Trojan.MulDrop8.33077

Technical Information

Malicious functions:

Executes the following:

'<SYSTEM32>\taskkill.exe' /f /im RfServiceMan.exe
'<SYSTEM32>\taskkill.exe' /f /im ATTEND_RF.exe
'<SYSTEM32>\taskkill.exe' /f /im RFMonitorWin.exe
'<SYSTEM32>\taskkill.exe' /f /im RfServerWin.exe
'<SYSTEM32>\taskkill.exe' /f /im RFConfig.exe

Modifies file system:

Creates the following files:

%TEMP%\is-JCGMQ.tmp\<File name>.tmp
<Current directory>\is-DQQHA.tmp
<Current directory>\is-10PDA.tmp
<Current directory>\is-8O2SI.tmp
<Current directory>\is-SN5OU.tmp
<Current directory>\is-AVTO3.tmp
<Current directory>\is-L7DA7.tmp
<Current directory>\is-8LPJV.tmp
<Current directory>\is-D1NGV.tmp
<Current directory>\Report\is-E8DPB.tmp
<Current directory>\Report\is-3Q7MM.tmp
<Current directory>\Report\is-TBOHL.tmp
<Current directory>\Report\is-TE11O.tmp
<Current directory>\Help\is-IES1G.tmp
<Current directory>\is-IHV7N.tmp
<Current directory>\is-RVLTP.tmp
<Current directory>\Images\is-TL0E5.tmp
<Current directory>\is-5MM55.tmp
<Current directory>\is-69D67.tmp
<Current directory>\is-IPD9V.tmp
<Current directory>\is-BOPOI.tmp
<Current directory>\is-KK7CA.tmp
<Current directory>\is-QM9EH.tmp
<Current directory>\Report\is-UTTD6.tmp
<Current directory>\is-2CQ1Q.tmp
<Current directory>\is-2JERJ.tmp
<Current directory>\is-BM53P.tmp
<Current directory>\is-56DP2.tmp
<Current directory>\is-1IC6C.tmp
<Current directory>\is-KH71S.tmp
<Current directory>\is-1SP78.tmp
<Current directory>\is-325FV.tmp
<Current directory>\is-PMM0V.tmp
<Current directory>\is-IG648.tmp
<Current directory>\is-4JHNO.tmp
%TEMP%\is-3BCRV.tmp\<File name>.tmp
%TEMP%\is-EKIMV.tmp\_isetup\_shfoldr.dll
<Current directory>\is-HAK6J.tmp
<Current directory>\is-6JIBS.tmp
<Current directory>\is-Q52QJ.tmp
<Current directory>\is-RGT9E.tmp
<Current directory>\Media\is-F1O73.tmp
<Current directory>\Media\is-4N9LK.tmp
<Current directory>\Media\is-UNFFJ.tmp
<Current directory>\Media\is-ONT7J.tmp
<Current directory>\Report\is-TLTES.tmp
<Current directory>\Report\is-3EFVI.tmp
<Current directory>\Report\is-3ABG6.tmp
<Current directory>\Report\is-1VNLK.tmp
%TEMP%\is-E605R.tmp\_isetup\_shfoldr.dll
<Current directory>\Report\is-GN9C0.tmp
<Current directory>\is-O4F0N.tmp
<Current directory>\Report\is-9FI44.tmp
<Current directory>\Report\is-D5N60.tmp
<Current directory>\Report\is-TLMTL.tmp
<Current directory>\Report\is-V1TR6.tmp
<Current directory>\Report\is-JRHJ2.tmp
<Current directory>\Report\is-QMHVO.tmp
<Current directory>\is-0PGTU.tmp
<Current directory>\Report\is-U1G9E.tmp
<Current directory>\is-H7BDQ.tmp
<Current directory>\Help\is-I576P.tmp
<Current directory>\Images\is-8RH6P.tmp
<Current directory>\Images\is-LLS34.tmp
<Current directory>\is-NJMU4.tmp
<Current directory>\is-G0R7B.tmp
<Current directory>\Help\is-8UB07.tmp
<Current directory>\is-K54N0.tmp

Deletes the following files:

%TEMP%\is-E605R.tmp\_isetup\_shfoldr.dll
<Current directory>\ssleay32.dll
<Current directory>\ServiceUninstall.bat
<Current directory>\ServiceStop.bat
<Current directory>\ServiceStart.bat
<Current directory>\ServiceInstall.bat
<Current directory>\RfServiceMan.exe
<Current directory>\RfServerWin.exe
<Current directory>\RfServerSvc.exe
<Current directory>\LogViewer.exe
<Current directory>\libusb0.dll
<Current directory>\libeay32.dll
<Current directory>\copy.avi
<Current directory>\BS_SDK.dll
<Current directory>\ATTEND_RF.exe
<Current directory>\ATTEND_DB_Patch.exe
<Current directory>\Images\back.jpg
<Current directory>\Help\Manual.pdf
<Current directory>\Report\TICKETM05V.fr3
<Current directory>\Report\TICKETM03E.FR3
<Current directory>\url.ini
%TEMP%\is-JCGMQ.tmp\<File name>.tmp

Moves the following files:

from <Current directory>\is-HAK6J.tmp to <Current directory>\AutoUpdater.exe
from <Current directory>\Images\is-8RH6P.tmp to <Current directory>\Images\back.jpg
from <Current directory>\Images\is-LLS34.tmp to <Current directory>\Images\login.jpg
from <Current directory>\is-NJMU4.tmp to <Current directory>\ATTEND_DB_Patch.exe
from <Current directory>\is-G0R7B.tmp to <Current directory>\ATTEND_RF.exe
from <Current directory>\is-O4F0N.tmp to <Current directory>\BS_SDK.dll
from <Current directory>\is-4JHNO.tmp to <Current directory>\copy.avi
from <Current directory>\is-IG648.tmp to <Current directory>\libeay32.dll
from <Current directory>\is-PMM0V.tmp to <Current directory>\libusb0.dll
from <Current directory>\is-RVLTP.tmp to <Current directory>\RfServerSvc.exe
from <Current directory>\Report\is-E8DPB.tmp to <Current directory>\Report\InbodyCard.fr3
from <Current directory>\is-DQQHA.tmp to <Current directory>\RfServerWin.exe
from <Current directory>\is-10PDA.tmp to <Current directory>\RfServiceMan.exe
from <Current directory>\is-8O2SI.tmp to <Current directory>\ServiceInstall.bat
from <Current directory>\is-SN5OU.tmp to <Current directory>\ServiceStart.bat
from <Current directory>\is-AVTO3.tmp to <Current directory>\ServiceStop.bat
from <Current directory>\is-L7DA7.tmp to <Current directory>\ServiceUninstall.bat
from <Current directory>\is-8LPJV.tmp to <Current directory>\ssleay32.dll
from <Current directory>\is-D1NGV.tmp to <Current directory>\url.ini
from <Current directory>\Help\is-I576P.tmp to <Current directory>\Help\VMManual.pdf
from <Current directory>\is-IHV7N.tmp to <Current directory>\LogViewer.exe
from <Current directory>\Help\is-8UB07.tmp to <Current directory>\Help\Manual.pdf
from <Current directory>\Report\is-3EFVI.tmp to <Current directory>\Report\ATTINF03R_2.FR3
from <Current directory>\is-6JIBS.tmp to <Current directory>\AutoWebUpdate.exe
from <Current directory>\is-Q52QJ.tmp to <Current directory>\curfiles.ini
from <Current directory>\is-RGT9E.tmp to <Current directory>\Options.Ini
from <Current directory>\Media\is-F1O73.tmp to <Current directory>\Media\double.wav
from <Current directory>\Media\is-4N9LK.tmp to <Current directory>\Media\nocard.wav
from <Current directory>\Media\is-UNFFJ.tmp to <Current directory>\Media\noprogram.wav
from <Current directory>\Media\is-ONT7J.tmp to <Current directory>\Media\ok.wav
from <Current directory>\Report\is-TLTES.tmp to <Current directory>\Report\ATTINF03R.FR3
from <Current directory>\Report\is-3ABG6.tmp to <Current directory>\Report\ATTINF04R.FR3
from <Current directory>\Report\is-U1G9E.tmp to <Current directory>\Report\VIEW06V.fr3
from <Current directory>\Report\is-1VNLK.tmp to <Current directory>\Report\ATTINF05R.FR3
from <Current directory>\Report\is-GN9C0.tmp to <Current directory>\Report\Inbody01E.fr3
from <Current directory>\Report\is-9FI44.tmp to <Current directory>\Report\MEMBCARD01E.fr3
from <Current directory>\Report\is-D5N60.tmp to <Current directory>\Report\TICKETM03E.FR3
from <Current directory>\Report\is-TLMTL.tmp to <Current directory>\Report\TICKETM05V.fr3
from <Current directory>\Report\is-V1TR6.tmp to <Current directory>\Report\View02R.fr3
from <Current directory>\Report\is-JRHJ2.tmp to <Current directory>\Report\VIEW04V.fr3
from <Current directory>\Report\is-QMHVO.tmp to <Current directory>\Report\VIEW05V.fr3
from <Current directory>\Report\is-UTTD6.tmp to <Current directory>\Report\VIEW07V.fr3
from <Current directory>\Report\is-TE11O.tmp to <Current directory>\Report\View01V.FR3

Substitutes the following files:

<Current directory>\Report\TICKETM03E.FR3
<Current directory>\ServiceUninstall.bat
<Current directory>\ServiceStop.bat
<Current directory>\ServiceStart.bat
<Current directory>\ServiceInstall.bat
<Current directory>\RfServiceMan.exe
<Current directory>\RfServerWin.exe
<Current directory>\RfServerSvc.exe
<Current directory>\LogViewer.exe
<Current directory>\libusb0.dll
<Current directory>\libeay32.dll
<Current directory>\copy.avi
<Current directory>\BS_SDK.dll
<Current directory>\ATTEND_RF.exe
<Current directory>\ATTEND_DB_Patch.exe
<Current directory>\Images\back.jpg
<Current directory>\Help\Manual.pdf
<Current directory>\Report\TICKETM05V.fr3
<Current directory>\ssleay32.dll
<Current directory>\url.ini

Miscellaneous:

Searches for the following windows:

ClassName: '' WindowName: ''

Creates and executes the following:

'%TEMP%\is-JCGMQ.tmp\<File name>.tmp' /SL5="$30092,11800982,54272,<Full path to file>"
'<Full path to file>' /SILENT
'%TEMP%\is-3BCRV.tmp\<File name>.tmp' /SL5="$400DE,11800982,54272,<Full path to file>" /SILENT
'<Current directory>\ATTEND_DB_Patch.exe'

Технології

Терміни

Навчання

Міфи

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней