Library
My library

+ Add to library

Profile

Trojan.MulDrop6.44482

Added to the Dr.Web virus database: 2016-06-23

Virus description added:

SHA1:
e7fc7a0e2d59dc8e18414830b02304fa5a8ce1b9 (NSIS)
3209448505069ff3a6eb1e446854aa85dad9481b (05DB2C2B.dll)
ae2869629aec2c18aedfc134aed8762ffbb66f2c (237AE0F2.dll)
aeef60dfcfa3745e0a3a57585d8ac4c6046bbb03 (dev25E9.exe)
fd4aa4184fcf6240b0cbb14e9c731a87ed744f0d (devCDFB.exe)
1d5897759ee66047e1d4c6378a52079fac2303f5 (payload)

A dropper Trojan for Microsoft Windows that is implemented as an installer of Nullsoft Scriptable Install System (NSIS). The installer and its content has the following digital signature:

CN = Bit-Trejd
OU = IT
O = Bit-Trejd
STREET = 1st Kolobovskij pereulok d. 27/3 str.3 office 30
L = Moscow
S = Moscow
PostalCode = 127051
C = RU

The Trojan terminates its operation if the computer’s localization differs from 1049 (Russian (ru)) or if the installer’s script detects one of the following programs:

avastui.exe
egui.exe
avpui.exe
spideragent.exe

Besides, the installer requests the system registry branch in order to check whether the Kaspersky anti-virus is installed on the computer:

HKCU\\Software\\KasperskyLab\\AVP6

The Trojan uses the attrib utility to remove “Hidden”, “System”, and “Read only” attributes for "%APPDATA%\Roaming\Microsoft\Shockwave" and "%APPDATA%\Roaming\Microsoft\Guide” directories. If these folders are missing, it creates them.

Then the Trojan saves the 7z packer named 7za.exe and a password-protected 7z archive named as install.dat into a temporary folder, files from which are extracted one by one. First, a dynamic library is unpacked:

cmd.exe /C "7za.exe x -p9J6D69ccVe install.dat 237AE0F2.dll -aoa"

The Trojan loads this library and calls its export with the following parameters:

"Software\Microsoft\Windows\CurrentVersion\Run", "Shockwave Flash Player", "%APPDATA%\Roaming\Microsoft\Shockwave\Guide.exe".

The following files are then extracted from the archive:

cmd.exe /C "7za.exe x -p9J6D69ccVe install.dat devCDFB.tmp -aoa"
cmd.exe /C "7za.exe x -p9J6D69ccVe install.dat 47ED9F45.dat -aoa"

The unpacked file is then run:

cmd.exe /C "%TEMP%\msi1223.tmp\devCDFB.exe 47ED9F45.dat 1.dat

After that, the installer extracts a dynamic library responsible for decryption of the payload:

cmd.exe /C "7za.exe x -p9J6D69ccVe install.dat 05DB2C2B.dll -aoa

The rest of the files are then finally unpacked:

cmd.exe /C "7za.exe x -p9J6D69ccVe install.dat dev25E9.tmp -aoa"
cmd.exe /C "7za.exe x -p9J6D69ccVe install.dat devE49C.tmp -aoa"
cmd.exe /C "7za.exe x -p9J6D69ccVe devE49C.tmp -aoa -o7676545.tmp"

The Trojan saves the The Guide program, which is used to load the library to the memory, into the "%APPDATA%\Roaming\Microsoft\Shockwave\” folder. This program is registered in autorun, and the Trojan places a malicious library, naming it as a corresponding Windows library necessary for the program’s operation, into the folder that contains The Guide. As a rule, when a process is launched, Windows first searchers for required libraries in the folder from which the process was run, and then—in Windows system folders. The Trojan uses this feature to load the malicious library to RAM.

Finally, the Trojan extracts the FileTouch utility:

cmd.exe /C "7za.exe x -p9J6D69ccVe install.dat FileTouch.exe -aoa"

This utility helps to set dates of file creation, modification, and access 2016-05-06:

FileTouch.exe  /s /c /w /a /r /d 06-05-2016 "%APPDATA%\Roaming\Microsoft\Shockwave\*.*"

The last stage is launch of a downloader component:

%APPDATA%\Roaming\Microsoft\Shockwave\dev25E9.exe Guide.exe 05DB2C2B.dll

Extracted files have the following names and purposes:

File namePurpose
237AE0F2.dllIt has two exports—F1 and F2. F1 receives a registry key, a parameter name and its value. The file uses SID to check whether the user has administrative privileges (if the privileges are missing, the HKCU registry branch is used, if not—HKLM). Then it uses the API SetWindowsHookEx function to intercept the GetMessage event to grant the sent value to the corresponding parameter in the specified registry key. F2 uses the same operation scheme; yet, it does not grant but removes values in the registry.
dev25E9.exeTrojan.Inject2.24412
devCDFB.exeThe file receives source and target files. It reads the content of the source file, decrypts it with XOR, and then it encrypts it with RC2. The key is generated based on the hard drive data. Encrypted information is saved to the target file.
05DB2C2B.dllThe file decrypts the library from the 1.dat file (that was created by devCDFB.exe) and grants it control.

The main payload of this Trojan is Trojan.PWS.Spy.19338.

News about the Trojan

Curing recommendations

  1. If the operating system (OS) can be loaded (either normally or in safe mode), download Dr.Web Security Space and run a full scan of your computer and removable media you use. More about Dr.Web Security Space.
  2. If you cannot boot the OS, change the BIOS settings to boot your system from a CD or USB drive. Download the image of the emergency system repair disk Dr.Web® LiveDisk , mount it on a USB drive or burn it to a CD/DVD. After booting up with this media, run a full scan and cure all the detected threats.
Download Dr.Web

Download by serial number

Use Dr.Web Anti-virus for macOS to run a full scan of your Mac.

After booting up, run a full scan of all disk partitions with Dr.Web Anti-virus for Linux.

Download Dr.Web

Download by serial number

  1. If the mobile device is operating normally, download and install Dr.Web for Android. Run a full system scan and follow recommendations to neutralize the detected threats.
  2. If the mobile device has been locked by Android.Locker ransomware (the message on the screen tells you that you have broken some law or demands a set ransom amount; or you will see some other announcement that prevents you from using the handheld normally), do the following:
    • Load your smartphone or tablet in the safe mode (depending on the operating system version and specifications of the particular mobile device involved, this procedure can be performed in various ways; seek clarification from the user guide that was shipped with the device, or contact its manufacturer);
    • Once you have activated safe mode, install the Dr.Web for Android onto the infected handheld and run a full scan of the system; follow the steps recommended for neutralizing the threats that have been detected;
    • Switch off your device and turn it on as normal.

Find out more about Dr.Web for Android