Trojan.MulDrop8.31821

Technical Information

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKCU>\Software\VOS\PingPlotterPro<HKLM>\SOFTWARE\Classes\Pingman Tools.PingPlotter 5.pp2\shell\open\command] '' = '"C:\PingPlotter 5\PingPlotter.exe" "%1"'
[<HKCU>\Software\VOS\PingPlotterPro<HKLM>\SOFTWARE\Classes\Pingman Tools.PingPlotter 5.ppws\shell\open\command] '' = '"C:\PingPlotter 5\PingPlotter.exe" "%1"'
[<HKCU>\Software\VOS\PingPlotterPro<HKLM>\SOFTWARE\Classes\pingplotter\shell\open\command] '' = '"C:\PingPlotter 5\PingPlotter.exe" /url "%1"'

Malicious functions:

Injects code into

the following system processes:

<SYSTEM32>\cmd.exe
<SYSTEM32>\route.exe
<SYSTEM32>\find.exe

the following user processes:

PingPlotterPro.exe
PingPlotter.exe

Modifies file system:

Creates the following files:

<Current directory>\PingPlotterPro 5.5.12\VirtApp.ini
<Current directory>\PingPlotterPro 5.5.12\CHANGES\CryptCheck.dat
<Current directory>\PingPlotterPro 5.5.12\PROG\C_\PingPlotter 5\PingPlotterPro.exe
<Current directory>\PingPlotterPro 5.5.12\CHANGES\VirtFiles.db.2896.tmp
<Current directory>\PingPlotterPro 5.5.12\CHANGES\%Temp%\~ppSave1.tmp
<Current directory>\PingPlotterPro 5.5.12\CHANGES\%Temp%\~ppSave3.tmp
<Current directory>\PingPlotterPro 5.5.12\PROG\C_\PingPlotter 5\PingPlotterPro.ini
<Current directory>\PingPlotterPro 5.5.12\VirtFiles.Prog.db
<Current directory>\PingPlotterPro 5.5.12\CHANGES\VirtFiles.db.2924.tmp
<Current directory>\PingPlotterPro 5.5.12\PROG\C_\PingPlotter 5\PingPlotter.exe.Config
<Current directory>\PingPlotterPro 5.5.12\CHANGES\VirtFiles.db.2944.tmp
<Current directory>\PingPlotterPro 5.5.12\CHANGES\VirtFiles.db.2936.tmp
<Current directory>\PingPlotterPro 5.5.12\CHANGES\VirtFiles.db.2952.tmp
<Current directory>\PingPlotterPro 5.5.12\CHANGES\VirtFiles.db.2960.tmp
<Current directory>\PingPlotterPro 5.5.12\CHANGES\VirtFiles.db.3036.tmp
<Current directory>\PingPlotterPro 5.5.12\ZipCache
<Current directory>\PingPlotterPro 5.5.12\EngineStamps\ZipCache.20180623-084035.769.stamp
<Current directory>\PingPlotterPro 5.5.12\EngineStamps\DiskModeDeploy.marker
<Current directory>\PingPlotterPro 5.5.12\CHANGES\VirtFiles.db.2884.tmp
<Current directory>\PingPlotterPro 5.5.12\CHANGES\VirtReg.Base.dat
<Current directory>\PingPlotterPro 5.5.12\EngineStamps\AppVirtDll_PingPlotterPro.dll.20180623-084035.769.stamp
<Current directory>\PingPlotterPro 5.5.12\AppVirtDll64_PingPlotterPro.dll
<Current directory>\PingPlotterPro 5.5.12\EngineStamps\AppVirtDll64_PingPlotterPro.dll.20180623-084035.769.stamp
<Current directory>\PingPlotterPro 5.5.12\PingPlotterPro.exe
<Current directory>\PingPlotterPro 5.5.12\EngineStamps\PingPlotterPro.exe.20180623-084035.769.stamp
<Current directory>\PingPlotterPro 5.5.12\PingPlotterPro64.exe
<Current directory>\PingPlotterPro 5.5.12\CHANGES\VirtFiles.db.3044.tmp
<Current directory>\PingPlotterPro 5.5.12\PROG\C_\PingPlotter 5\PingPlotter.exe
<Current directory>\PingPlotterPro 5.5.12\EngineStamps\PingPlotterPro64.exe.20180623-084035.769.stamp
<Current directory>\PingPlotterPro 5.5.12\SandboxCfg.db
<Current directory>\PingPlotterPro 5.5.12\EngineStamps\SandboxCfg.db.20180623-093356.124.stamp
<Current directory>\PingPlotterPro 5.5.12\VirtReg.Prog.dat
<Current directory>\PingPlotterPro 5.5.12\EngineStamps\VirtReg.Prog.dat.20180623-152044.659.stamp
<Current directory>\PingPlotterPro 5.5.12\CHANGES\VirtFiles.db
<Current directory>\PingPlotterPro 5.5.12\CHANGES\VirtReg.dat
<Current directory>\PingPlotterPro 5.5.12\AppVirtDll_PingPlotterPro.dll
<Current directory>\PingPlotterPro 5.5.12\EngineStamps\VirtFiles.Prog.db.20180623-152044.691.stamp
<Current directory>\PingPlotterPro 5.5.12\CHANGES\VirtFiles.db.3108.tmp

Deletes the following files:

<Current directory>\PingPlotterPro 5.5.12\CHANGES\VirtFiles.db
<Current directory>\PingPlotterPro 5.5.12\CHANGES\%Temp%\~ppSave1.tmp
<Current directory>\PingPlotterPro 5.5.12\CHANGES\%Temp%\~ppSave3.tmp

Substitutes the following files:

<Current directory>\PingPlotterPro 5.5.12\CHANGES\VirtFiles.db
<Current directory>\PingPlotterPro 5.5.12\CHANGES\VirtFiles.db.2884.tmp

Miscellaneous:

Searches for the following windows:

ClassName: '' WindowName: 'GFXSVR'

Creates and executes the following:

'<Current directory>\PingPlotterPro 5.5.12\PROG\C_\PingPlotter 5\PingPlotterPro.exe'
'<Current directory>\PingPlotterPro 5.5.12\PROG\C_\PingPlotter 5\PingPlotter.exe'

Executes the following:

'<SYSTEM32>\cmd.exe' /c "for /f "tokens=3" %g in ('route print ^| find " 0.0.0.0"') do (for /f "tokens=1-3 delims=." %a in ("%g") do (route -p add 216.92.151.75 %a.%b.%c.0 && route -p add 216.92.150.222 %a.%b.%c.0)...
'<SYSTEM32>\cmd.exe' /c route print | find " 0.0.0.0"
'<SYSTEM32>\route.exe' print
'<SYSTEM32>\find.exe' " 0.0.0.0"
'<SYSTEM32>\cmd.exe' /c "route delete 216.92.151.75 && route delete 216.92.150.222 && exit"
'<SYSTEM32>\route.exe' delete 216.92.151.75
'<SYSTEM32>\route.exe' delete 216.92.150.222

Демо бесплатно на 14 дней

Выдаётся при установке

Скачать с сайта

Скачать с Google Play

Завантажте
Dr.Web для Android

Безкоштовно на 3 місяці
Всі компоненти захисту
Подовження демо в
AppGallery/Google Pay

Технології

Терміни

Навчання

Міфи

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней