Trojan.MulDrop32.43175

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\] 'Userinit' = '<SYSTEM32>\userinit.exe,<SYSTEM32>\winnt32.exe'
[HKLM\SOFTWARE\Classes\exefile\shell\open\command] '' = '%WINDIR%\SysWow64\winnt32.exe "%1" %*'

Malicious functions

To complicate detection of its presence in the operating system,

blocks the following features:

User Account Control (UAC)

Modifies file system

Creates the following files

%WINDIR%\syswow64\winnt32.exe
C:\user.png
C:\user.bmp
C:\user-32.png
C:\user-40.png
C:\user-48.png
C:\user-192.png
C:\hello.png
C:\hello.bat
C:\users\public\desktop\p䭡ⵖ槒ᛉk
C:\users\public\desktop\whbręマv丷ptvm
C:\users\public\desktop\炟rs㮥q摋耖qmu
C:\users\public\desktop\౛޲瘚⍮壸嵽᫉㱶秽lm乲⻀
C:\users\public\desktop\㛫䊰dy㽶娑wk夰㜙簹
C:\users\public\desktop\o䬀ᝅyb㑪to`nӿ
C:\users\public\desktop\㜎稃omku
C:\users\public\desktop\hx懲㍦v翏۷ᥗ傹᧓k從`⮌
C:\users\public\desktop\vl⃙ÐÂµb᭴䝏j`wj
C:\users\public\desktop\xxeᔁr盟⮀翡twqa
C:\users\public\desktop\l㔒僤㩎k淩j䣪᠖
C:\users\public\desktop\瑙᢯h⵷૊仗壶᎖or؈r䥛e
C:\users\public\desktop\浴eન劋y㓙sjbv灉d
C:\users\public\desktop\vc竡炔y䄥v
C:\users\public\desktop\啖sc䆯gbku滾v
C:\users\public\desktop\t⸵儿でsg⪸
C:\users\public\desktop\w漡峞ɡ嬜᱙w
C:\users\public\desktop\n唛柇d珆
C:\users\public\desktop\dbࣸ䧣rjiⓢ猖徴
C:\users\public\desktop\piⁱdp㜡↠iႃy`tkb
C:\users\public\desktop\ap䏆㎈䭳堍㠾ūc䩐
C:\users\public\desktop\r㗾rs唾朾b壁d澰l䜧
C:\users\public\desktop\⎲hheᱼ
C:\users\public\desktop\䌾crq`x㫲`ay⃄‴俦m
C:\users\public\desktop\o瓞癬`tl
C:\users\public\desktop\䔪gdᦧtjlo
C:\users\public\desktop\㣼㍁䱍稇㊣ᠸ
C:\users\public\desktop\c嬰┍㒭a
C:\users\public\desktop\`琱㈭ⷁiwg垘o຀᩾呑pg
C:\users\public\desktop\mtpp᧯yoh
C:\users\public\desktop\㯥h垇yۥᘴjt㺉㣍q
C:\users\public\desktop\ⵆo耦䢋㈁ⓡ`ˢh硧
C:\users\public\desktop\t炍䲩pi䥛嚜ǐlrgk独y
C:\users\public\desktop\kenbsytᙡ㸏枼b
C:\users\public\desktop\㴊ᤏ`elng〄ṃy
C:\users\public\desktop\⒐拵ehɐ㗐byh
C:\users\public\desktop\ݩ⇇aற孍漞☁t檐va
C:\users\public\desktop\q槙a咧haua
C:\users\public\desktop\ˠ卥疂㟂ᾅfͬlq㯑⛽r乓
C:\users\public\desktop\n㫫聖qif▫宮y穜扰㦎o᪱
C:\users\public\desktop\䰯c㨐d⃀帀傂gdmg
C:\users\public\desktop\۲唂e㔌᳞tth⯴ad
C:\users\public\desktop\叆干e⻿瑋
C:\users\public\desktop\๩n㗕बᮋy侣壛yeヨoᙕឲ
C:\users\public\desktop\筥ㅜggcf㜓㮍k``渲
C:\users\public\desktop\n慆瓷oo斪hj炑
C:\users\public\desktop\㌍ܻb慊ᑏdww
C:\users\public\desktop\凙㶍દm瘀すtlgᬠ
C:\users\public\desktop\灺qּ᠅㨁狽npk澇v
C:\users\public\desktop\ᙢwx梆椹岄厭牠掁ÐÑjfb
C:\users\public\desktop\ᯓ挵lt䕻濆ᶦ
C:\users\public\desktop\⽶䡘y`磗洶㦈冿
C:\users\public\desktop\㚺漛`bjjj
C:\users\public\desktop\yť⬼㮫۷
C:\users\public\desktop\埙䂎⊊卄fuco㐲љ
C:\users\public\desktop\x`w紳㡽phdr
C:\users\public\desktop\篧yy䁑l撈䯑``
C:\users\public\desktop\嶒ḕb䨃gias筚
C:\users\public\desktop\n䉽㕅䵯ox歞h濞碶
C:\users\public\desktop\岀掯rה滟ɚ楅摋miᾆ`x小
C:\users\public\desktop\⚢tjgᓔᅟឹ⁦⳧喛矜෷e
C:\users\public\desktop\jlp㨸稇嶰⍝
C:\users\public\desktop\䵝u㶽秜hftk䦏
C:\users\public\desktop\ᘩბ弭sjࢿ湵خemg搀
C:\users\public\desktop\懅ᒹd㢜baq
C:\users\public\desktop\m竎⮲▏羐vfr∢᱘
C:\users\public\desktop\vura灆澪k凇䲡
C:\users\public\desktop\qתn晀玴x݇⷏`ᴠ
C:\users\public\desktop\rᩐⷿ▿ീys
C:\users\public\desktop\f砸m灙d➆
C:\users\public\desktop\v㌃ඌog᷄p`ްcbi
C:\users\public\desktop\㕭槣uq呹窬ᨶ
C:\users\public\desktop\hcb⤌涿᧍d`㘚mf稻n
C:\users\public\desktop\ଵᬝ⤜儇ધወ樘
C:\users\public\desktop\᳈bű挡lgp㶾㖋氹㜷e
C:\users\public\desktop\惤u㵍jⱬ`ᐿs᫜n
C:\users\public\desktop\篙qᝲy⁒qmvŭ
C:\users\public\desktop\`䊻v㽡ye
C:\users\public\desktop\䉮ኃa疗xej槿⍀`糂cw
C:\users\public\desktop\ly☮攟b↦`፼yㅗsㄧf㹍
C:\users\public\desktop\ui䠎n産⾪fe⁙ጋ乖
C:\users\public\desktop\㩑cy⧍al御wns੡fᆝ
C:\users\public\desktop\䆟bပ嫽lt䊴檣හb㴩瘝
C:\users\public\desktop\nk໤䙲⿁忆g䭿兦
C:\users\public\desktop\kfֳo嬒r
C:\users\public\desktop\枿皿ዕybp燞h䔁同ci
C:\users\public\desktop\⭫ek率o㭬el
C:\users\public\desktop\‪ඏn㪔kള
C:\users\public\desktop\l箫omlcẩr䢗o㕷
C:\users\public\desktop\䘨nhrެb⟠⾬箅⇢慅
C:\users\public\desktop\宧寨wⴍㅁ漛㿡pⴿ打Ðâ¢恀
C:\users\public\desktop\歨p㑪sctsmw⊱wvk
C:\users\public\desktop\聎秗hጡ㬝
C:\users\public\desktop\呯ൌnr愆e`gln伧`
C:\users\public\desktop\㌇c戂ccq耟x
C:\users\public\desktop\v㩼⇳狐gḵufec
C:\users\public\desktop\atw糄em
C:\users\public\desktop\r㇮聃l垒n኏f絭璥b䨞m
C:\users\public\desktop\ᛶlcu嬸棱細⢵`l
C:\users\public\desktop\ᰣ㞧l㉫e`pjky妋
C:\users\public\desktop\eࣘ㪛t⊏
C:\users\public\desktop\痙i娾ງe
C:\users\public\desktop\uggve
C:\users\public\desktop\㜮eir嶞ㆥhidq⊃抵`o
C:\users\public\desktop\妠㏪f严朔c૧繃
C:\users\public\desktop\᠖ἃcils琱k穣劻∼
C:\users\public\desktop\fm楃`i矿hnfcg岑䚢
C:\users\public\desktop\ui⟷䏑彏j唉䫧☺dj㵐䉿
C:\users\public\desktop\ド圲v၊ugln仝a
C:\users\public\desktop\耿⮽้緊l⫝̸`y烥
C:\users\public\desktop\ms⦂`y
C:\users\public\desktop\称p䋾嘗ᚓ㳵甴ᓤ
C:\users\public\desktop\椮sw䩖䱜䫎w煘w㘂
C:\users\public\desktop\mpmj䥇l䭤ᦇ`d曁p
C:\users\public\desktop\rwj㍁繋v垣cxjbas耋
C:\users\public\desktop\ro`ⅵeuw戓⩌ਝ
C:\users\public\desktop\`怋㢾橚c䳯vxṷ呤ip㘾
C:\users\public\desktop\wৡ㉗xtku溳
C:\users\public\desktop\翳ѝྦྷusnhyo
C:\users\public\desktop\nuⴁ甪rp夋罕磛
C:\users\public\desktop\ᖳrpl䔵洡gཪ䚷
C:\users\public\desktop\g枬㆚掳hwkp䥾s搞
C:\users\public\desktop\枸x礥᩶dqhdw㋿rc
C:\users\public\desktop\劉bḧү⬷rxfflh
C:\users\public\desktop\`sg凝nọ緈j榑琨gjd
C:\users\public\desktop\n䚓䦡⨧u旽ᾑ
C:\users\public\desktop\䢐h㮡eఀo惃
C:\users\public\desktop\oery䚉idq㔌itt⣔
C:\users\public\desktop\e《翵⼅ᮋt㟱`u
C:\users\public\desktop\d㩆⬋o拦䛎綒dd瑥㋿p
C:\users\public\desktop\ਆ⫃ॲ䁓敐呦㙛t⫋ࡄb
C:\users\public\desktop\䁁㛺䣍bg㩔b
C:\users\public\desktop\圑ᅷԣkff`
C:\users\public\desktop\a㒺ᘃhmx
C:\users\public\desktop\䋵㪇ᰵ掺㕧`
C:\users\public\desktop\`⪉cyਓ`
C:\users\public\desktop\xdvng
C:\users\public\desktop\ᗟjvmflᶮvᳳ䔑yja
C:\users\public\desktop\w㓌೒⺹榧dj
C:\users\public\desktop\䁀ij丂s祣dg换䍝儌l䭒
C:\users\public\desktop\j`勬vwsw⴪珹v巐
C:\users\public\desktop\`pᅺe桳䔷橳md䑙box
C:\users\public\desktop\hhkowߛcᓮcp
C:\users\public\desktop\osᣞspaan墂j㓁
C:\users\public\desktop\哤a⅄䦞gwcᤜ䉕凞vh暰
C:\users\public\desktop\杝ᄅbkp⾁huठ
C:\users\public\desktop\罺⽋i㤅plo
C:\users\public\desktop\dmડi娧⯖`ᡑqn侍˥
C:\users\public\desktop\缅ᜱ粀⁶j`㠆a⊁qk
C:\users\public\desktop\e㢭畕喈塯ᄋu߆q
C:\users\public\desktop\⠞潰呤⬷ᝇaham榀qk
C:\users\public\desktop\hwᶜs⍦ᾲ㠨i⣈扜o羭珴
C:\users\public\desktop\檮gj绋l
C:\users\public\desktop\㝲䷙k`n
C:\users\public\desktop\rv∥eṿq嫋ܻ玈y忋j䒃u
C:\users\public\desktop\䕊櫸uuyx
C:\users\public\desktop\`s⭘䅹jn畖⎖hxqw滉
C:\users\public\desktop\k䛛p悑㟑⢒ធm皓p
C:\users\public\desktop\o渾⌣i耮`vj耥
C:\users\public\desktop\ᤜyo桷劎簙vy
C:\users\public\desktop\悪n`ἦjdtj
C:\users\public\desktop\kvㄸ䏙d
C:\users\public\desktop\bkjoleb婘q捍
C:\users\public\desktop\seud⩼姬⨞q箻κd䔣
C:\users\public\desktop\u⹐gwᛕ䍅q᭓ve懮
C:\users\public\desktop\瓈t⩠涎c䝾⥛jw
C:\users\public\desktop\cÐÒw施p櫴窥
C:\users\public\desktop\e嬀phey䬠௿efࡆrf
C:\users\public\desktop\ⓢs楱brh`q⟺rva䞾䖻
C:\users\public\desktop\⡍眉g箾fp敕j愧mꮥ
C:\users\public\desktop\䷉r潄mn䲌⎓i㔲r
C:\users\public\desktop\v嫈ㅱ敬o⨮v
C:\users\public\desktop\qsr᪼٧h
C:\users\public\desktop\`㊚椆⽵㞜rkfl⤺q
C:\users\public\desktop\ev噂s堕w
C:\users\public\desktop\䃱puh䥳i濇rxơ拿
C:\users\public\desktop\ьgd₭s琭䥺kcl崃x噐
C:\users\public\desktop\pjsi䵬⾷㙲㩳gi⠖g८
C:\users\public\desktop\䜛f砠᧨ၗtl稒a
C:\users\public\desktop\叙bsluߪw
C:\users\public\desktop\䦥生㱪㣜jtiiນ
C:\users\public\desktop\玙xva媕ry浸u
C:\users\public\desktop\⏊tv聠h
C:\users\public\desktop\e她r⢭j➖jq
C:\users\public\desktop\͌㲘vᢼᷣ؃ź尻㾍⫝␀
C:\users\public\desktop\xflw甈⭴bq滖䱊t
C:\users\public\desktop\⃺ቪr᭟d೜r彸䄱䞘
C:\users\public\desktop\䜍kⓤѓ含byw
C:\users\public\desktop\pry䝑؜qጾ嫁㬸jeki᡼
C:\users\public\desktop\㱗aym樞೰w炽xq恝
C:\users\public\desktop\la㑾ab䂷r洺筑耜䭨
C:\users\public\desktop\q`pώ搴㵝繰㱀扃pys
C:\users\public\desktop\nnl箑pⓕ
C:\users\public\desktop\瓝࣡vfthjfጻm焸
C:\users\public\desktop\䗰㥖㙣䑆`p⊙ᠢ䈦摰哱
C:\users\public\desktop\嫌║t于s䇲w
C:\users\public\desktop\拏ᅹw磱壨
C:\users\public\desktop\gcsr㮩s熣i筴eb䳋⩊稳
C:\users\public\desktop\r㙂祢hr次㤀ㆨ聋զ竆⌁
C:\users\public\desktop\yo尘a村篭
C:\users\public\desktop\th楫al綤ꮀgswᬼo
C:\users\public\desktop\䎷ry伜p传೉nn俓`gqc
C:\users\public\desktop\c䳣d⢌侷憦晘棍
C:\users\public\desktop\ᄇ亇傢䆑䱮c悪撟wh
C:\users\public\desktop\ڛɶ碁筗n≮岙䥻
C:\users\public\desktop\ɥ籫m湢j塰൶l箒⨼f₺
C:\users\public\desktop\rb晵t䨠皥ffe⁬
C:\users\public\desktop\c噿䣔ÐÂ§g`o
C:\users\public\desktop\r䒢svmℽbwiab儨
C:\users\public\desktop\ʉ噞ẉx樹ღ枒de᳍
C:\users\public\desktop\箳॑嘠䰟ᴂn琗
C:\users\public\desktop\k瞣x窘兟剧ld㟪j䠼w
C:\users\public\desktop\א匢䶨⊂bms羅asxxu
C:\users\public\desktop\m᧬i沩s
C:\users\public\desktop\o੒昄溈e㔄
C:\users\public\desktop\䱎qaqo秾iq僳o歪
C:\users\public\desktop\fq䙗puo䍓kiᛓ塜o懿r
C:\users\public\desktop\xyqႅ姕᫋晚g㒄瞯bujइ
C:\users\public\desktop\hqv㵦䒀t⛚mᐤ擱媴柣ᴾ
C:\users\public\desktop\tr䶂忆ug㠗t㾀
C:\users\public\desktop\⏷vj㩩t➳揰jචj垖`♞
C:\users\public\desktop\rk憌sw
C:\users\public\desktop\殘ka⤯ᖼd䙂⛶m您ৎ俭
C:\users\public\desktop\撸☐⿡ࡀᰉ䛪⡚hro
C:\users\public\desktop\๢ldcag穇១f殃棠h
C:\users\public\desktop\禁hк㮡㙫ὠos姶ᥡ㈹ㄖᓪb
C:\users\public\desktop\䃅s䠝yk䕻o
C:\users\public\desktop\儥娼弄mg屬㾞x䶌恎⎗
C:\users\public\desktop\唻矊䜸u䋬fi⊔k⠢
C:\users\public\desktop\jim⟣⦤晳wbg囻氼p䢘
C:\users\public\desktop\愩h撐慯㿢毗hxc`稽㤶n
C:\users\public\desktop\㓾壮cp慁xbylպ`粘q
C:\users\public\desktop\挎vມb篭p朔封tʉ`
C:\users\public\desktop\kܯጎ᷹r
C:\users\public\desktop\uࢨga䯅㚆loj؃斥঵
C:\users\public\desktop\䨍呑q痡瀰瘧kwxwj፶⯾扚
C:\users\public\desktop\fu``i␓๢ᶈ
C:\users\public\desktop\䇟୨曆rdmk㰧䗴lfj婻j
C:\users\public\desktop\ÐÒxngjnu浡y倝y旃m
C:\users\public\desktop\∞滿奱bsⱆ䊪p㸎afᗞpd
C:\users\public\desktop\績yoqᱶᜢcn㈃䒞矴kᔅu
C:\users\public\desktop\㥈vvqkeeu搹t䃓
C:\users\public\desktop\祄ᐇpyg
C:\users\public\desktop\qqkŉ库m䩏hm烐䶽䟏嚶t
C:\users\public\desktop\tز‼损g䔶dమ㜰滳䵢
C:\users\public\desktop\✌嶒䑖戜㹹帋
C:\users\public\desktop\ln綹朊㏙`攮q᫫嗢ᴅ
C:\users\public\desktop\s矶r判sⲥ
C:\users\public\desktop\傹mw磊啊c紌kj
C:\users\public\desktop\h匤睠櫖gmmhs↪渖l
C:\users\public\desktop\ೌ婎璯gc
C:\users\public\desktop\ydt䬈ꮱu㐽瘩୞᧛㦗mc㫗
C:\users\public\desktop\᝹s䐪䞶`ivbj眴m≒
C:\users\public\desktop\s䄿悾msಳa
C:\users\public\desktop\ᣁчy྾媟g妊⹘ᐗ椂䚍
C:\users\public\desktop\`q㧃ot`೾毗s㳗᳧ジ䃀
C:\users\public\desktop\iஇuṗජvᏹal佊佸
C:\users\public\desktop\㼦t㹶c呙yᖍ含h㗀nm暝澐
C:\users\public\desktop\luh縀ᩝ㬜冿
C:\users\public\desktop\`c⺶櫽g
C:\users\public\desktop\fᵌr㔌畑淵w䓵o᜗k
C:\users\public\desktop\p礤c庩f
C:\users\public\desktop\ᯨ䷙go櫙䭄簧sn
C:\users\public\desktop\皋䵟gidks
C:\users\public\desktop\匬v泺i珇aඳln`jp忔摝
C:\users\public\desktop\snt瑬唚j
C:\users\public\desktop\㽴癤sgjd絳燼ٸـvsg
C:\users\public\desktop\䅒y瞧Ðâꮩᐩmへnϥ妬`
C:\users\public\desktop\id劣ʏ枙kqk
C:\users\public\desktop\vnᲊ䒱ჵ攜r捿楙b⅛eq
C:\users\public\desktop\䙪hᑜpg`
C:\users\public\desktop\fh穪cოqqi志礤rf嫺
C:\users\public\desktop\g篍段₂ंlqheja墧
C:\users\public\desktop\㠯䇬mwqgnf㏺戕jc䙃ᑡ
C:\users\public\desktop\ᰎჰ廫alce㑍uᛤኻkt
C:\users\public\desktop\暂ufᬯdohᩔwq஍w
C:\users\public\desktop\ᚎw扈ឹ滀qt
C:\users\public\desktop\㲉井sg惌j熑e
C:\users\public\desktop\犔qr侄瑤j᩻樝ep`狌co
C:\users\public\desktop\另c尢歫h偄ᾑຂe休r⒱埀
C:\users\public\desktop\䕬玪i嬡h篩ቯഗvh
C:\users\public\desktop\଎叾嶨l滍ހ杧s⎟p
C:\users\public\desktop\wf橯〡j䙠w泹l
C:\users\public\desktop\䳑秥ᭃ㣿uy瑗
C:\users\public\desktop\n抆੪oal
C:\users\public\desktop\wj䬴lh㙺b䠹䶐ⰽ
C:\users\public\desktop\猤䗱㯇ᡭiຸ爙䔋kpkm
C:\users\public\desktop\昧㳞xm巺h⌴k⚷t剻
C:\users\public\desktop\៪yoii⋼cme
C:\users\public\desktop\㋛d㙐⭯i溥抨職䢈j
C:\users\public\desktop\呮涼շb෵䑅n
C:\users\public\desktop\xk⣮峹n㪣tcq
C:\users\public\desktop\nuهd䴑ࡻ寴y⽏t
C:\users\public\desktop\lx旄㍭i
C:\users\public\desktop\㒷ⱕh恵`咛jfk捾㟴
C:\users\public\desktop\ni⹫䢭愙
C:\users\public\desktop\im㖤goy犭
C:\users\public\desktop\爑y⡰ẃg
C:\users\public\desktop\氌耬l⃊o䏑⏴䤬
C:\users\public\desktop\穐`⮆㬔x⤜y摵
%LOCALAPPDATA%\microsoft\windows\actioncentercache\windows-systemtoast-securityandmaintenance_10_0.png
\device\harddiskvolume1\boot\bcd.log
\device\harddiskvolume1\boot\bcd

Sets the 'hidden' attribute to the following files

%WINDIR%\syswow64\winnt32.exe
C:\hello.png
C:\hello.bat

Modifies the following files

%ALLUSERSPROFILE%\microsoft\user account pictures\user-192.png
%ALLUSERSPROFILE%\microsoft\user account pictures\user-32.png
%ALLUSERSPROFILE%\microsoft\user account pictures\user-40.png
%ALLUSERSPROFILE%\microsoft\user account pictures\user-48.png
%ALLUSERSPROFILE%\microsoft\user account pictures\user.png
%ALLUSERSPROFILE%\microsoft\user account pictures\user.bmp
%APPDATA%\microsoft\windows\themes\transcodedwallpaper
%LOCALAPPDATA%\microsoft\windows\explorer\thumbcache_idx.db

Miscellaneous

Searches for the following windows

ClassName: 'RegEdit_RegEdit' WindowName: ''

Executes the following

'%WINDIR%\syswow64\cmd.exe' /c ""C:\hello.bat" "
'%WINDIR%\syswow64\attrib.exe' +s +h C:\hello.png
'%WINDIR%\syswow64\attrib.exe' +s +h C:\hello.bat
'%WINDIR%\syswow64\net.exe' user user death
'%WINDIR%\syswow64\net1.exe' user user death
'%WINDIR%\syswow64\wbem\wmic.exe' useraccount where name='user' rename 'NO ESCAPE'
'%WINDIR%\syswow64\takeown.exe' /f "%ALLUSERSPROFILE%\Microsoft\User Account Pictures" /r /d y
'%WINDIR%\syswow64\xcopy.exe' *.png "%ALLUSERSPROFILE%\Microsoft\User Account Pictures\"
'%WINDIR%\syswow64\xcopy.exe' *.bmp "%ALLUSERSPROFILE%\Microsoft\User Account Pictures\"
'%WINDIR%\syswow64\regedit.exe' /s <SYSTEM32>\hello.reg
'%WINDIR%\syswow64\regedit.exe' -s <SYSTEM32>\hello.reg
'%WINDIR%\syswow64\shutdown.exe' /t 0 /r
'%WINDIR%\syswow64\cmd.exe' /c ""C:\hello.bat" "' (with hidden window)

Attempts to shut down the Windows operating system.

Technologies

Terminology

Training and education

Myths

Technical Information

Curing recommendations

Free trial