Trojan.MulDrop4.53585

Technical Information

To ensure autorun and distribution:

Creates the following services:

[<HKLM>\SYSTEM\ControlSet001\Services\RemoteRegistry] 'Start' = '00000002'

Malicious functions:

Creates and executes the following:

'%TEMP%\GLB1.tmp' 6144 <Full path to virus>

Executes the following:

'<SYSTEM32>\cscript.exe' "%TEMP%\Machine\RupeeForadianFont\RegisterRupeeForadianFont.vbs"
'<SYSTEM32>\wscript.exe' "%TEMP%\Machine\McAfeeCustomProps\CUSTOM~1.VBS"
'<SYSTEM32>\wscript.exe' "%TEMP%\Machine\EDMCFix\edmcfix.vbs"
'<SYSTEM32>\wscript.exe' "%TEMP%\Machine\MCDLLRename\MCDLLR~1.VBS"
'<SYSTEM32>\wscript.exe' "%TEMP%\Machine\NotesBuddyList\NOTESB~1.VBS"
'<SYSTEM32>\wscript.exe' %TEMP%\Machine\DNSSuffixList\ED5_AppendDNSSuffixlist.vbs WBG
'<SYSTEM32>\net1.exe' Start "WebClient"
'<SYSTEM32>\wscript.exe' "%TEMP%\Machine\FixINews\WBGTIC~2.VBS"
'<SYSTEM32>\sc.exe' stop IBMPMSVC
'<SYSTEM32>\wscript.exe' "%TEMP%\Machine\OUAdmin\LOCALA~1.VBS"
'<SYSTEM32>\net1.exe' Stop "WebClient"
'<SYSTEM32>\net.exe' Stop "WebClient"
'<SYSTEM32>\net1.exe' START "RemoteRegistry"

Modifies file system :

Creates the following files:

%TEMP%\Machine\SMS20\~GLH0039.TMP
%TEMP%\Machine\SMS20\~GLH003a.TMP
%TEMP%\Machine\SMS20\~GLH0038.TMP
%TEMP%\Machine\SMS20\~GLH0036.TMP
%TEMP%\Machine\SMS20\~GLH0037.TMP
%TEMP%\Machine\SMS20\~GLH003b.TMP
%TEMP%\Machine\SMS20\~GLH003f.TMP
%TEMP%\Machine\SMS20\~GLH0040.TMP
%TEMP%\Machine\SMS20\~GLH003e.TMP
%TEMP%\Machine\SMS20\~GLH003c.TMP
%TEMP%\Machine\SMS20\~GLH003d.TMP
%TEMP%\Machine\SMS20\~GLH0035.TMP
%TEMP%\Machine\SMS20\~GLH002d.TMP
%TEMP%\Machine\SMS20\~GLH002e.TMP
%TEMP%\Machine\SMS20\~GLH002c.TMP
%TEMP%\Machine\SMS20\~GLH002a.TMP
%TEMP%\Machine\SMS20\~GLH002b.TMP
%TEMP%\Machine\SMS20\~GLH002f.TMP
%TEMP%\Machine\SMS20\~GLH0033.TMP
%TEMP%\Machine\SMS20\~GLH0034.TMP
%TEMP%\Machine\SMS20\~GLH0032.TMP
%TEMP%\Machine\SMS20\~GLH0030.TMP
%TEMP%\Machine\SMS20\~GLH0031.TMP
%PROGRAM_FILES%\IBM\Lotus\Notes\framework\rcp\~GLH0050.TMP
C:\WBG\Scripts\~GLH0051.TMP
C:\WBG\Utility\~GLH004f.TMP
%TEMP%\Machine\VPNProfile\NewProfiles\~GLH004d.TMP
%TEMP%\Machine\VPNProfile\NewProfiles\~GLH004e.TMP
C:\temp\cd\download\Cache\~GLH0052.TMP
%PROGRAM_FILES%\IBM\Lotus\Notes\framework\rcp\plugin_customization.ini
C:\WBG\Logs\MachineScripts5.LOG
C:\WBG\Scripts\~GLH0054.TMP
C:\temp\cd\download\Cache\~GLH0053.TMP
%WINDIR%\Fonts\Rupee_Foradian.ttf
%TEMP%\Machine\VPNProfile\~GLH004c.TMP
%TEMP%\Machine\SMS20\~GLH0044.TMP
%TEMP%\Machine\SMS20\~GLH0045.TMP
%TEMP%\Machine\SMS20\~GLH0043.TMP
%TEMP%\Machine\SMS20\~GLH0041.TMP
%TEMP%\Machine\SMS20\~GLH0042.TMP
%TEMP%\Machine\SMS20\~GLH0046.TMP
%TEMP%\Machine\SMS20\~GLH004a.TMP
%TEMP%\Machine\SMS20\~GLH004b.TMP
%TEMP%\Machine\SMS20\~GLH0049.TMP
%TEMP%\Machine\SMS20\~GLH0047.TMP
%TEMP%\Machine\SMS20\~GLH0048.TMP
%TEMP%\Machine\SMS20\~GLH0029.TMP
%TEMP%\Machine\EnableNSDService\~GLH000a.TMP
%TEMP%\Machine\FixINews\~GLH000b.TMP
%TEMP%\Machine\EDMCFix\~GLH0009.TMP
%TEMP%\Machine\DocumentumFix\~GLH0007.TMP
%TEMP%\Machine\DocumentumFix\~GLH0008.TMP
%TEMP%\Machine\FixINews\~GLH000c.TMP
%TEMP%\Machine\McAfeeCustomProps\~GLH0010.TMP
%TEMP%\Machine\MCDLLRename\~GLH0011.TMP
%TEMP%\Machine\LLOGOUT\~GLH000f.TMP
%TEMP%\Machine\FixINews\~GLH000d.TMP
%TEMP%\Machine\ISUSPM_Uninstall\~GLH000e.TMP
%TEMP%\Machine\DocumentumFix\~GLH0006.TMP
%TEMP%\GLW4.tmp
%TEMP%\GLG6.tmp
%TEMP%\GLK3.tmp
%TEMP%\GLB1.tmp
%TEMP%\GLC2.tmp
%TEMP%\Machine\~GLH0000.TMP
%TEMP%\Machine\DisableJVMProperties\~GLH0004.TMP
%TEMP%\Machine\DNSSuffixList\~GLH0005.TMP
%TEMP%\Machine\8021x\~GLH0003.TMP
%TEMP%\Machine\8021x\~GLH0001.TMP
%TEMP%\Machine\8021x\~GLH0002.TMP
%TEMP%\Machine\SAP & BW\Open Text\Document Pipelines\~GLH0021.TMP
%TEMP%\Machine\SAP & BW\Open Text\Livelink Imaging\~GLH0022.TMP
%TEMP%\Machine\SAP & BW\Open Text\~GLH0020.TMP
%TEMP%\Machine\RupeeForadianFont\~GLH001e.TMP
%TEMP%\Machine\SametimeAutoLogonFix\~GLH001f.TMP
%TEMP%\Machine\SAP & BW\Open Text\Livelink Imaging\~GLH0023.TMP
%TEMP%\Machine\SMS20\~GLH0027.TMP
%TEMP%\Machine\SMS20\~GLH0028.TMP
%TEMP%\Machine\SMS20\~GLH0026.TMP
%TEMP%\Machine\SAP & BW\Open Text\Scan\~GLH0024.TMP
%TEMP%\Machine\SAPINI\~GLH0025.TMP
%TEMP%\Machine\RupeeForadianFont\~GLH001d.TMP
%TEMP%\Machine\NotesPresetFeeds\~GLH0015.TMP
%TEMP%\Machine\NotesPresetFeeds\~GLH0016.TMP
%TEMP%\Machine\NotesPresetFeeds\~GLH0014.TMP
%TEMP%\Machine\newWMI\~GLH0012.TMP
%TEMP%\Machine\NotesBuddyList\~GLH0013.TMP
%TEMP%\Machine\OUAdmin\~GLH0017.TMP
%TEMP%\Machine\PGFIX_PSEXEC\~GLH001b.TMP
%TEMP%\Machine\RASPOST\~GLH001c.TMP
%TEMP%\Machine\PGFIX_PSEXEC\~GLH001a.TMP
%TEMP%\Machine\OUAdmin\~GLH0018.TMP
%TEMP%\Machine\PGFIX_PSEXEC\~GLH0019.TMP

Deletes the following files:

%TEMP%\GLK3.tmp
%TEMP%\GLC2.tmp
%TEMP%\GLB1.tmp
%TEMP%\GLW4.tmp
%PROGRAM_FILES%\IBM\Lotus\Notes\framework\rcp\plugin_customization.ini
%TEMP%\GLG6.tmp

Moves the following files:

from %TEMP%\Machine\SMS20\~GLH0039.TMP to %TEMP%\Machine\SMS20\reg.exe
from %TEMP%\Machine\SMS20\~GLH003a.TMP to %TEMP%\Machine\SMS20\servicelist.txt
from %TEMP%\Machine\SMS20\~GLH0038.TMP to %TEMP%\Machine\SMS20\pskill.exe
from %TEMP%\Machine\SMS20\~GLH0036.TMP to %TEMP%\Machine\SMS20\man.ini.en
from %TEMP%\Machine\SMS20\~GLH0037.TMP to %TEMP%\Machine\SMS20\man.wsf
from %TEMP%\Machine\SMS20\~GLH003e.TMP to %TEMP%\Machine\SMS20\TEMPREM.BAT
from %TEMP%\Machine\SMS20\~GLH003f.TMP to %TEMP%\Machine\SMS20\update_mof.bat
from %TEMP%\Machine\SMS20\~GLH003d.TMP to %TEMP%\Machine\SMS20\SMS_ACL.BAT
from %TEMP%\Machine\SMS20\~GLH003b.TMP to %TEMP%\Machine\SMS20\Setevnt.exe
from %TEMP%\Machine\SMS20\~GLH003c.TMP to %TEMP%\Machine\SMS20\sleep.exe
from %TEMP%\Machine\SMS20\~GLH0035.TMP to %TEMP%\Machine\SMS20\LOG.BAT
from %TEMP%\Machine\SMS20\~GLH002e.TMP to %TEMP%\Machine\SMS20\ipadd.txt
from %TEMP%\Machine\SMS20\~GLH002f.TMP to %TEMP%\Machine\SMS20\ipccr.txt
from %TEMP%\Machine\SMS20\~GLH002d.TMP to %TEMP%\Machine\SMS20\homeou.txt
from %TEMP%\Machine\SMS20\~GLH002b.TMP to %TEMP%\Machine\SMS20\FindLDAPPath.exe
from %TEMP%\Machine\SMS20\~GLH002c.TMP to %TEMP%\Machine\SMS20\Hammer.exe
from %TEMP%\Machine\SMS20\~GLH0033.TMP to %TEMP%\Machine\SMS20\localad.cmd
from %TEMP%\Machine\SMS20\~GLH0034.TMP to %TEMP%\Machine\SMS20\localad.vbs
from %TEMP%\Machine\SMS20\~GLH0032.TMP to %TEMP%\Machine\SMS20\Kill.exe
from %TEMP%\Machine\SMS20\~GLH0030.TMP to %TEMP%\Machine\SMS20\IPCCRTS2.TXT
from %TEMP%\Machine\SMS20\~GLH0031.TMP to %TEMP%\Machine\SMS20\ipcoadd.txt
from %TEMP%\Machine\VPNProfile\NewProfiles\~GLH004e.TMP to %TEMP%\Machine\VPNProfile\NewProfiles\World Bank DC2.pcf
from C:\WBG\Utility\~GLH004f.TMP to C:\WBG\Utility\Local Area Connection-Machine-Cert.xml
from %TEMP%\Machine\VPNProfile\NewProfiles\~GLH004d.TMP to %TEMP%\Machine\VPNProfile\NewProfiles\World Bank DC1.pcf
from %TEMP%\Machine\SMS20\~GLH004b.TMP to %TEMP%\Machine\SMS20\WBG_ED_remove.mof
from %TEMP%\Machine\VPNProfile\~GLH004c.TMP to %TEMP%\Machine\VPNProfile\vpnclient.ini
from C:\temp\cd\download\Cache\~GLH0053.TMP to C:\temp\cd\download\Cache\ipcoadd.txt
from C:\WBG\Scripts\~GLH0054.TMP to C:\WBG\Scripts\LLOGOUT.WSF
from C:\temp\cd\download\Cache\~GLH0052.TMP to C:\temp\cd\download\Cache\ipadd.txt
from %PROGRAM_FILES%\IBM\Lotus\Notes\framework\rcp\~GLH0050.TMP to %PROGRAM_FILES%\IBM\Lotus\Notes\framework\rcp\plugin_customization.ini
from C:\WBG\Scripts\~GLH0051.TMP to C:\WBG\Scripts\WMI.WSF
from %TEMP%\Machine\SMS20\~GLH004a.TMP to %TEMP%\Machine\SMS20\WBG_ED_ADR.MOF
from %TEMP%\Machine\SMS20\~GLH0043.TMP to %TEMP%\Machine\SMS20\WBGSMS.vbs
from %TEMP%\Machine\SMS20\~GLH0044.TMP to %TEMP%\Machine\SMS20\WBGSMStest.vbs
from %TEMP%\Machine\SMS20\~GLH0042.TMP to %TEMP%\Machine\SMS20\WBGResetWMI.cmd
from %TEMP%\Machine\SMS20\~GLH0040.TMP to %TEMP%\Machine\SMS20\WBGCliCln.bat
from %TEMP%\Machine\SMS20\~GLH0041.TMP to %TEMP%\Machine\SMS20\WBGCLICLN.BK1
from %TEMP%\Machine\SMS20\~GLH0048.TMP to %TEMP%\Machine\SMS20\WBG_ED.mof
from %TEMP%\Machine\SMS20\~GLH0049.TMP to %TEMP%\Machine\SMS20\wbg_ed4_rm.mof
from %TEMP%\Machine\SMS20\~GLH0047.TMP to %TEMP%\Machine\SMS20\WBG_Chk_logs.cmd
from %TEMP%\Machine\SMS20\~GLH0045.TMP to %TEMP%\Machine\SMS20\WBGSysMgr.exe
from %TEMP%\Machine\SMS20\~GLH0046.TMP to %TEMP%\Machine\SMS20\WBG_AdminGrps.cmd
from %TEMP%\Machine\SMS20\~GLH002a.TMP to %TEMP%\Machine\SMS20\EMPTY.TXT
from %TEMP%\Machine\ISUSPM_Uninstall\~GLH000e.TMP to %TEMP%\Machine\ISUSPM_Uninstall\ISUSPM-Uninstall.exe
from %TEMP%\Machine\LLOGOUT\~GLH000f.TMP to %TEMP%\Machine\LLOGOUT\LLOGOUT.WSF
from %TEMP%\Machine\FixINews\~GLH000d.TMP to %TEMP%\Machine\FixINews\WBGTicker_invt_v3.vbs
from %TEMP%\Machine\FixINews\~GLH000b.TMP to %TEMP%\Machine\FixINews\FixINews.exe
from %TEMP%\Machine\FixINews\~GLH000c.TMP to %TEMP%\Machine\FixINews\WBGTicker_invt.vbs
from %TEMP%\Machine\NotesBuddyList\~GLH0013.TMP to %TEMP%\Machine\NotesBuddyList\NotesBuddyList.vbs
from %TEMP%\Machine\NotesPresetFeeds\~GLH0014.TMP to %TEMP%\Machine\NotesPresetFeeds\presetfeeds.opml
from %TEMP%\Machine\newWMI\~GLH0012.TMP to %TEMP%\Machine\newWMI\WMI.WSF
from %TEMP%\Machine\McAfeeCustomProps\~GLH0010.TMP to %TEMP%\Machine\McAfeeCustomProps\CustomProps.VBS
from %TEMP%\Machine\MCDLLRename\~GLH0011.TMP to %TEMP%\Machine\MCDLLRename\MCDLLRename.vbs
from %TEMP%\Machine\EnableNSDService\~GLH000a.TMP to %TEMP%\Machine\EnableNSDService\install_start_nsd_service.bat
from %TEMP%\Machine\8021x\~GLH0003.TMP to %TEMP%\Machine\8021x\Local Area Connection.xml
from %TEMP%\Machine\DisableJVMProperties\~GLH0004.TMP to %TEMP%\Machine\DisableJVMProperties\jvm.properties
from %TEMP%\Machine\8021x\~GLH0002.TMP to %TEMP%\Machine\8021x\Local Area Connection-User.xml
from %TEMP%\Machine\~GLH0000.TMP to %TEMP%\Machine\Local Area Connection-Machine-Cert.xml
from %TEMP%\Machine\8021x\~GLH0001.TMP to %TEMP%\Machine\8021x\Local Area Connection-Machine-Cert.xml
from %TEMP%\Machine\DocumentumFix\~GLH0008.TMP to %TEMP%\Machine\DocumentumFix\WINWORD.exe.config
from %TEMP%\Machine\EDMCFix\~GLH0009.TMP to %TEMP%\Machine\EDMCFix\edmcfix.vbs
from %TEMP%\Machine\DocumentumFix\~GLH0007.TMP to %TEMP%\Machine\DocumentumFix\POWERPNT.exe.config
from %TEMP%\Machine\DNSSuffixList\~GLH0005.TMP to %TEMP%\Machine\DNSSuffixList\ED5_AppendDNSSuffixlist.vbs
from %TEMP%\Machine\DocumentumFix\~GLH0006.TMP to %TEMP%\Machine\DocumentumFix\EXCEL.exe.config
from %TEMP%\Machine\SAP & BW\Open Text\Livelink Imaging\~GLH0023.TMP to %TEMP%\Machine\SAP & BW\Open Text\Livelink Imaging\Livelink Desktop Monitor.lnk
from %TEMP%\Machine\SAP & BW\Open Text\Scan\~GLH0024.TMP to %TEMP%\Machine\SAP & BW\Open Text\Scan\Enterprise Scan.lnk
from %TEMP%\Machine\SAP & BW\Open Text\Livelink Imaging\~GLH0022.TMP to %TEMP%\Machine\SAP & BW\Open Text\Livelink Imaging\Livelink Archive Windows Viewer.lnk
from %TEMP%\Machine\SAP & BW\Open Text\~GLH0020.TMP to %TEMP%\Machine\SAP & BW\Open Text\Livelink Archive Windows Viewer.lnk
from %TEMP%\Machine\SAP & BW\Open Text\Document Pipelines\~GLH0021.TMP to %TEMP%\Machine\SAP & BW\Open Text\Document Pipelines\Pipeline Info.lnk
from %TEMP%\Machine\SMS20\~GLH0028.TMP to %TEMP%\Machine\SMS20\CCRADD.bat
from %TEMP%\Machine\SMS20\~GLH0029.TMP to %TEMP%\Machine\SMS20\dummy.cmd
from %TEMP%\Machine\SMS20\~GLH0027.TMP to %TEMP%\Machine\SMS20\ccmclean.exe
from %TEMP%\Machine\SAPINI\~GLH0025.TMP to %TEMP%\Machine\SAPINI\saplogon.ini
from %TEMP%\Machine\SMS20\~GLH0026.TMP to %TEMP%\Machine\SMS20\ADDLOC.vbs
from %TEMP%\Machine\SametimeAutoLogonFix\~GLH001f.TMP to %TEMP%\Machine\SametimeAutoLogonFix\plugin_customization.ini
from %TEMP%\Machine\OUAdmin\~GLH0018.TMP to %TEMP%\Machine\OUAdmin\LocalAdmin.vbs
from %TEMP%\Machine\PGFIX_PSEXEC\~GLH0019.TMP to %TEMP%\Machine\PGFIX_PSEXEC\EnableCertChainCheck_x86.reg
from %TEMP%\Machine\OUAdmin\~GLH0017.TMP to %TEMP%\Machine\OUAdmin\LocalAdmin.old
from %TEMP%\Machine\NotesPresetFeeds\~GLH0015.TMP to %TEMP%\Machine\NotesPresetFeeds\WBE.MDM
from %TEMP%\Machine\NotesPresetFeeds\~GLH0016.TMP to %TEMP%\Machine\NotesPresetFeeds\WBI.MDM
from %TEMP%\Machine\RupeeForadianFont\~GLH001d.TMP to %TEMP%\Machine\RupeeForadianFont\RegisterRupeeForadianFont.vbs
from %TEMP%\Machine\RupeeForadianFont\~GLH001e.TMP to %TEMP%\Machine\RupeeForadianFont\Rupee_Foradian.ttf
from %TEMP%\Machine\RASPOST\~GLH001c.TMP to %TEMP%\Machine\RASPOST\RasPost.wsf
from %TEMP%\Machine\PGFIX_PSEXEC\~GLH001a.TMP to %TEMP%\Machine\PGFIX_PSEXEC\PGHook.dll
from %TEMP%\Machine\PGFIX_PSEXEC\~GLH001b.TMP to %TEMP%\Machine\PGFIX_PSEXEC\PrivilegeGuardService.exe

Miscellaneous:

Searches for the following windows:

ClassName: 'Shell_TrayWnd' WindowName: '(null)'

技术

术语

教育培训

误区

Technical Information

Curing recommendations

Free trial