Trojan.MulDrop24.43313

Technical Information

Modifies file system

Creates the following files

%TEMP%\_ir_sf_temp_0\irsetup.exe
%TEMP%\{6d0609b6-e849-7ebc-e41b-9c242ae47460}\x64\set1789.tmp
<SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\oem2.cat
%TEMP%\{13f0ca18-f5c3-1999-90a9-db0fdf91c74b}\setfbaf.tmp
%TEMP%\{13f0ca18-f5c3-1999-90a9-db0fdf91c74b}\setfac4.tmp
%TEMP%\{13f0ca18-f5c3-1999-90a9-db0fdf91c74b}\amd64\setf96c.tmp
%TEMP%\{13f0ca18-f5c3-1999-90a9-db0fdf91c74b}\amd64\setf862.tmp
%WINDIR%\dpinst.log
%TEMP%\_ir_sf_temp_0\sony\win10\x64\usb2ser.sys
%TEMP%\_ir_sf_temp_0\dpinst64.exe
%TEMP%\_ir_sf_temp_0\dpinst.exe
%TEMP%\_ir_sf_temp_0\ver3\win7\cdc-acm.inf
%TEMP%\_ir_sf_temp_0\ver3\win7\cdc-acm.cat
%TEMP%\_ir_sf_temp_0\ver3\win7\x86\usb2ser.sys
%TEMP%\_ir_sf_temp_0\ver3\win7\x64\usb2ser.sys
%TEMP%\_ir_sf_temp_0\ver3\win10\cdc-acm.inf
%TEMP%\_ir_sf_temp_0\ver3\win10\cdc-acm.cat
%TEMP%\_ir_sf_temp_0\ver3\win10\x86\usb2ser.sys
%TEMP%\_ir_sf_temp_0\ver3\win10\x64\usb2ser.sys
%TEMP%\_ir_sf_temp_0\ver2\win7\mdmcpq.inf
%TEMP%\_ir_sf_temp_0\ver2\win7\layout.cat
%TEMP%\_ir_sf_temp_0\ver2\win7\cdc-acm.inf
%TEMP%\{6d0609b6-e849-7ebc-e41b-9c242ae47460}\set193f.tmp
<SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\oem3.cat
%TEMP%\{32ddb274-cfb8-2c3d-737c-8e3f13a3153c}\setfe6d.tmp
%TEMP%\{27c52aaa-c663-411c-56b7-3d61b71c1c62}\set3901.tmp
<SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\oem9.cat
%TEMP%\{035146dc-4ba2-3ed5-0982-6b567babb829}\setdfb6.tmp
%TEMP%\{035146dc-4ba2-3ed5-0982-6b567babb829}\setdeda.tmp
%TEMP%\{035146dc-4ba2-3ed5-0982-6b567babb829}\x64\setdd82.tmp
<SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\oem8.cat
%TEMP%\{24847275-7cf4-42ac-905c-942b674fa47b}\setb4a2.tmp
%TEMP%\{24847275-7cf4-42ac-905c-942b674fa47b}\setb3e6.tmp
<SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\oem7.cat
%TEMP%\{7ba44f67-a434-1bff-c4db-3c17649e0212}\seta0d2.tmp
%TEMP%\{7ba44f67-a434-1bff-c4db-3c17649e0212}\set9ff7.tmp
<SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\oem6.cat
%TEMP%\{530fe437-6a74-4e72-b71c-1c6218740608}\set8c85.tmp
%TEMP%\{530fe437-6a74-4e72-b71c-1c6218740608}\set8bb9.tmp
%TEMP%\{530fe437-6a74-4e72-b71c-1c6218740608}\set8ade.tmp
<SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\oem5.cat
%TEMP%\{674d2e3a-9af0-6376-84f3-af6e7720606c}\set616d.tmp
%TEMP%\{674d2e3a-9af0-6376-84f3-af6e7720606c}\set60b1.tmp
%TEMP%\{674d2e3a-9af0-6376-84f3-af6e7720606c}\set6004.tmp
<SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\oem4.cat
%TEMP%\{27c52aaa-c663-411c-56b7-3d61b71c1c62}\set3a89.tmp
%TEMP%\{27c52aaa-c663-411c-56b7-3d61b71c1c62}\set39cd.tmp
%TEMP%\_ir_sf_temp_0\ver2\win7\cdc-acm.cat
%TEMP%\{6d0609b6-e849-7ebc-e41b-9c242ae47460}\set1a3a.tmp
%TEMP%\_ir_sf_temp_0\ver2\win7\x86\usb2ser.sys
%TEMP%\_ir_sf_temp_0\ver1\cdc-acm.inf
%TEMP%\_ir_sf_temp_0\ver1\android_winusb.inf
%TEMP%\_ir_sf_temp_0\ver1\androidwinusb.cat
%TEMP%\_ir_sf_temp_0\ver1\x86\usb2ser.sys
%TEMP%\_ir_sf_temp_0\ver1\x64\usb2ser.sys
%TEMP%\_ir_sf_temp_0\ver1\i386\wudfupdate_01009.dll
%TEMP%\_ir_sf_temp_0\ver1\i386\winusbcoinstaller2.dll
%TEMP%\_ir_sf_temp_0\ver1\i386\wdfcoinstaller01009.dll
%TEMP%\_ir_sf_temp_0\ver1\amd64\wudfupdate_01009.dll
%TEMP%\_ir_sf_temp_0\ver1\amd64\winusbcoinstaller2.dll
%TEMP%\_ir_sf_temp_0\ver1\amd64\wdfcoinstaller01009.dll
%TEMP%\_ir_sf_temp_0\sony\win7\cdc-acm.inf
%TEMP%\_ir_sf_temp_0\sony\win7\cdc-acm.cat
%TEMP%\_ir_sf_temp_0\sony\win7\x86\usb2ser.sys
%TEMP%\_ir_sf_temp_0\sony\win7\x64\usb2ser.sys
%TEMP%\_ir_sf_temp_0\sony\win10\cdc-acm.inf
%TEMP%\_ir_sf_temp_0\sony\win10\cdc-acm.cat
%TEMP%\_ir_sf_temp_0\sony\win10\x86\usb2ser.sys
%TEMP%\_ir_sf_temp_0\wow64.lmd
%TEMP%\_ir_sf_temp_0\chimera.ico
%TEMP%\_ir_sf_temp_0\irsetup.dat
%TEMP%\_ir_sf_temp_0\lua5.1.dll
%TEMP%\_ir_sf_temp_0\ver1\cdc-acm.cat
%TEMP%\_ir_sf_temp_0\ver1\mtkmbim7_x64.cat
%TEMP%\_ir_sf_temp_0\ver2\win7\i386\wudfupdate_01009.dll
%TEMP%\_ir_sf_temp_0\ver1\mtkmbim7_x64.inf
%TEMP%\_ir_sf_temp_0\ver2\win7\i386\winusbcoinstaller2.dll
%TEMP%\_ir_sf_temp_0\ver2\win7\i386\wdfcoinstaller01009.dll
%TEMP%\_ir_sf_temp_0\ver2\win7\amd64\wudfupdate_01009.dll
%TEMP%\_ir_sf_temp_0\ver2\win7\amd64\winusbcoinstaller2.dll
%TEMP%\_ir_sf_temp_0\ver2\win7\amd64\wdfcoinstaller01009.dll
%TEMP%\_ir_sf_temp_0\ver2\win10\cdc-acm.inf
%TEMP%\_ir_sf_temp_0\ver2\win10\cdc-acm.cat
%TEMP%\_ir_sf_temp_0\ver2\win10\x86\usb2ser.sys
%TEMP%\_ir_sf_temp_0\ver2\win10\x64\usb2ser.sys
%TEMP%\_ir_sf_temp_0\ver1\wpdmtp.inf
%TEMP%\_ir_sf_temp_0\ver1\wpdmtp.cat
%TEMP%\_ir_sf_temp_0\ver1\tetherxp.inf
%TEMP%\_ir_sf_temp_0\ver1\mtk_isd_xp64.cat
%TEMP%\_ir_sf_temp_0\ver1\mtk_isd_xp32.cat
%TEMP%\_ir_sf_temp_0\ver1\mtkmbimx_x64.sys
%TEMP%\_ir_sf_temp_0\ver1\mtkmbimx_x64.inf
%TEMP%\_ir_sf_temp_0\ver1\mtkmbimx_x64.cat
%TEMP%\_ir_sf_temp_0\ver1\mtkmbimv_x64.sys
%TEMP%\_ir_sf_temp_0\ver1\mtkmbimv_x64.inf
%TEMP%\_ir_sf_temp_0\ver1\mtkmbimv_x64.cat
%TEMP%\_ir_sf_temp_0\ver1\mtkmbim7_x64.sys
%TEMP%\_ir_sf_temp_0\ver2\win7\x64\usb2ser.sys
%TEMP%\{32ddb274-cfb8-2c3d-737c-8e3f13a3153c}\setff39.tmp

Sets the 'hidden' attribute to the following files

<SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\oem2.cat
<SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\oem3.cat
<SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\oem4.cat
<SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\oem5.cat
<SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\oem6.cat
<SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\oem7.cat
<SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\oem8.cat
<SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\oem9.cat

Deletes the following files

%TEMP%\_ir_sf_temp_0\irsetup.dat
%TEMP%\_ir_sf_temp_0\sony\win7\cdc-acm.cat
%TEMP%\_ir_sf_temp_0\sony\win7\cdc-acm.inf
%TEMP%\_ir_sf_temp_0\sony\win7\x64\usb2ser.sys
%TEMP%\_ir_sf_temp_0\sony\win7\x86\usb2ser.sys
%TEMP%\_ir_sf_temp_0\ver1\cdc-acm.cat
%TEMP%\_ir_sf_temp_0\ver1\cdc-acm.inf
%TEMP%\_ir_sf_temp_0\ver1\tetherxp.inf
%TEMP%\_ir_sf_temp_0\ver1\wpdmtp.cat
%TEMP%\_ir_sf_temp_0\ver1\wpdmtp.inf
%TEMP%\_ir_sf_temp_0\ver1\x64\usb2ser.sys
%TEMP%\_ir_sf_temp_0\ver1\x86\usb2ser.sys
%TEMP%\_ir_sf_temp_0\ver2\win10\cdc-acm.cat
%TEMP%\_ir_sf_temp_0\ver2\win10\cdc-acm.inf
%TEMP%\_ir_sf_temp_0\ver2\win10\x64\usb2ser.sys
%TEMP%\_ir_sf_temp_0\ver2\win10\x86\usb2ser.sys
%TEMP%\_ir_sf_temp_0\ver2\win7\cdc-acm.cat
%TEMP%\_ir_sf_temp_0\ver2\win7\cdc-acm.inf
%TEMP%\_ir_sf_temp_0\ver2\win7\layout.cat
%TEMP%\_ir_sf_temp_0\ver2\win7\mdmcpq.inf
%TEMP%\_ir_sf_temp_0\ver2\win7\x64\usb2ser.sys
%TEMP%\_ir_sf_temp_0\ver2\win7\x86\usb2ser.sys
%TEMP%\_ir_sf_temp_0\ver3\win10\cdc-acm.cat
%TEMP%\_ir_sf_temp_0\ver3\win10\cdc-acm.inf
%TEMP%\_ir_sf_temp_0\ver3\win10\x64\usb2ser.sys
%TEMP%\_ir_sf_temp_0\ver3\win10\x86\usb2ser.sys
%TEMP%\_ir_sf_temp_0\ver3\win7\cdc-acm.cat
%TEMP%\_ir_sf_temp_0\ver3\win7\cdc-acm.inf
%TEMP%\_ir_sf_temp_0\ver3\win7\x64\usb2ser.sys
%TEMP%\_ir_sf_temp_0\ver3\win7\x86\usb2ser.sys
%TEMP%\_ir_sf_temp_0\sony\win10\x86\usb2ser.sys
%TEMP%\_ir_sf_temp_0\wow64.lmd
%TEMP%\_ir_sf_temp_0\sony\win10\x64\usb2ser.sys
%TEMP%\_ir_sf_temp_0\sony\win10\cdc-acm.cat
%TEMP%\{13f0ca18-f5c3-1999-90a9-db0fdf91c74b}\amd64\wdfcoinstaller01009.dll
%TEMP%\{13f0ca18-f5c3-1999-90a9-db0fdf91c74b}\amd64\winusbcoinstaller2.dll
%TEMP%\{13f0ca18-f5c3-1999-90a9-db0fdf91c74b}\androidwinusb.cat
%TEMP%\{13f0ca18-f5c3-1999-90a9-db0fdf91c74b}\android_winusb.inf
%TEMP%\{6d0609b6-e849-7ebc-e41b-9c242ae47460}\cdc-acm.cat
%TEMP%\{6d0609b6-e849-7ebc-e41b-9c242ae47460}\cdc-acm.inf
%TEMP%\{6d0609b6-e849-7ebc-e41b-9c242ae47460}\x64\usb2ser.sys
%TEMP%\{27c52aaa-c663-411c-56b7-3d61b71c1c62}\mtkmbim7_x64.cat
%TEMP%\{27c52aaa-c663-411c-56b7-3d61b71c1c62}\mtkmbim7_x64.inf
%TEMP%\{27c52aaa-c663-411c-56b7-3d61b71c1c62}\mtkmbim7_x64.sys
%TEMP%\{674d2e3a-9af0-6376-84f3-af6e7720606c}\mtkmbimv_x64.cat
%TEMP%\{674d2e3a-9af0-6376-84f3-af6e7720606c}\mtkmbimv_x64.inf
%TEMP%\{674d2e3a-9af0-6376-84f3-af6e7720606c}\mtkmbimv_x64.sys
%TEMP%\{530fe437-6a74-4e72-b71c-1c6218740608}\mtkmbimx_x64.cat
%TEMP%\{530fe437-6a74-4e72-b71c-1c6218740608}\mtkmbimx_x64.inf
%TEMP%\{530fe437-6a74-4e72-b71c-1c6218740608}\mtkmbimx_x64.sys
%TEMP%\{7ba44f67-a434-1bff-c4db-3c17649e0212}\mtk_isd_xp64.cat
%TEMP%\{7ba44f67-a434-1bff-c4db-3c17649e0212}\tetherxp.inf
%TEMP%\{24847275-7cf4-42ac-905c-942b674fa47b}\wpdmtp.cat
%TEMP%\{24847275-7cf4-42ac-905c-942b674fa47b}\wpdmtp.inf
%TEMP%\{035146dc-4ba2-3ed5-0982-6b567babb829}\cdc-acm.cat
%TEMP%\{035146dc-4ba2-3ed5-0982-6b567babb829}\cdc-acm.inf
%TEMP%\{035146dc-4ba2-3ed5-0982-6b567babb829}\x64\usb2ser.sys
%TEMP%\{32ddb274-cfb8-2c3d-737c-8e3f13a3153c}\layout.cat
%TEMP%\{32ddb274-cfb8-2c3d-737c-8e3f13a3153c}\mdmcpq.inf
%TEMP%\_ir_sf_temp_0\chimera.ico
%TEMP%\_ir_sf_temp_0\dpinst.exe
%TEMP%\_ir_sf_temp_0\dpinst64.exe
%TEMP%\_ir_sf_temp_0\irsetup.exe
%TEMP%\_ir_sf_temp_0\sony\win10\cdc-acm.inf
%TEMP%\_ir_sf_temp_0\lua5.1.dll

Moves the following files

from %TEMP%\{13f0ca18-f5c3-1999-90a9-db0fdf91c74b}\amd64\setf862.tmp to %TEMP%\{13f0ca18-f5c3-1999-90a9-db0fdf91c74b}\amd64\wdfcoinstaller01009.dll
from %TEMP%\{035146dc-4ba2-3ed5-0982-6b567babb829}\setdfb6.tmp to %TEMP%\{035146dc-4ba2-3ed5-0982-6b567babb829}\cdc-acm.inf
from %TEMP%\{035146dc-4ba2-3ed5-0982-6b567babb829}\setdeda.tmp to %TEMP%\{035146dc-4ba2-3ed5-0982-6b567babb829}\cdc-acm.cat
from %TEMP%\{035146dc-4ba2-3ed5-0982-6b567babb829}\x64\setdd82.tmp to %TEMP%\{035146dc-4ba2-3ed5-0982-6b567babb829}\x64\usb2ser.sys
from %TEMP%\{24847275-7cf4-42ac-905c-942b674fa47b}\setb4a2.tmp to %TEMP%\{24847275-7cf4-42ac-905c-942b674fa47b}\wpdmtp.inf
from %TEMP%\{24847275-7cf4-42ac-905c-942b674fa47b}\setb3e6.tmp to %TEMP%\{24847275-7cf4-42ac-905c-942b674fa47b}\wpdmtp.cat
from %TEMP%\{7ba44f67-a434-1bff-c4db-3c17649e0212}\seta0d2.tmp to %TEMP%\{7ba44f67-a434-1bff-c4db-3c17649e0212}\tetherxp.inf
from %TEMP%\{7ba44f67-a434-1bff-c4db-3c17649e0212}\set9ff7.tmp to %TEMP%\{7ba44f67-a434-1bff-c4db-3c17649e0212}\mtk_isd_xp64.cat
from %TEMP%\{530fe437-6a74-4e72-b71c-1c6218740608}\set8c85.tmp to %TEMP%\{530fe437-6a74-4e72-b71c-1c6218740608}\mtkmbimx_x64.sys
from %TEMP%\{530fe437-6a74-4e72-b71c-1c6218740608}\set8bb9.tmp to %TEMP%\{530fe437-6a74-4e72-b71c-1c6218740608}\mtkmbimx_x64.inf
from %TEMP%\{530fe437-6a74-4e72-b71c-1c6218740608}\set8ade.tmp to %TEMP%\{530fe437-6a74-4e72-b71c-1c6218740608}\mtkmbimx_x64.cat
from %TEMP%\{32ddb274-cfb8-2c3d-737c-8e3f13a3153c}\setfe6d.tmp to %TEMP%\{32ddb274-cfb8-2c3d-737c-8e3f13a3153c}\layout.cat
from %TEMP%\{674d2e3a-9af0-6376-84f3-af6e7720606c}\set616d.tmp to %TEMP%\{674d2e3a-9af0-6376-84f3-af6e7720606c}\mtkmbimv_x64.sys
from %TEMP%\{674d2e3a-9af0-6376-84f3-af6e7720606c}\set6004.tmp to %TEMP%\{674d2e3a-9af0-6376-84f3-af6e7720606c}\mtkmbimv_x64.cat
from %TEMP%\{27c52aaa-c663-411c-56b7-3d61b71c1c62}\set3a89.tmp to %TEMP%\{27c52aaa-c663-411c-56b7-3d61b71c1c62}\mtkmbim7_x64.sys
from %TEMP%\{27c52aaa-c663-411c-56b7-3d61b71c1c62}\set39cd.tmp to %TEMP%\{27c52aaa-c663-411c-56b7-3d61b71c1c62}\mtkmbim7_x64.inf
from %TEMP%\{27c52aaa-c663-411c-56b7-3d61b71c1c62}\set3901.tmp to %TEMP%\{27c52aaa-c663-411c-56b7-3d61b71c1c62}\mtkmbim7_x64.cat
from %TEMP%\{6d0609b6-e849-7ebc-e41b-9c242ae47460}\set1a3a.tmp to %TEMP%\{6d0609b6-e849-7ebc-e41b-9c242ae47460}\cdc-acm.inf
from %TEMP%\{6d0609b6-e849-7ebc-e41b-9c242ae47460}\set193f.tmp to %TEMP%\{6d0609b6-e849-7ebc-e41b-9c242ae47460}\cdc-acm.cat
from %TEMP%\{6d0609b6-e849-7ebc-e41b-9c242ae47460}\x64\set1789.tmp to %TEMP%\{6d0609b6-e849-7ebc-e41b-9c242ae47460}\x64\usb2ser.sys
from %TEMP%\{13f0ca18-f5c3-1999-90a9-db0fdf91c74b}\setfbaf.tmp to %TEMP%\{13f0ca18-f5c3-1999-90a9-db0fdf91c74b}\android_winusb.inf
from %TEMP%\{13f0ca18-f5c3-1999-90a9-db0fdf91c74b}\setfac4.tmp to %TEMP%\{13f0ca18-f5c3-1999-90a9-db0fdf91c74b}\androidwinusb.cat
from %TEMP%\{13f0ca18-f5c3-1999-90a9-db0fdf91c74b}\amd64\setf96c.tmp to %TEMP%\{13f0ca18-f5c3-1999-90a9-db0fdf91c74b}\amd64\winusbcoinstaller2.dll
from %TEMP%\{674d2e3a-9af0-6376-84f3-af6e7720606c}\set60b1.tmp to %TEMP%\{674d2e3a-9af0-6376-84f3-af6e7720606c}\mtkmbimv_x64.inf
from %TEMP%\{32ddb274-cfb8-2c3d-737c-8e3f13a3153c}\setff39.tmp to %TEMP%\{32ddb274-cfb8-2c3d-737c-8e3f13a3153c}\mdmcpq.inf

Miscellaneous

Creates and executes the following

'%TEMP%\_ir_sf_temp_0\irsetup.exe' __IRAOFF:1817634 "__IRAFN:<Full path to file>" "__IRCT:3" "__IRTSS:0" "__IRSID:S-1-5-21-1238866942-1249195528-555854008-1000"
'%TEMP%\_ir_sf_temp_0\dpinst64.exe' /PATH "%TEMP%\_ir_sf_temp_0\VER1" /SW /F /SA /SE /LM
'%TEMP%\_ir_sf_temp_0\dpinst64.exe' /PATH "%TEMP%\_ir_sf_temp_0\VER2\WIN7" /SW /SA /SE /LM
'%TEMP%\_ir_sf_temp_0\dpinst64.exe' /PATH "%TEMP%\_ir_sf_temp_0\VER3\WIN7" /SW /SA /SE /LM
'%TEMP%\_ir_sf_temp_0\dpinst64.exe' /PATH "%TEMP%\_ir_sf_temp_0\SONY\WIN7" /SW /SA /SE /LM
'%TEMP%\_ir_sf_temp_0\dpinst64.exe' /PATH "%TEMP%\_ir_sf_temp_0\VER1" /SW /F /SA /SE /LM' (with hidden window)
'%TEMP%\_ir_sf_temp_0\dpinst64.exe' /PATH "%TEMP%\_ir_sf_temp_0\VER2\WIN7" /SW /SA /SE /LM' (with hidden window)
'%TEMP%\_ir_sf_temp_0\dpinst64.exe' /PATH "%TEMP%\_ir_sf_temp_0\VER3\WIN7" /SW /SA /SE /LM' (with hidden window)
'%TEMP%\_ir_sf_temp_0\dpinst64.exe' /PATH "%TEMP%\_ir_sf_temp_0\SONY\WIN7" /SW /SA /SE /LM' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /D /A /C RMDIR %TEMP%\_ir_sf_temp_0 /S /Q' (with hidden window)

Executes the following

'%WINDIR%\syswow64\cmd.exe' /D /A /C RMDIR %TEMP%\_ir_sf_temp_0 /S /Q

Технологии

Термины

Обучение и просвещение

Мифы

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней