Trojan.MulDrop8.16045

Technical Information

Malicious functions:

Searches for windows to

detect analytical utilities:

ClassName: 'OLLYDBG', WindowName: ''
ClassName: 'pediy06', WindowName: ''
ClassName: 'TIdaWindow', WindowName: ''
ClassName: 'APIMonitor By Rohitab', WindowName: ''
ClassName: 'FileMonClass', WindowName: 'File Monitor - Sysinternals: www.sysinternals.com'
ClassName: 'PROCEXPL', WindowName: 'Process Explorer - SysInternals: www.sysinternals.com [CRNJEUFU\%USERNAME%]'
ClassName: 'PROCEXPL', WindowName: ''
ClassName: 'PROCMON_WINDOW_CLASS', WindowName: 'Process Monitor - Sysinternals: www.sysinternals.com'

Modifies file system:

Creates the following files:

%TEMP%\CmdLineExtInstallerExe.exe
<SYSTEM32>\CmdLineExt.dll
%TEMP%\drm_dyndata_7330014.dll
%APPDATA%\SecuROM\UserData\readme.txt
%APPDATA%\SecuROM\UserData\securom_v7_01.tmp
%APPDATA%\SecuROM\UserData\securom_v7_01.dat
%APPDATA%\SecuROM\UserData\securom_v7_01.bak
%APPDATA%\SecuROM\UserData\ЃϵϳЅЂϿϽϯІχϯπρϴϱЄϱЃϵϳЅ
%APPDATA%\SecuROM\UserData\ЃϵϳЅЂϿϽϯІχϯπρЂϻϵЉЃϵϳЅ
%TEMP%\drm_dialogs.dll

Sets the 'hidden' attribute to the following files:

%APPDATA%\SecuROM\UserData\securom_v7_01.bak
%APPDATA%\SecuROM\UserData\ЃϵϳЅЂϿϽϯІχϯπρϴϱЄϱЃϵϳЅ
%APPDATA%\SecuROM\UserData\ЃϵϳЅЂϿϽϯІχϯπρЂϻϵЉЃϵϳЅ

Deletes the following files:

%TEMP%\CmdLineExtInstallerExe.exe
<SYSTEM32>\d3d9caps.dat

Substitutes the following files:

<SYSTEM32>\d3d9caps.dat

Miscellaneous:

Searches for the following windows:

ClassName: '18467-41' WindowName: ''
ClassName: 'ReBarWindow32' WindowName: ''
ClassName: 'ToolbarWindow32 ' WindowName: ''
ClassName: '#32770' WindowName: 'Atiptool'
ClassName: '#32770' WindowName: 'Task Explorer II - by Ntoskrnl'
ClassName: 'TApplication' WindowName: '<File name>'
ClassName: 'ThunderRT6FormDC' WindowName: 'Pr0t.St0p v1.0'
ClassName: 'ThunderRT6Main' WindowName: 'Pr0t.St0p v1.0'
ClassName: 'ThunderRT6FormDC' WindowName: 'Settings'
ClassName: 'File Monitor - Sysinternals: www.sysinternals.com' WindowName: 'FileMonClass'
ClassName: '' WindowName: 'APIMonitor By Rohitab'
ClassName: 'ToolbarWindow32?' WindowName: ''
ClassName: '[ LordPE Deluxe b ] by yoda' WindowName: '#32770'
ClassName: 'ThunderRT6Main' WindowName: 'SysAnalyzer'
ClassName: 'TrayNotifyWnd' WindowName: ''
ClassName: 'JCDSPY_NT_001' WindowName: 'DriverspyNT v1.20. (c)2001,2002 Collake Software'
ClassName: 'cuteProgressClass' WindowName: ''
ClassName: 'c3' WindowName: 'API Functions'
ClassName: 'c1' WindowName: 'KaKeeware Application Monitor 1.21'
ClassName: 'PEBrowse Professional Interactive' WindowName: 'TMainForm'
ClassName: 'TMainForm' WindowName: 'PEBrowse Professional Interactive'
ClassName: 'SysAnalyzer Configuration Wizard' WindowName: 'ThunderRT6Main'
ClassName: 'ThunderRT6Main' WindowName: 'SysAnalyzer Configuration Wizard'
ClassName: 'sniff_hit' WindowName: 'ThunderRT6Main'
ClassName: 'ThunderRT6Main' WindowName: 'sniff_hit'
ClassName: 'Process Analyzer - right click on a process to access menu' WindowName: 'ThunderRT6Main'
ClassName: 'ThunderRT6Main' WindowName: 'Process Analyzer - right click on a process to access menu'
ClassName: 'ApiLogger' WindowName: 'ThunderRT6Main'
ClassName: 'ThunderRT6Main' WindowName: 'ApiLogger'
ClassName: 'ThunderRT6Main' WindowName: 'SD4 Sucks v0.10 by Joseph Cox'
ClassName: 'SafeDisc4 Hider 1.1 ? 2005 SKULL' WindowName: 'Tsd4hideform'
ClassName: 'Tsd4hideform' WindowName: 'SafeDisc4 Hider 1.1 ? 2005 SKULL'
ClassName: 'Virtual-CD-Hide' WindowName: 'Virtual-CD-Hide'
ClassName: '[ LordPE Deluxe ] by yoda' WindowName: ''
ClassName: '' WindowName: '[ LordPE Deluxe ] by yoda'
ClassName: 'ThunderRT6FormDC' WindowName: 'SR7.Stop v1.1'
ClassName: 'ThunderRT6Main' WindowName: 'SR7.Stop v1.1'
ClassName: 'ThunderRT6Main' WindowName: 'SR7.Stop v1.2'
ClassName: 'ThunderRT6Main' WindowName: 'SR7Stop'
ClassName: '#32770' WindowName: 'Starforce Nightmare'
ClassName: '[ LordPE Dumper Server ]' WindowName: ''
ClassName: 'ThunderRT6Main' WindowName: 'Anti-Blaxx'
ClassName: 'WispWindowClass' WindowName: 'Syser [Ctrl+F12]'
ClassName: 'kk1' WindowName: ''
ClassName: 'icu_dbg' WindowName: ''
ClassName: 'Lbr68' WindowName: ''
ClassName: 'SHADOW' WindowName: ''
ClassName: 'SysPager' WindowName: ''
ClassName: 'SysAnalyzer' WindowName: 'ThunderRT6Main'
ClassName: '#32770' WindowName: '[ LordPE Deluxe b ] by yoda'
ClassName: '[ LordPE RoyalTS ] by yoda' WindowName: '#32770'
ClassName: '' WindowName: '[ LordPE Dumper Server ]'
ClassName: 'SafeDisc4 Hider 1.0 ? 2005 SKULL' WindowName: 'TForm1'
ClassName: 'TForm1' WindowName: 'SafeDisc4 Hider 1.0 ? 2005 SKULL'
ClassName: 'SafeDisc4 Hider' WindowName: 'TApplication'
ClassName: 'TApplication' WindowName: 'SafeDisc4 Hider'
ClassName: 'BusTrace Status' WindowName: '#32770'
ClassName: '#32770' WindowName: 'BusTrace Status'
ClassName: 'Fucker of CDROM Protections v0.83 Beta' WindowName: 'TForm1'
ClassName: 'TForm1' WindowName: 'Fucker of CDROM Protections v0.83 Beta'
ClassName: 'Fucker of CDROM Protections v0.81 Beta' WindowName: 'TForm1'
ClassName: 'TForm1' WindowName: 'Fucker of CDROM Protections v0.81 Beta'
ClassName: 'STARFUCK TOOL' WindowName: '#32770'
ClassName: '#32770' WindowName: 'STARFUCK TOOL'
ClassName: '#32770' WindowName: '[ LordPE RoyalTS ] by yoda'
ClassName: 'ToolbarWindow32' WindowName: ''

Creates and executes the following:

'%TEMP%\CmdLineExtInstallerExe.exe'

テクノロジー

用語

トレーニングコースおよび啓蒙プロジェクト

アンチウイルスに関する誤解と噂

Technical Information

Curing recommendations

Free trial