Trojan.MulDrop7.26387

SHA1:

• 2ce5f1de24e5ac0d394ce12919343be2bcf9832f

A multi-purpose backdoor for Microsoft Windows that was distributed in social networks as a free license key for commercial anti-virus products. It is a packed tool called Njrat 0.7 Golden By Hassan Amiri (BackDoor.NJRat.1013). The Trojan contains a keylogger as one of the components.

Once the Trojan is launched, it establishes a connection with the command and control (C&C) server and uploads the following data:

• Serial number of a hard drive;
• Operating system version;
• Operating system bitness;
• Identify the web camera connected to the computer;
• Computer name;
• User name;
• Version of the installed Service Pack;
• Version of the installed anti-virus.

The Trojan can execute the following commands of cybercriminals:

• Replace the Windows Desktop wallpaper;
• Turn off or restart the computer;
• Output a system message with the specified text on the screen;
• Swap the functions of mouse keys;
• Play a specific phrase using a voice synthesizer and speakers;
• Hide and then restore the Windows taskbar;
• Open or close the optical disc drive;
• Turn a display on and off;
• Open the specified link in a browser;
• Read, install or remove the specified value of the system registry;
• Receive a screenshot and send it to the C&C server;
• Download and launch the specified executable file;
• Send data collected by the keylogger to the C&C server;
• Refresh or remove the Trojan’s executable file;

At the command of cybercriminals it can display frightening SWF videos.

News about the Trojan