Trojan.MulDrop9.35661

To ensure autorun and distribution

Modifies the following registry keys

[<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'run' = ''
[<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = ''
[<HKLM>\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] 'shell' = 'Explorer.exe '
[<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'run' = '%WINDIR%\CcVDU\Vkhebx.exe'
[<HKCU>\Software\Microsoft\Windows NT\CurrentVersion\Windows] 'load' = '%WINDIR%\CcVDU\Vkhebx.exe'
[<HKLM>\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] 'shell' = 'Explorer.exe %WINDIR%\CcVDU\Vkhebx.exe'

Creates or modifies the following files

Creates the following services

[<HKLM>\System\CurrentControlSet\Services\PolicyAgent] 'Start' = '00000002'
[<HKLM>\System\CurrentControlSet\Services\Application Layre Gateway Saervice] 'ImagePath' = 'cmd.exe /c start %WINDIR%\boy.exe'

Malicious functions

Searches for windows to

detect analytical utilities:

ClassName: 'OLLYDBG', WindowName: ''
ClassName: 'GBDYLLO', WindowName: ''
ClassName: 'pediy06', WindowName: ''
ClassName: 'FilemonClass', WindowName: ''
ClassName: '', WindowName: 'File Monitor - Sysinternals: www.sysinternals.com'
ClassName: 'PROCMON_WINDOW_CLASS', WindowName: ''
ClassName: '', WindowName: 'Process Monitor - Sysinternals: www.sysinternals.com'
ClassName: 'RegmonClass', WindowName: ''
ClassName: '', WindowName: 'Registry Monitor - Sysinternals: www.sysinternals.com'

Modifies file system

Creates the following files

Deletes the following files

Deletes itself.

Network activity

UDP

Miscellaneous

Searches for the following windows

Creates and executes the following

'%WINDIR%\ccvdu\vkhebx.exe'
'<SYSTEM32>\cmd.exe' /c del "<Full path to file>"' (with hidden window)
'<SYSTEM32>\cmd.exe' /c ""%WINDIR%\end.bat" "' (with hidden window)
'<SYSTEM32>\sc.exe' Create "Application Layre Gateway Saervice" type= own type= interact start= demand DisplayName= "Can not be deledted" binPath= "cmd.exe /c start "%WINDIR%\boy.exe"' (with hidden window)
'<SYSTEM32>\cmd.exe' /c ""%WINDIR%\CcVDU\qdx.bat" "' (with hidden window)

Executes the following

'<SYSTEM32>\cmd.exe' /c del "<Full path to file>"
'<SYSTEM32>\cmd.exe' /c ""%WINDIR%\end.bat" "
'<SYSTEM32>\netsh.exe' ipsec static add policy name=ipsec_ply
'<SYSTEM32>\netsh.exe' ipsec static add filterlist name=deny_pt
'<SYSTEM32>\netsh.exe' ipsec static add filterlist name=allow_pt
'<SYSTEM32>\netsh.exe' ipsec static add filter filterlist=deny_pt srcaddr=any dstaddr=ME dstport=445 protocol=TCP
'<SYSTEM32>\netsh.exe' ipsec static add filter filterlist=deny_pt srcaddr=any dstaddr=ME dstport=139 protocol=TCP
'<SYSTEM32>\netsh.exe' ipsec static add filteraction name=deny action=block
'<SYSTEM32>\netsh.exe' ipsec static add filteraction name=allow action=negotiate
'<SYSTEM32>\netsh.exe' ipsec static add rule name=deny policy=ipsec_ply filterlist=deny_pt filteraction=deny
'<SYSTEM32>\netsh.exe' ipsec static add rule name=allow policy=ipsec_ply filterlist=allow_pt filteraction=allow psk="(@=P#$bV4$"
'<SYSTEM32>\netsh.exe' ipsec static set policy name=ipsec_ply assign=y
'<SYSTEM32>\sc.exe' Create "Application Layre Gateway Saervice" type= own type= interact start= demand DisplayName= "Can not be deledted" binPath= "cmd.exe /c start "%WINDIR%\boy.exe"
'<SYSTEM32>\cmd.exe' /c ""%WINDIR%\CcVDU\qdx.bat" "
'<SYSTEM32>\schtasks.exe' /create /TN "\Microsoft\Windows\UPnP\Services" /RU SYSTEM /TR "%WINDIR%\CcVDU\Vkhebx.exe" /SC ONSTART