Trojan.MulDrop28.42643

Technical Information

To ensure autorun and distribution

Sets the following service settings

[HKLM\System\CurrentControlSet\Services\EShineEncoder] 'Start' = '00000002'
[HKLM\System\CurrentControlSet\Services\EShineEncoder] 'ImagePath' = '%ALLUSERSPROFILE%\EShineEncoder\EShineEncoder.exe'

Creates the following services

'EShineEncoder' %ALLUSERSPROFILE%\EShineEncoder\EShineEncoder.exe

Modifies file system

Creates the following files

%TEMP%\is-m80fb.tmp\<File name>.tmp
%LOCALAPPDATA%\flashback express 1.25.3.44\flashbackexpress360.exe
%LOCALAPPDATA%\flashback express 1.25.3.44\uninstall\unins000.dat
%LOCALAPPDATA%\flashback express 1.25.3.44\is-eb1cq.tmp
%LOCALAPPDATA%\flashback express 1.25.3.44\is-fph1k.tmp
%LOCALAPPDATA%\flashback express 1.25.3.44\library\is-clcm8.tmp
%LOCALAPPDATA%\flashback express 1.25.3.44\library\is-l8mpq.tmp
%LOCALAPPDATA%\flashback express 1.25.3.44\library\is-4jk9p.tmp
%LOCALAPPDATA%\flashback express 1.25.3.44\library\is-1q4g1.tmp
%LOCALAPPDATA%\flashback express 1.25.3.44\library\is-ke9fa.tmp
%LOCALAPPDATA%\flashback express 1.25.3.44\library\is-nmbp1.tmp
%LOCALAPPDATA%\flashback express 1.25.3.44\library\is-ll8b1.tmp
%LOCALAPPDATA%\flashback express 1.25.3.44\library\is-vp58s.tmp
%LOCALAPPDATA%\flashback express 1.25.3.44\library\is-pcj79.tmp
%ALLUSERSPROFILE%\eshineencoder\eshineencoder.exe
%LOCALAPPDATA%\flashback express 1.25.3.44\library\is-f0fkq.tmp
%LOCALAPPDATA%\flashback express 1.25.3.44\library\is-8c95d.tmp
%LOCALAPPDATA%\flashback express 1.25.3.44\library\is-l1cmd.tmp
%LOCALAPPDATA%\flashback express 1.25.3.44\library\is-p07oe.tmp
%LOCALAPPDATA%\flashback express 1.25.3.44\is-9sbna.tmp
%LOCALAPPDATA%\flashback express 1.25.3.44\is-t5jiu.tmp
%LOCALAPPDATA%\flashback express 1.25.3.44\is-591ot.tmp
%LOCALAPPDATA%\flashback express 1.25.3.44\is-70835.tmp
%LOCALAPPDATA%\flashback express 1.25.3.44\is-b43ar.tmp
%LOCALAPPDATA%\flashback express 1.25.3.44\uninstall\is-b6vik.tmp
%TEMP%\is-k29f1.tmp\_isetup\_iscrypt.dll
%TEMP%\is-k29f1.tmp\_isetup\_shfoldr.dll
%TEMP%\is-k29f1.tmp\_isetup\_setup64.tmp
%TEMP%\is-k29f1.tmp\_isetup\_regdll.tmp
%LOCALAPPDATA%\flashback express 1.25.3.44\library\is-ttiep.tmp
%ALLUSERSPROFILE%\eshineencoder\sqlite3.dll

Moves the following files

from %LOCALAPPDATA%\flashback express 1.25.3.44\uninstall\is-b6vik.tmp to %LOCALAPPDATA%\flashback express 1.25.3.44\uninstall\unins000.exe
from %LOCALAPPDATA%\flashback express 1.25.3.44\library\is-clcm8.tmp to %LOCALAPPDATA%\flashback express 1.25.3.44\library\winter.scal
from %LOCALAPPDATA%\flashback express 1.25.3.44\library\is-l8mpq.tmp to %LOCALAPPDATA%\flashback express 1.25.3.44\library\weather.scal
from %LOCALAPPDATA%\flashback express 1.25.3.44\library\is-4jk9p.tmp to %LOCALAPPDATA%\flashback express 1.25.3.44\library\symbols.scal
from %LOCALAPPDATA%\flashback express 1.25.3.44\library\is-1q4g1.tmp to %LOCALAPPDATA%\flashback express 1.25.3.44\library\swirls.scal
from %LOCALAPPDATA%\flashback express 1.25.3.44\library\is-ke9fa.tmp to %LOCALAPPDATA%\flashback express 1.25.3.44\library\summer.scal
from %LOCALAPPDATA%\flashback express 1.25.3.44\library\is-nmbp1.tmp to %LOCALAPPDATA%\flashback express 1.25.3.44\library\spring.scal
from %LOCALAPPDATA%\flashback express 1.25.3.44\library\is-ll8b1.tmp to %LOCALAPPDATA%\flashback express 1.25.3.44\library\newborn.scal
from %LOCALAPPDATA%\flashback express 1.25.3.44\library\is-vp58s.tmp to %LOCALAPPDATA%\flashback express 1.25.3.44\library\music.scal
from %LOCALAPPDATA%\flashback express 1.25.3.44\library\is-pcj79.tmp to %LOCALAPPDATA%\flashback express 1.25.3.44\library\michellemybelle creations.scal
from %LOCALAPPDATA%\flashback express 1.25.3.44\library\is-f0fkq.tmp to %LOCALAPPDATA%\flashback express 1.25.3.44\library\game.scal
from %LOCALAPPDATA%\flashback express 1.25.3.44\library\is-ttiep.tmp to %LOCALAPPDATA%\flashback express 1.25.3.44\library\fall.scal
from %LOCALAPPDATA%\flashback express 1.25.3.44\library\is-8c95d.tmp to %LOCALAPPDATA%\flashback express 1.25.3.44\library\createinspain designs.scal
from %LOCALAPPDATA%\flashback express 1.25.3.44\library\is-l1cmd.tmp to %LOCALAPPDATA%\flashback express 1.25.3.44\library\basic shapes.scal
from %LOCALAPPDATA%\flashback express 1.25.3.44\library\is-p07oe.tmp to %LOCALAPPDATA%\flashback express 1.25.3.44\library\arrows.scal
from %LOCALAPPDATA%\flashback express 1.25.3.44\is-9sbna.tmp to %LOCALAPPDATA%\flashback express 1.25.3.44\winsparkle.dll
from %LOCALAPPDATA%\flashback express 1.25.3.44\is-t5jiu.tmp to %LOCALAPPDATA%\flashback express 1.25.3.44\ch375dll.dll
from %LOCALAPPDATA%\flashback express 1.25.3.44\is-591ot.tmp to %LOCALAPPDATA%\flashback express 1.25.3.44\cairogfx.dll
from %LOCALAPPDATA%\flashback express 1.25.3.44\is-70835.tmp to %LOCALAPPDATA%\flashback express 1.25.3.44\msvcr71.dll
from %LOCALAPPDATA%\flashback express 1.25.3.44\is-b43ar.tmp to %LOCALAPPDATA%\flashback express 1.25.3.44\msvcp71.dll
from %LOCALAPPDATA%\flashback express 1.25.3.44\is-fph1k.tmp to %LOCALAPPDATA%\flashback express 1.25.3.44\sqlite3.dll
from %LOCALAPPDATA%\flashback express 1.25.3.44\is-eb1cq.tmp to %LOCALAPPDATA%\flashback express 1.25.3.44\flashbackexpress360.exe

Miscellaneous

Searches for the following windows

ClassName: 'f1c685_shineenc_11163_f1c685' WindowName: ''

Creates and executes the following

'%TEMP%\is-m80fb.tmp\<File name>.tmp' /SL5="$60248,4319793,54272,<Full path to file>"
'%LOCALAPPDATA%\flashback express 1.25.3.44\flashbackexpress360.exe' -i

Executes the following