Trojan.MulDrop5.21220

Technical Information

Malicious functions:

Creates and executes the following:

'%TEMP%\CmdLineExtInstallerExe.exe'

Searches for windows to

detect analytical utilities:

ClassName: 'FileMonClass' WindowName: 'File Monitor - Sysinternals: www.sysinternals.com'
ClassName: 'File Monitor - Sysinternals: www.sysinternals.com' WindowName: 'FileMonClass'
ClassName: 'PROCMON_WINDOW_CLASS' WindowName: 'Process Monitor - Sysinternals: www.sysinternals.com'
ClassName: 'APIMonitor By Rohitab' WindowName: '(null)'
ClassName: 'OLLYDBG' WindowName: '(null)'
ClassName: 'pediy06' WindowName: '(null)'
ClassName: 'TIdaWindow' WindowName: '(null)'

Modifies file system :

Creates the following files:

<SYSTEM32>\d3d9caps.tmp
%TEMP%\drm_dyndata_7340014.dll
%TEMP%\drm_dialogs.dll
%TEMP%\CmdLineExtInstallerExe.exe
<SYSTEM32>\CmdLineExt.dll
<SYSTEM32>\d3d9caps.dat

Deletes the following files:

<SYSTEM32>\d3d9caps.dat
%TEMP%\CmdLineExtInstallerExe.exe

Moves the following files:

from <SYSTEM32>\d3d9caps.tmp to <SYSTEM32>\d3d9caps.dat

Miscellaneous:

Searches for the following windows:

ClassName: '#32770' WindowName: 'Task Explorer II - by Ntoskrnl'
ClassName: '#32770' WindowName: 'Atiptool'
ClassName: 'ThunderRT6Main' WindowName: 'ApiLogger'
ClassName: 'ApiLogger' WindowName: 'ThunderRT6Main'
ClassName: 'ThunderRT6Main' WindowName: 'SysAnalyzer'
ClassName: 'SysAnalyzer' WindowName: 'ThunderRT6Main'
ClassName: 'ReBarWindow32' WindowName: '(null)'
ClassName: 'ThunderRT6Main' WindowName: 'Pr0t.St0p v1.0'
ClassName: 'ThunderRT6FormDC' WindowName: 'Pr0t.St0p v1.0'
ClassName: '(null)' WindowName: 'APIMonitor By Rohitab'
ClassName: 'ThunderRT6FormDC' WindowName: 'Settings'
ClassName: 'ToolbarWindow32?' WindowName: '(null)'
ClassName: 'Shell_TrayWnd' WindowName: '(null)'
ClassName: 'TApplication' WindowName: '<Virus name>'
ClassName: 'ThunderRT6Main' WindowName: 'SD4 Sucks v0.10 by Joseph Cox'
ClassName: 'ThunderRT6Main' WindowName: 'Process Analyzer - right click on a process to access menu'
ClassName: 'cuteProgressClass' WindowName: '(null)'
ClassName: 'JCDSPY_NT_001' WindowName: 'DriverspyNT v1.20. (c)2001,2002 Collake Software'
ClassName: 'c1' WindowName: 'KaKeeware Application Monitor 1.21'
ClassName: 'c3' WindowName: 'API Functions'
ClassName: 'ToolbarWindow32' WindowName: '(null)'
ClassName: 'SysListView32' WindowName: '(null)'
ClassName: 'TrayNotifyWnd' WindowName: '(null)'
ClassName: 'SysPager' WindowName: '(null)'
ClassName: 'PROCEXPL' WindowName: '(null)'
ClassName: 'sniff_hit' WindowName: 'ThunderRT6Main'
ClassName: 'ThunderRT6Main' WindowName: 'SysAnalyzer Configuration Wizard'
ClassName: 'Process Analyzer - right click on a process to access menu' WindowName: 'ThunderRT6Main'
ClassName: 'ThunderRT6Main' WindowName: 'sniff_hit'
ClassName: 'PEBrowse Professional Interactive' WindowName: 'TMainForm'
ClassName: 'PROCEXPL' WindowName: 'Process Explorer - SysInternals: www.sysinternals.com [CRNJEUFU\%USERNAME%]'
ClassName: 'SysAnalyzer Configuration Wizard' WindowName: 'ThunderRT6Main'
ClassName: 'TMainForm' WindowName: 'PEBrowse Professional Interactive'
ClassName: 'ThunderRT6Main' WindowName: 'SR7.Stop v1.1'
ClassName: 'ThunderRT6FormDC' WindowName: 'SR7.Stop v1.1'
ClassName: 'ThunderRT6Main' WindowName: 'SR7Stop'
ClassName: 'ThunderRT6Main' WindowName: 'SR7.Stop v1.2'
ClassName: '(null)' WindowName: '[ LordPE Dumper Server ]'
ClassName: '[ LordPE Dumper Server ]' WindowName: '(null)'
ClassName: '(null)' WindowName: '[ LordPE Deluxe ] by yoda'
ClassName: '[ LordPE Deluxe ] by yoda' WindowName: '(null)'
ClassName: 'Virtual-CD-Hide' WindowName: 'Virtual-CD-Hide'
ClassName: 'Lbr68' WindowName: '(null)'
ClassName: 'icu_dbg' WindowName: '(null)'
ClassName: '18467-41' WindowName: '(null)'
ClassName: 'SHADOW' WindowName: '(null)'
ClassName: 'ThunderRT6Main' WindowName: 'Anti-Blaxx'
ClassName: '#32770' WindowName: 'Starforce Nightmare'
ClassName: 'kk1' WindowName: '(null)'
ClassName: 'WispWindowClass' WindowName: 'Syser [Ctrl+F12]'
ClassName: '#32770' WindowName: '[ LordPE Deluxe b ] by yoda'
ClassName: 'TApplication' WindowName: 'SafeDisc4 Hider'
ClassName: 'SafeDisc4 Hider' WindowName: 'TApplication'
ClassName: '#32770' WindowName: 'BusTrace Status'
ClassName: 'BusTrace Status' WindowName: '#32770'
ClassName: 'Tsd4hideform' WindowName: 'SafeDisc4 Hider 1.1 ? 2005 SKULL'
ClassName: 'SafeDisc4 Hider 1.1 ? 2005 SKULL' WindowName: 'Tsd4hideform'
ClassName: 'TForm1' WindowName: 'SafeDisc4 Hider 1.0 ? 2005 SKULL'
ClassName: 'SafeDisc4 Hider 1.0 ? 2005 SKULL' WindowName: 'TForm1'
ClassName: 'Fucker of CDROM Protections v0.83 Beta' WindowName: 'TForm1'
ClassName: '[ LordPE RoyalTS ] by yoda' WindowName: '#32770'
ClassName: '#32770' WindowName: 'STARFUCK TOOL'
ClassName: '[ LordPE Deluxe b ] by yoda' WindowName: '#32770'
ClassName: '#32770' WindowName: '[ LordPE RoyalTS ] by yoda'
ClassName: 'Fucker of CDROM Protections v0.81 Beta' WindowName: 'TForm1'
ClassName: 'TForm1' WindowName: 'Fucker of CDROM Protections v0.83 Beta'
ClassName: 'STARFUCK TOOL' WindowName: '#32770'
ClassName: 'TForm1' WindowName: 'Fucker of CDROM Protections v0.81 Beta'

Technologies

Terminology

Training and education

Myths

Technical Information

Curing recommendations

Free trial