SHA1: aeef60dfcfa3745e0a3a57585d8ac4c6046bbb03
A Trojan that is embedded into running processes of a malicious library using the dll side loading method. It is distributed by the Trojan.MulDrop6.44482 dropper.
It receives a name of the executable file needed to be run and a name of the malicious library. Once the target process is launched, it generates a list of the downloaded components.
Then it removes the following components from the list:
- components from \\KnownDlls or \\KnownDlls32;
- components from a process import table;
- cpwinet.dll;
- wdmaud.drv;
- msacm32.drv.
The Trojan uses the rest of the components to load the malicious library: it copies the malicious library named as one of the libraries on the list to the folder with a target application and then launches the executable file.