Trojan.MulDrop8.29335

Technical Information

To ensure autorun and distribution:

Creates or modifies the following files:

%ALLUSERSPROFILE%\Start Menu\Programs\Startup\ProSecCo Client.lnk

Malicious functions:

Searches for windows to

detect virtual machines:

ClassName: 'VBoxTrayToolWndClass', WindowName: ''
ClassName: '', WindowName: 'VBoxTrayToolWnd'

Modifies file system:

Creates the following files:

%TEMP%\GLC1.tmp
C:\Liebherr_SEC\~GLH001b.TMP
C:\Liebherr_SEC\~GLH001c.TMP
C:\Liebherr_SEC\~GLH001d.TMP
C:\Liebherr_SEC\~GLH001e.TMP
C:\Liebherr_SEC\~GLH001f.TMP
C:\Liebherr_SEC\~GLH0020.TMP
C:\Liebherr_SEC\~GLH0021.TMP
C:\Liebherr_SEC\~GLH0022.TMP
C:\Liebherr_SEC\~GLH0023.TMP
C:\Liebherr_SEC\~GLH0024.TMP
C:\Liebherr_SEC\~GLH0025.TMP
C:\Liebherr_SEC\~GLH0026.TMP
C:\Liebherr_SEC\~GLH0027.TMP
C:\Liebherr_SEC\~GLH0028.TMP
C:\Liebherr_SEC\~GLH0029.TMP
C:\Liebherr_SEC\~GLH002a.TMP
C:\Liebherr_SEC\~GLH002b.TMP
C:\Liebherr_SEC\~GLH002c.TMP
C:\Liebherr_SEC\SecurityClient.INI
C:\Liebherr_SEC\DatenC.dat
%ALLUSERSPROFILE%\Start Menu\Programs\Liebherr\ProSecCo Client.LNK
%ALLUSERSPROFILE%\Start Menu\Programs\Liebherr\Uninstall ProSecCo Client.LNK
C:\Liebherr_SEC\ScDLLLog.txt
C:\Liebherr_SEC\UserData\Sc_User.ini
C:\Liebherr_SEC\UserData\DatenL.dat
C:\Liebherr_SEC\DatenA.dat
C:\Liebherr_SEC\Info_CRNJEUFU.LXC
C:\Liebherr_SEC\~GLH001a.TMP
C:\Liebherr_SEC\UserData\DatenU.dat
C:\Liebherr_SEC\~GLH0019.TMP
C:\Liebherr_SEC\~GLH0017.TMP
%TEMP%\GLW2.tmp
%TEMP%\~GLH0000.TMP
%TEMP%\GLC4.tmp
%TEMP%\GLK5.tmp
%TEMP%\~GLH0001.TMP
%TEMP%\~GLH0002.TMP
%TEMP%\~GLH0003.TMP
%TEMP%\GLI8.tmp
C:\Liebherr_SEC\~GLH0004.TMP
C:\Liebherr_SEC\~GLH0005.TMP
C:\Liebherr_SEC\~GLH0006.TMP
C:\Liebherr_SEC\~GLH0007.TMP
C:\Liebherr_SEC\~GLH0008.TMP
C:\Liebherr_SEC\~GLH0009.TMP
C:\Liebherr_SEC\~GLH000a.TMP
C:\Liebherr_SEC\~GLH000b.TMP
C:\Liebherr_SEC\~GLH000c.TMP
C:\Liebherr_SEC\~GLH000d.TMP
C:\Liebherr_SEC\~GLH000e.TMP
C:\Liebherr_SEC\~GLH000f.TMP
C:\Liebherr_SEC\~GLH0010.TMP
C:\Liebherr_SEC\~GLH0011.TMP
C:\Liebherr_SEC\~GLH0012.TMP
C:\Liebherr_SEC\~GLH0013.TMP
C:\Liebherr_SEC\~GLH0014.TMP
C:\Liebherr_SEC\~GLH0015.TMP
C:\Liebherr_SEC\~GLH0016.TMP
C:\Liebherr_SEC\~GLH0018.TMP
C:\Liebherr_SEC\Install.log

Deletes the following files:

%TEMP%\GLW2.tmp
%TEMP%\lx_prosecco.dll
%TEMP%\GLI8.tmp
%TEMP%\GLK5.tmp
%TEMP%\GLC4.tmp
%TEMP%\SecurityClient.exe
%TEMP%\GLC1.tmp

Moves the following files:

from %TEMP%\~GLH0000.TMP to %TEMP%\SecurityClient.exe
from C:\Liebherr_SEC\~GLH0018.TMP to C:\Liebherr_SEC\LxProSec.dll
from C:\Liebherr_SEC\~GLH0019.TMP to C:\Liebherr_SEC\ScAddress.ini
from C:\Liebherr_SEC\~GLH001a.TMP to C:\Liebherr_SEC\ScClient.cds
from C:\Liebherr_SEC\~GLH001b.TMP to C:\Liebherr_SEC\ScClient.frm
from C:\Liebherr_SEC\~GLH001c.TMP to C:\Liebherr_SEC\ScClint.ddm
from C:\Liebherr_SEC\~GLH001d.TMP to C:\Liebherr_SEC\ScClint.fdt
from C:\Liebherr_SEC\~GLH001e.TMP to C:\Liebherr_SEC\ScClintD.bin
from C:\Liebherr_SEC\~GLH001f.TMP to C:\Liebherr_SEC\ScClintD.pnt
from C:\Liebherr_SEC\~GLH0020.TMP to C:\Liebherr_SEC\ScClintE.bin
from C:\Liebherr_SEC\~GLH0022.TMP to C:\Liebherr_SEC\ScClintF.bin
from C:\Liebherr_SEC\~GLH002c.TMP to C:\Liebherr_SEC\UNWISE32.EXE
from C:\Liebherr_SEC\~GLH0023.TMP to C:\Liebherr_SEC\ScClintF.pnt
from C:\Liebherr_SEC\~GLH0024.TMP to C:\Liebherr_SEC\ScClintGB.bin
from C:\Liebherr_SEC\~GLH0025.TMP to C:\Liebherr_SEC\ScClintGB.pnt
from C:\Liebherr_SEC\~GLH0026.TMP to C:\Liebherr_SEC\ScClintI.bin
from C:\Liebherr_SEC\~GLH0027.TMP to C:\Liebherr_SEC\ScClintI.pnt
from C:\Liebherr_SEC\~GLH0028.TMP to C:\Liebherr_SEC\Sc_Lang.ini
from C:\Liebherr_SEC\~GLH0029.TMP to C:\Liebherr_SEC\SecurityClient.exe
from C:\Liebherr_SEC\~GLH002a.TMP to C:\Liebherr_SEC\SecurityClient.INI
from C:\Liebherr_SEC\~GLH002b.TMP to C:\Liebherr_SEC\SecurityUninstall.EXE
from C:\Liebherr_SEC\~GLH0017.TMP to C:\Liebherr_SEC\LxidTpL.dll
from C:\Liebherr_SEC\~GLH0021.TMP to C:\Liebherr_SEC\ScClintE.pnt
from C:\Liebherr_SEC\~GLH0016.TMP to C:\Liebherr_SEC\LxidTiff.dll
from C:\Liebherr_SEC\~GLH0009.TMP to C:\Liebherr_SEC\DG.exe
from %TEMP%\~GLH0000.TMP to %TEMP%\GLF7.tmp
from %TEMP%\~GLH0001.TMP to %TEMP%\Mfc42.dll
from %TEMP%\~GLH0002.TMP to %TEMP%\Msvcrt.dll
from %TEMP%\~GLH0003.TMP to %TEMP%\lx_prosecco.dll
from C:\Liebherr_SEC\~GLH0004.TMP to C:\Liebherr_SEC\00040000.app
from C:\Liebherr_SEC\~GLH0005.TMP to C:\Liebherr_SEC\00040000.grp
from C:\Liebherr_SEC\~GLH0006.TMP to C:\Liebherr_SEC\0004c000.lsc
from C:\Liebherr_SEC\~GLH0007.TMP to C:\Liebherr_SEC\0004p000.lsc
from C:\Liebherr_SEC\~GLH0008.TMP to C:\Liebherr_SEC\0004p001.lsc
from C:\Liebherr_SEC\~GLH000a.TMP to C:\Liebherr_SEC\lex.ico
from C:\Liebherr_SEC\~GLH0014.TMP to C:\Liebherr_SEC\LxidJpeg.dll
from C:\Liebherr_SEC\~GLH000b.TMP to C:\Liebherr_SEC\LexFpi32.dll
from C:\Liebherr_SEC\~GLH000c.TMP to C:\Liebherr_SEC\LexLogo.tif
from C:\Liebherr_SEC\~GLH000d.TMP to C:\Liebherr_SEC\LIDOSLOGO.TIF
from C:\Liebherr_SEC\~GLH000e.TMP to C:\Liebherr_SEC\LxidBmp.dll
from C:\Liebherr_SEC\~GLH000f.TMP to C:\Liebherr_SEC\LxidDcod.dll
from C:\Liebherr_SEC\~GLH0010.TMP to C:\Liebherr_SEC\LxidDib.dll
from C:\Liebherr_SEC\~GLH0011.TMP to C:\Liebherr_SEC\LxidDrf.dll
from C:\Liebherr_SEC\~GLH0012.TMP to C:\Liebherr_SEC\LxidHtSp.dll
from C:\Liebherr_SEC\~GLH0013.TMP to C:\Liebherr_SEC\LxidImg.dll
from C:\Liebherr_SEC\~GLH0015.TMP to C:\Liebherr_SEC\LxidPng.dll
from C:\Liebherr_SEC\UserData\Sc_User.ini to C:\Liebherr_SEC\UserData\DatenU.dat