Trojan.MulDrop6.44482

SHA1:
e7fc7a0e2d59dc8e18414830b02304fa5a8ce1b9 (NSIS)
3209448505069ff3a6eb1e446854aa85dad9481b (05DB2C2B.dll)
ae2869629aec2c18aedfc134aed8762ffbb66f2c (237AE0F2.dll)
aeef60dfcfa3745e0a3a57585d8ac4c6046bbb03 (dev25E9.exe)
fd4aa4184fcf6240b0cbb14e9c731a87ed744f0d (devCDFB.exe)
1d5897759ee66047e1d4c6378a52079fac2303f5 (payload)

A dropper Trojan for Microsoft Windows that is implemented as an installer of Nullsoft Scriptable Install System (NSIS). The installer and its content has the following digital signature:

CN = Bit-Trejd
OU = IT
O = Bit-Trejd
STREET = 1st Kolobovskij pereulok d. 27/3 str.3 office 30
L = Moscow
S = Moscow
PostalCode = 127051
C = RU

The Trojan terminates its operation if the computer’s localization differs from 1049 (Russian (ru)) or if the installer’s script detects one of the following programs:

avastui.exe
egui.exe
avpui.exe
spideragent.exe

Besides, the installer requests the system registry branch in order to check whether the Kaspersky anti-virus is installed on the computer:

HKCU\\Software\\KasperskyLab\\AVP6

The Trojan uses the attrib utility to remove “Hidden”, “System”, and “Read only” attributes for "%APPDATA%\Roaming\Microsoft\Shockwave" and "%APPDATA%\Roaming\Microsoft\Guide” directories. If these folders are missing, it creates them.

Then the Trojan saves the 7z packer named 7za.exe and a password-protected 7z archive named as install.dat into a temporary folder, files from which are extracted one by one. First, a dynamic library is unpacked:

cmd.exe /C "7za.exe x -p9J6D69ccVe install.dat 237AE0F2.dll -aoa"

The Trojan loads this library and calls its export with the following parameters:

"Software\Microsoft\Windows\CurrentVersion\Run", "Shockwave Flash Player", "%APPDATA%\Roaming\Microsoft\Shockwave\Guide.exe".

The following files are then extracted from the archive:

cmd.exe /C "7za.exe x -p9J6D69ccVe install.dat devCDFB.tmp -aoa"
cmd.exe /C "7za.exe x -p9J6D69ccVe install.dat 47ED9F45.dat -aoa"

The unpacked file is then run:

cmd.exe /C "%TEMP%\msi1223.tmp\devCDFB.exe 47ED9F45.dat 1.dat

After that, the installer extracts a dynamic library responsible for decryption of the payload:

cmd.exe /C "7za.exe x -p9J6D69ccVe install.dat 05DB2C2B.dll -aoa

The rest of the files are then finally unpacked:

cmd.exe /C "7za.exe x -p9J6D69ccVe install.dat dev25E9.tmp -aoa"
cmd.exe /C "7za.exe x -p9J6D69ccVe install.dat devE49C.tmp -aoa"
cmd.exe /C "7za.exe x -p9J6D69ccVe devE49C.tmp -aoa -o7676545.tmp"

The Trojan saves the The Guide program, which is used to load the library to the memory, into the "%APPDATA%\Roaming\Microsoft\Shockwave\” folder. This program is registered in autorun, and the Trojan places a malicious library, naming it as a corresponding Windows library necessary for the program’s operation, into the folder that contains The Guide. As a rule, when a process is launched, Windows first searchers for required libraries in the folder from which the process was run, and then—in Windows system folders. The Trojan uses this feature to load the malicious library to RAM.

Finally, the Trojan extracts the FileTouch utility:

cmd.exe /C "7za.exe x -p9J6D69ccVe install.dat FileTouch.exe -aoa"

This utility helps to set dates of file creation, modification, and access 2016-05-06:

FileTouch.exe  /s /c /w /a /r /d 06-05-2016 "%APPDATA%\Roaming\Microsoft\Shockwave\*.*"

The last stage is launch of a downloader component:

%APPDATA%\Roaming\Microsoft\Shockwave\dev25E9.exe Guide.exe 05DB2C2B.dll

Extracted files have the following names and purposes:

The main payload of this Trojan is Trojan.PWS.Spy.19338.

News about the Trojan