.exe'
[<HKLM>\SOFTWARE\Classes\MarkAny ContentSAFER Client\Shell\Open\Command] '' = '"%PROGRAM_FILES%\MarkAny\ContentSAFER\MaCSMgr.exe" "%1"'
[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks] '{88485281-8b4b-4f8d-9ede-82e29a064277}' = 'MarkAny Contents Safer Manager 1.0'

Вредоносные функции:

Создает и запускает на исполнение:

%CommonProgramFiles%\InstallShield\Engine\6\Intel 32\IKernel.exe 32\IKernel.exe -Embedding
%CommonProgramFiles%\InstallShield\Engine\6\Intel 32\IKernel.exe /REGSERVER
%TEMP%\pft3~tmp\Disk1\Setup.exe -s
%CommonProgramFiles%\InstallShield\Engine\6\Intel 32\IKernel.exe -RegServer

Изменения в файловой системе:

Создает следующие файлы:

<SYSTEM32>\MACXbb9a.rra
%ALLUSERSPROFILE%\Desktop\MPXBOX.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\MarkAny\ContentSAFER Client\MPXBOX.lnk
<SYSTEM32>\MaXMbbb9.rra
<SYSTEM32>\MaJUbbf8.rra
<SYSTEM32>\MaJGbbe8.rra
<SYSTEM32>\MK_Lbbc9.rra
%PROGRAM_FILES%\InstallShield Installation Information\{68E0D9E4-1474-48C9-A191-A32CC6A40027}\Setup.ini
%PROGRAM_FILES%\InstallShield Installation Information\{68E0D9E4-1474-48C9-A191-A32CC6A40027}\databa62.rra
%PROGRAM_FILES%\InstallShield Installation Information\{68E0D9E4-1474-48C9-A191-A32CC6A40027}\layoba52.rra
%ALLUSERSPROFILE%\Start Menu\Programs\MarkAny\ContentSAFER Client\ContentSAFER Client »иБ¦.lnk
%PROGRAM_FILES%\InstallShield Installation Information\{68E0D9E4-1474-48C9-A191-A32CC6A40027}\databa71.rra
%PROGRAM_FILES%\InstallShield Installation Information\{68E0D9E4-1474-48C9-A191-A32CC6A40027}\setubacf.rra
%PROGRAM_FILES%\InstallShield Installation Information\{68E0D9E4-1474-48C9-A191-A32CC6A40027}\Setubabf.rra
%PROGRAM_FILES%\InstallShield Installation Information\{68E0D9E4-1474-48C9-A191-A32CC6A40027}\Setubaa0.rra
<SYSTEM32>\MASebe0b.rra
%PROGRAM_FILES%\MarkAny\ContentSAFER\mapsbdbd.rra
%PROGRAM_FILES%\MarkAny\ContentSAFER\MaCSbd8e.rra
%PROGRAM_FILES%\MarkAny\ContentSAFER\UpdateClient\MaUpbe59.rra
%PROGRAM_FILES%\MarkAny\ContentSAFER\MACSbf05.rra
%PROGRAM_FILES%\MarkAny\ContentSAFER\UpdateClient\MAUpbe98.rra
%PROGRAM_FILES%\MarkAny\ContentSAFER\UpdateClient\MAFibe78.rra
%PROGRAM_FILES%\MarkAny\ContentSAFER\MaCSbd7e.rra
%PROGRAM_FILES%\MarkAny\ContentSAFER\Userbcc3.rra
<SYSTEM32>\MaDRbc65.rra
<SYSTEM32>\MPXBbc17.rra
%PROGRAM_FILES%\MarkAny\ContentSAFER\MaAgbce2.rra
%PROGRAM_FILES%\MarkAny\ContentSAFER\mapwbd5f.rra
%PROGRAM_FILES%\MarkAny\ContentSAFER\MAWebd11.rra
%PROGRAM_FILES%\MarkAny\ContentSAFER\MAAubcf2.rra
%TEMP%\pft3~tmp\Disk1\setup.inx
%TEMP%\pft3~tmp\Disk1\Setup.ini
%TEMP%\pft3~tmp\Disk1\Setup.exe
%TEMP%\pft3~tmp\Disk1\setup.iss
%CommonProgramFiles%\InstallShield\Engine\6\Intel 32\temp.000
%TEMP%\IEC4.tmp
%TEMP%\pft3~tmp\Disk1\layout.bin
%TEMP%\pft3~tmp\pftw1.pkg
%TEMP%\plf1.tmp
%TEMP%\ext2.tmp
%TEMP%\pft3~tmp\Disk1\data1.cab
%TEMP%\pft3~tmp\Disk1\ikernel.ex_
%TEMP%\pft3~tmp\Disk1\data2.cab
%TEMP%\pft3~tmp\Disk1\data1.hdr
%TEMP%\{68e0d9e4-1474-48c9-a191-a32cc6a40027}\vssvafd2.rra
%TEMP%\{68e0d9e4-1474-48c9-a191-a32cc6a40027}\valuafb3.rra
%TEMP%\{68e0d9e4-1474-48c9-a191-a32cc6a40027}\vssvaf65.rra
%TEMP%\{68e0d9e4-1474-48c9-a191-a32cc6a40027}\isrtb011.rra
%TEMP%\pft3~tmp\Disk1\setup.log
%TEMP%\{68e0d9e4-1474-48c9-a191-a32cc6a40027}\_IsRb09e.rra
%TEMP%\{68e0d9e4-1474-48c9-a191-a32cc6a40027}\defab04f.rra
%TEMP%\{68e0d9e4-1474-48c9-a191-a32cc6a40027}\liceaf55.rra
%CommonProgramFiles%\InstallShield\Engine\6\Intel 32\objea776.rra
%CommonProgramFiles%\InstallShield\Engine\6\Intel 32\ctora62e.rra
%CommonProgramFiles%\InstallShield\Engine\6\Intel 32\corea5ef.rra
%CommonProgramFiles%\InstallShield\Engine\6\Intel 32\iusea7c4.rra
%TEMP%\{68e0d9e4-1474-48c9-a191-a32cc6a40027}\infoaf46.rra
%TEMP%\{68e0d9e4-1474-48c9-a191-a32cc6a40027}\setuaed8.rra
%CommonProgramFiles%\InstallShield\IScript\iscra96a.rra