Trojan.MulDrop8.9609

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'HKLM' = '%WINDIR%\InstallDir\Server.exe'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'HKCU' = '%WINDIR%\InstallDir\Server.exe'
[<HKLM>\SOFTWARE\Microsoft\Active Setup\Installed Components\{K7ON383J-0476-FN57-QMDM-1QA246XC6AVV}] 'StubPath' = '%WINDIR%\InstallDir\Server.exe restart'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'Alobw' = '"%APPDATA%\Aqogrogosif\izmuubupyhi.exe"'

Creates or modifies the following files:

Malicious functions:

Injects code into

the following system processes:

the following user processes:

Searches for registry branches where third party applications store passwords:

[<HKCU>\Software\Ghisler\Total Commander]
[<HKCU>\Software\Microsoft\Internet Account Manager]
[<HKCU>\SOFTWARE\ftpware\coreftp\sites]
[<HKLM>\SOFTWARE\martin prikryl\winscp 2\sessions]
[<HKCU>\SOFTWARE\martin prikryl\winscp 2\sessions]
[<HKLM>\SOFTWARE\FlashFXP\3]
[<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook]
[<HKLM>\Software\Martin Prikryl]
[<HKLM>\Software\SimonTatham\PuTTY\Sessions]
[<HKCU>\Software\SimonTatham\PuTTY\Sessions]
[<HKCU>\Software\NCH Software\ClassicFTP\FTPAccounts]
[<HKLM>\Software\NCH Software\ClassicFTP\FTPAccounts]
[<HKCU>\Software\NCH Software\Fling\Accounts]
[<HKLM>\Software\NCH Software\Fling\Accounts]
[<HKCU>\Software\VanDyke\SecureFX]
[<HKCU>\Software\Far2\Plugins\FTP\Hosts]
[<HKCU>\Software\Far\Plugins\FTP\Hosts]
[<HKCU>\Software\Martin Prikryl]
[<HKCU>\Software\Microsoft\Internet Account Manager\Accounts]
[<HKCU>\Software\Microsoft\Windows Live Mail]

Modifies settings of Windows Internet Explorer:

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0] '1609' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1] '1406' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1] '1609' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2] '1609' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1406' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '1609' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4] '1406' = '00000000'
[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4] '1609' = '00000000'

Modifies file system:

Creates the following files:

%TEMP%\server.exe
%TEMP%\tmp6.tmp
%TEMP%\tmp5.tmp
%APPDATA%\Aqogrogosif\izmuubupyhi.exe
%TEMP%\tmp4.tmp
%TEMP%\tmp3.tmp
%APPDATA%\517D9D\DE2515.lck
%APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\ec702f375e1b12d218f67ab9ef19ca23_23ef5514-3059-436f-a4a7-4cefaab20eb1
%APPDATA%\Subeivcyim\antidogy.ebe
%APPDATA%\Microsoft\Protect\CREDHIST
%TEMP%\150rluir.exe.exe
%TEMP%\979l8rk.exe
%TEMP%\979l8rk.exe.exe
%APPDATA%\Microsoft\Windows\mjTLyhXpe.dat
%WINDIR%\InstallDir\Server.exe
%APPDATA%\Microsoft\Windows\mjTLyhXpe.cfg
%TEMP%\e3di.jar
%TEMP%\150rluir.exe
<LS_APPDATA>\Identities\{5518F2FB-DB74-45A3-BEC1-4575D8D9DC84}\Microsoft\Outlook Express\Sent Items.dbx

Sets the 'hidden' attribute to the following files:

Deletes the following files:

%APPDATA%\517D9D\DE2515.lck
%APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\ec702f375e1b12d218f67ab9ef19ca23_23ef5514-3059-436f-a4a7-4cefaab20eb1
%TEMP%\tmp3.tmp
%TEMP%\tmp4.tmp
%TEMP%\tmp5.tmp
%TEMP%\tmp6.tmp

Moves the following files:

Substitutes the following files:

%APPDATA%\Microsoft\Crypto\RSA\S-1-5-21-2052111302-484763869-725345543-1003\ec702f375e1b12d218f67ab9ef19ca23_23ef5514-3059-436f-a4a7-4cefaab20eb1

Network activity:

Connects to:

TCP:

HTTP POST requests:

UDP:

Miscellaneous:

Creates and executes the following:

Executes the following: