Trojan.MulDrop5.38435

Technical Information

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKLM>\SOFTWARE\Classes\TrueBoxShot\shell\open\command] '' = '"%PROGRAM_FILES%\True BoxShot\TrueBoxShot2.exe" "%1"'

Malicious functions:

Creates and executes the following:

'%TEMP%\is-N6TN5.tmp\TrueBoxShot2Setup.tmp' /SL5="$10110,3650285,79360,%TEMP%\RarSFX0\TrueBoxShot2Setup.exe" /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-
'%TEMP%\RarSFX0\TrueBoxShot2Setup.exe' /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-
'%TEMP%\RarSFX0\BySam.231.exe'

Executes the following:

'%WINDIR%\regedit.exe' /S kk.reg
'%WINDIR%\regedit.exe' /S k.reg

Modifies file system :

Creates the following files:

%PROGRAM_FILES%\True BoxShot\True BoxShot\Scenes\is-S5K0D.tmp
%PROGRAM_FILES%\True BoxShot\True BoxShot\Scenes\is-1I3G8.tmp
%PROGRAM_FILES%\True BoxShot\True BoxShot\Scenes\is-VEG48.tmp
%PROGRAM_FILES%\True BoxShot\True BoxShot\Scenes\is-PASMD.tmp
%PROGRAM_FILES%\True BoxShot\True BoxShot\Scenes\is-A79SM.tmp
%PROGRAM_FILES%\True BoxShot\True BoxShot\Scenes\is-H84BM.tmp
%PROGRAM_FILES%\True BoxShot\True BoxShot\Scenes\is-J4UUO.tmp
%PROGRAM_FILES%\True BoxShot\True BoxShot\Scenes\is-QHMPN.tmp
%PROGRAM_FILES%\True BoxShot\True BoxShot\Scenes\is-P6BTG.tmp
%PROGRAM_FILES%\True BoxShot\True BoxShot\Scenes\is-K4QK2.tmp
%PROGRAM_FILES%\True BoxShot\True BoxShot\Scenes\is-5AGNQ.tmp
%PROGRAM_FILES%\True BoxShot\True BoxShot\Scenes\is-P89PV.tmp
%PROGRAM_FILES%\True BoxShot\True BoxShot\Scenes\is-TB6N8.tmp
%PROGRAM_FILES%\True BoxShot\True BoxShot\Scenes\is-4P28K.tmp
%PROGRAM_FILES%\True BoxShot\True BoxShot\Scenes\is-4ACAH.tmp
%PROGRAM_FILES%\True BoxShot\True BoxShot\Scenes\is-I822Q.tmp
%ALLUSERSPROFILE%\Start Menu\Programs\True BoxShot\True BoxShot License.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\True BoxShot\Uninstall True BoxShot 2.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\True BoxShot\True BoxShot 2.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\True BoxShot\True BoxShot 2 Manual.lnk
%HOMEPATH%\Desktop\منتديات داماس.URL
%HOMEPATH%\Desktop\True BoxShot 2.lnk
%PROGRAM_FILES%\True BoxShot\unins000.dat
%PROGRAM_FILES%\True BoxShot\is-45VPN.tmp
%PROGRAM_FILES%\True BoxShot\True BoxShot\Scenes\is-QK7JR.tmp
%PROGRAM_FILES%\True BoxShot\True BoxShot\Scenes\is-CVPFN.tmp
%PROGRAM_FILES%\True BoxShot\True BoxShot\Scenes\is-JTHNO.tmp
%PROGRAM_FILES%\True BoxShot\is-7SR5L.tmp
%PROGRAM_FILES%\True BoxShot\is-64JHL.tmp
%PROGRAM_FILES%\True BoxShot\True BoxShot\is-JNC53.tmp
%PROGRAM_FILES%\True BoxShot\is-LP5H1.tmp
%PROGRAM_FILES%\True BoxShot\True BoxShot\Scenes\is-KT6OE.tmp
%PROGRAM_FILES%\True BoxShot\Models\Book\is-D5EC7.tmp
%PROGRAM_FILES%\True BoxShot\Models\Book\is-0HVND.tmp
%PROGRAM_FILES%\True BoxShot\True BoxShot\is-J0MGT.tmp
%PROGRAM_FILES%\True BoxShot\Models\Book\is-HK2PG.tmp
%PROGRAM_FILES%\True BoxShot\Models\BoxShot\is-2KFOC.tmp
%PROGRAM_FILES%\True BoxShot\Models\BoxShot\is-FTD98.tmp
%PROGRAM_FILES%\True BoxShot\Models\BoxShot\is-7D8M8.tmp
%PROGRAM_FILES%\True BoxShot\is-2MO7E.tmp
%TEMP%\RarSFX0\k.reg
%TEMP%\RarSFX0\TrueBoxShot2Setup.exe
%TEMP%\RarSFX0\BySam.231.exe
%TEMP%\RarSFX0\kk.reg
%TEMP%\is-EFC56.tmp\_isetup\_shfoldr.dll
%TEMP%\is-EFC56.tmp\_isetup\_RegDLL.tmp
%TEMP%\is-N6TN5.tmp\TrueBoxShot2Setup.tmp
%PROGRAM_FILES%\True BoxShot\Models\CDCase\is-8VTL9.tmp
%PROGRAM_FILES%\True BoxShot\Models\ScreenShots\is-9LET6.tmp
%PROGRAM_FILES%\True BoxShot\Models\Other\is-VS556.tmp
%PROGRAM_FILES%\True BoxShot\Models\MemberCard\is-KI1KE.tmp
%PROGRAM_FILES%\True BoxShot\Models\SoftBookSpring\is-H20AB.tmp
%PROGRAM_FILES%\True BoxShot\True BoxShot\Scenes\is-GUOJD.tmp
%PROGRAM_FILES%\True BoxShot\True BoxShot\Scenes\is-7HF5R.tmp
%PROGRAM_FILES%\True BoxShot\Models\VistaBox\is-G42MC.tmp
%PROGRAM_FILES%\True BoxShot\Models\iPod\is-HOKOU.tmp
%PROGRAM_FILES%\True BoxShot\Models\DVDBox\is-4GEHD.tmp
%PROGRAM_FILES%\True BoxShot\Models\DVDBox\is-TLJDL.tmp
%PROGRAM_FILES%\True BoxShot\Models\CompactDisks\is-RAIS5.tmp
%PROGRAM_FILES%\True BoxShot\Models\DVDBox\is-MTO1H.tmp
%PROGRAM_FILES%\True BoxShot\Models\iPhone\is-HE033.tmp
%PROGRAM_FILES%\True BoxShot\Models\iPhone\is-M4UDC.tmp
%PROGRAM_FILES%\True BoxShot\Models\iPhone\is-N8P49.tmp

Deletes the following files:

%TEMP%\RarSFX0\k.reg
%TEMP%\RarSFX0\kk.reg
%TEMP%\RarSFX0\TrueBoxShot2Setup.exe
%TEMP%\RarSFX0\BySam.231.exe
%TEMP%\is-EFC56.tmp\_isetup\_RegDLL.tmp
%TEMP%\is-EFC56.tmp\_isetup\_shfoldr.dll
%TEMP%\is-N6TN5.tmp\TrueBoxShot2Setup.tmp

Moves the following files:

from %PROGRAM_FILES%\True BoxShot\True BoxShot\Scenes\is-VEG48.tmp to %PROGRAM_FILES%\True BoxShot\True BoxShot\Scenes\DVDCases & CD.sbs
from %PROGRAM_FILES%\True BoxShot\True BoxShot\Scenes\is-QHMPN.tmp to %PROGRAM_FILES%\True BoxShot\True BoxShot\Scenes\DVDBox.sbs
from %PROGRAM_FILES%\True BoxShot\True BoxShot\Scenes\is-TB6N8.tmp to %PROGRAM_FILES%\True BoxShot\True BoxShot\Scenes\DVDBox & CD.sbs
from %PROGRAM_FILES%\True BoxShot\True BoxShot\Scenes\is-PASMD.tmp to %PROGRAM_FILES%\True BoxShot\True BoxShot\Scenes\Many books.sbs
from %PROGRAM_FILES%\True BoxShot\True BoxShot\Scenes\is-S5K0D.tmp to %PROGRAM_FILES%\True BoxShot\True BoxShot\Scenes\Home Collection.sbs
from %PROGRAM_FILES%\True BoxShot\True BoxShot\Scenes\is-1I3G8.tmp to %PROGRAM_FILES%\True BoxShot\True BoxShot\Scenes\Fashion style.sbs
from %PROGRAM_FILES%\True BoxShot\True BoxShot\Scenes\is-P6BTG.tmp to %PROGRAM_FILES%\True BoxShot\True BoxShot\Scenes\Boxes.sbs
from %PROGRAM_FILES%\True BoxShot\True BoxShot\Scenes\is-K4QK2.tmp to %PROGRAM_FILES%\True BoxShot\True BoxShot\Scenes\Box & CD.sbs
from %PROGRAM_FILES%\True BoxShot\True BoxShot\Scenes\is-5AGNQ.tmp to %PROGRAM_FILES%\True BoxShot\True BoxShot\Scenes\Books.sbs
from %PROGRAM_FILES%\True BoxShot\True BoxShot\Scenes\is-4P28K.tmp to %PROGRAM_FILES%\True BoxShot\True BoxShot\Scenes\DVD Cases.sbs
from %PROGRAM_FILES%\True BoxShot\True BoxShot\Scenes\is-4ACAH.tmp to %PROGRAM_FILES%\True BoxShot\True BoxShot\Scenes\Dual Vista.sbs
from %PROGRAM_FILES%\True BoxShot\True BoxShot\Scenes\is-P89PV.tmp to %PROGRAM_FILES%\True BoxShot\True BoxShot\Scenes\CD.sbs
from %PROGRAM_FILES%\True BoxShot\is-LP5H1.tmp to %PROGRAM_FILES%\True BoxShot\BoxShot2.ico
from %PROGRAM_FILES%\True BoxShot\is-7SR5L.tmp to %PROGRAM_FILES%\True BoxShot\TrueBoxShot2.exe
from %PROGRAM_FILES%\True BoxShot\True BoxShot\Scenes\is-QK7JR.tmp to %PROGRAM_FILES%\True BoxShot\True BoxShot\Scenes\Workplace.sbs
from %PROGRAM_FILES%\True BoxShot\is-45VPN.tmp to %PROGRAM_FILES%\True BoxShot\manual.chm
from %PROGRAM_FILES%\True BoxShot\is-64JHL.tmp to %PROGRAM_FILES%\True BoxShot\License.rtf
from %PROGRAM_FILES%\True BoxShot\True BoxShot\is-JNC53.tmp to %PROGRAM_FILES%\True BoxShot\True BoxShot\Version.xml
from %PROGRAM_FILES%\True BoxShot\True BoxShot\Scenes\is-A79SM.tmp to %PROGRAM_FILES%\True BoxShot\True BoxShot\Scenes\Stand-up boxes.sbs
from %PROGRAM_FILES%\True BoxShot\True BoxShot\Scenes\is-H84BM.tmp to %PROGRAM_FILES%\True BoxShot\True BoxShot\Scenes\Red-Blue Text.sbs
from %PROGRAM_FILES%\True BoxShot\True BoxShot\Scenes\is-J4UUO.tmp to %PROGRAM_FILES%\True BoxShot\True BoxShot\Scenes\Music Style.sbs
from %PROGRAM_FILES%\True BoxShot\True BoxShot\Scenes\is-CVPFN.tmp to %PROGRAM_FILES%\True BoxShot\True BoxShot\Scenes\VistaBox & CD.sbs
from %PROGRAM_FILES%\True BoxShot\True BoxShot\Scenes\is-JTHNO.tmp to %PROGRAM_FILES%\True BoxShot\True BoxShot\Scenes\Vista & Manual.sbs
from %PROGRAM_FILES%\True BoxShot\True BoxShot\Scenes\is-I822Q.tmp to %PROGRAM_FILES%\True BoxShot\True BoxShot\Scenes\Various Books.sbs
from %PROGRAM_FILES%\True BoxShot\True BoxShot\Scenes\is-KT6OE.tmp to %PROGRAM_FILES%\True BoxShot\True BoxShot\Scenes\Book with text.sbs
from %PROGRAM_FILES%\True BoxShot\Models\CDCase\is-8VTL9.tmp to %PROGRAM_FILES%\True BoxShot\Models\CDCase\CD Jewel Case.tbm
from %PROGRAM_FILES%\True BoxShot\Models\BoxShot\is-2KFOC.tmp to %PROGRAM_FILES%\True BoxShot\Models\BoxShot\Smooth edge box.tbm
from %PROGRAM_FILES%\True BoxShot\Models\BoxShot\is-FTD98.tmp to %PROGRAM_FILES%\True BoxShot\Models\BoxShot\Chamfered edge box.tbm
from %PROGRAM_FILES%\True BoxShot\Models\DVDBox\is-4GEHD.tmp to %PROGRAM_FILES%\True BoxShot\Models\DVDBox\DVD case and CD.tbm
from %PROGRAM_FILES%\True BoxShot\Models\DVDBox\is-TLJDL.tmp to %PROGRAM_FILES%\True BoxShot\Models\DVDBox\Closed DVD.tbm
from %PROGRAM_FILES%\True BoxShot\Models\CompactDisks\is-RAIS5.tmp to %PROGRAM_FILES%\True BoxShot\Models\CompactDisks\Compact disk.tbm
from %PROGRAM_FILES%\True BoxShot\Models\Book\is-0HVND.tmp to %PROGRAM_FILES%\True BoxShot\Models\Book\Book.tbm
from %PROGRAM_FILES%\True BoxShot\True BoxShot\is-J0MGT.tmp to %PROGRAM_FILES%\True BoxShot\True BoxShot\Gradient.xml
from %PROGRAM_FILES%\True BoxShot\is-2MO7E.tmp to %PROGRAM_FILES%\True BoxShot\unins000.exe
from %PROGRAM_FILES%\True BoxShot\Models\BoxShot\is-7D8M8.tmp to %PROGRAM_FILES%\True BoxShot\Models\BoxShot\Box.tbm
from %PROGRAM_FILES%\True BoxShot\Models\Book\is-HK2PG.tmp to %PROGRAM_FILES%\True BoxShot\Models\Book\Spiral Book.tbm
from %PROGRAM_FILES%\True BoxShot\Models\Book\is-D5EC7.tmp to %PROGRAM_FILES%\True BoxShot\Models\Book\Soft cover book.tbm
from %PROGRAM_FILES%\True BoxShot\Models\SoftBookSpring\is-H20AB.tmp to %PROGRAM_FILES%\True BoxShot\Models\SoftBookSpring\Spiral Book.tbm
from %PROGRAM_FILES%\True BoxShot\Models\ScreenShots\is-9LET6.tmp to %PROGRAM_FILES%\True BoxShot\Models\ScreenShots\ScreenShot.tbm
from %PROGRAM_FILES%\True BoxShot\Models\Other\is-VS556.tmp to %PROGRAM_FILES%\True BoxShot\Models\Other\3D Text.tbm
from %PROGRAM_FILES%\True BoxShot\True BoxShot\Scenes\is-GUOJD.tmp to %PROGRAM_FILES%\True BoxShot\True BoxShot\Scenes\Book & CD.sbs
from %PROGRAM_FILES%\True BoxShot\True BoxShot\Scenes\is-7HF5R.tmp to %PROGRAM_FILES%\True BoxShot\True BoxShot\Scenes\3D Text.sbs
from %PROGRAM_FILES%\True BoxShot\Models\VistaBox\is-G42MC.tmp to %PROGRAM_FILES%\True BoxShot\Models\VistaBox\Vista Box.tbm
from %PROGRAM_FILES%\True BoxShot\Models\iPhone\is-M4UDC.tmp to %PROGRAM_FILES%\True BoxShot\Models\iPhone\iPhone.tbm
from %PROGRAM_FILES%\True BoxShot\Models\iPhone\is-N8P49.tmp to %PROGRAM_FILES%\True BoxShot\Models\iPhone\iPad.tbm
from %PROGRAM_FILES%\True BoxShot\Models\DVDBox\is-MTO1H.tmp to %PROGRAM_FILES%\True BoxShot\Models\DVDBox\Fully opened DVD case.tbm
from %PROGRAM_FILES%\True BoxShot\Models\MemberCard\is-KI1KE.tmp to %PROGRAM_FILES%\True BoxShot\Models\MemberCard\Member Card.tbm
from %PROGRAM_FILES%\True BoxShot\Models\iPod\is-HOKOU.tmp to %PROGRAM_FILES%\True BoxShot\Models\iPod\iPod Nano.tbm
from %PROGRAM_FILES%\True BoxShot\Models\iPhone\is-HE033.tmp to %PROGRAM_FILES%\True BoxShot\Models\iPhone\IPOD nano.tbm

Miscellaneous:

Searches for the following windows:

ClassName: 'RegEdit_RegEdit' WindowName: ''
ClassName: 'Shell_TrayWnd' WindowName: ''
ClassName: 'EDIT' WindowName: ''

テクノロジー

用語

トレーニングコースおよび啓蒙プロジェクト

アンチウイルスに関する誤解と噂

Technical Information

Curing recommendations

Free trial