Trojan.MulDrop2.42884

Technical Information

To ensure autorun and distribution:

Creates the following services:

[<HKLM>\SYSTEM\ControlSet001\Services\rppnxSvcs] 'Start' = '00000002'

Malicious functions:

Creates and executes the following:

%PROGRAM_FILES%\Enesas Solutions\rppnxsvc.exe /INSTALL /SILENT

Executes the following:

%WINDIR%\sleep.exe 5
<SYSTEM32>\cmd.exe /c ""<Current directory>\cls$$$$-.bat" "

Modifies file system :

Creates the following files:

%HOMEPATH%\Favorites\CJON마트.url
%HOMEPATH%\Favorites\G마캣.url
%HOMEPATH%\Favorites\CJON mart.url
%HOMEPATH%\Favorites\CJmall.url
%HOMEPATH%\Favorites\cjon.url
%HOMEPATH%\Favorites\GS샵.url
%HOMEPATH%\Favorites\GSSHOP.url
%HOMEPATH%\Favorites\GS SHOP.url
%HOMEPATH%\Favorites\G마켓.url
%HOMEPATH%\Favorites\gmarket.url
%HOMEPATH%\Favorites\지에스이샵.url
%HOMEPATH%\Favorites\지에스이숍.url
%HOMEPATH%\Favorites\지에스숍.url
%HOMEPATH%\Favorites\지마켓.url
%HOMEPATH%\Favorites\지에스샵.url
%HOMEPATH%\Favorites\cj마트.url
%HOMEPATH%\Favorites\cj쇼핑.url
%HOMEPATH%\Favorites\assacom.url
%HOMEPATH%\Favorites\지에스홈쇼핑.url
%HOMEPATH%\Favorites\AK몰.url
%HOMEPATH%\Favorites\gseshop.url
%HOMEPATH%\Favorites\Links\옥션.url
%WINDIR%\11st_favicon.ico
%WINDIR%\auction_favicon.ico
%WINDIR%\gmarket_favicon.ico
%HOMEPATH%\Favorites\Links\G마켓.url
<Current directory>\cls$$$$-.bat
%PROGRAM_FILES%\Enesas Solutions\rppnxsvc.exe
%ALLUSERSPROFILE%\Desktop\톰파일.lnk
%HOMEPATH%\Favorites\Links\11번가.url
%WINDIR%\tomfile_favicon.ico
%HOMEPATH%\Favorites\NS이숍.url
%HOMEPATH%\Favorites\wlakzpt.url
%HOMEPATH%\Favorites\LG패션샵.url
%HOMEPATH%\Favorites\H몰.url
%HOMEPATH%\Favorites\Hmall.url
%HOMEPATH%\Favorites\티몬.url
%HOMEPATH%\Favorites\쿠팡.url
%HOMEPATH%\Favorites\티켓몬스터.url
%HOMEPATH%\Favorites\YES24.url
%HOMEPATH%\Favorites\플라이워치.url
%HOMEPATH%\Favorites\롯데인터넷면세점.url
%HOMEPATH%\Favorites\롯데홈쇼핑.url
%HOMEPATH%\Favorites\롯데마트인터넷쇼핑몰.url
%HOMEPATH%\Favorites\롯데마트.url
%HOMEPATH%\Favorites\롯데마트쇼핑몰.url
%HOMEPATH%\Favorites\신라인터넷면세점.url
%HOMEPATH%\Favorites\신세계.url
%HOMEPATH%\Favorites\신라면세점.url
%HOMEPATH%\Favorites\면세점.url
%HOMEPATH%\Favorites\명품관.url
%HOMEPATH%\Favorites\1300k.url
%HOMEPATH%\Favorites\가방팝.url
%HOMEPATH%\Favorites\11st.url
%HOMEPATH%\Favorites\11번가.url
%HOMEPATH%\Favorites\11qjsrk.url
%HOMEPATH%\Favorites\더페이스샵.url
%HOMEPATH%\Favorites\디앤샵.url
%HOMEPATH%\Favorites\대출.url
%HOMEPATH%\Favorites\꽃배달.url
%HOMEPATH%\Favorites\농수산홈쇼핑.url
%HOMEPATH%\Favorites\신세계몰.url
%HOMEPATH%\Favorites\우체국쇼핑.url
%HOMEPATH%\Favorites\워커힐면세점.url
%HOMEPATH%\Favorites\옥션.url
%HOMEPATH%\Favorites\예스24.url
%HOMEPATH%\Favorites\예스이십사.url
%HOMEPATH%\Favorites\이마트상품.url
%HOMEPATH%\Favorites\이마트인터넷쇼핑몰.url
%HOMEPATH%\Favorites\이마트.url
%HOMEPATH%\Favorites\원어데이.url
%HOMEPATH%\Favorites\웹하드.url
%HOMEPATH%\Favorites\씨제이오쇼핑.url
%HOMEPATH%\Favorites\씨제이온마트.url
%HOMEPATH%\Favorites\씨제이쇼핑.url
%HOMEPATH%\Favorites\씨제이마트.url
%HOMEPATH%\Favorites\씨제이몰.url
%HOMEPATH%\Favorites\엔조이뉴욕.url
%HOMEPATH%\Favorites\연예인디씨.url
%HOMEPATH%\Favorites\아이스타일24.url
%HOMEPATH%\Favorites\아싸컴.url
%HOMEPATH%\Favorites\아이스타일.url

Sets the 'hidden' attribute to the following files:

%HOMEPATH%\Favorites\지에스이숍.url
%HOMEPATH%\Favorites\지에스홈쇼핑.url
%HOMEPATH%\Favorites\지에스숍.url
%HOMEPATH%\Favorites\지에스이샵.url
%HOMEPATH%\Favorites\cj쇼핑.url
%HOMEPATH%\Favorites\cjon.url
%HOMEPATH%\Favorites\assacom.url
%HOMEPATH%\Favorites\cj마트.url
%HOMEPATH%\Favorites\웹하드.url
%HOMEPATH%\Favorites\이마트.url
%HOMEPATH%\Favorites\워커힐면세점.url
%HOMEPATH%\Favorites\원어데이.url
%HOMEPATH%\Favorites\지마켓.url
%HOMEPATH%\Favorites\지에스샵.url
%HOMEPATH%\Favorites\이마트상품.url
%HOMEPATH%\Favorites\이마트인터넷쇼핑몰.url
%HOMEPATH%\Favorites\CJON mart.url
%HOMEPATH%\Favorites\wlakzpt.url
%HOMEPATH%\Favorites\YES24.url
%HOMEPATH%\Favorites\LG패션샵.url
%HOMEPATH%\Favorites\NS이숍.url
%HOMEPATH%\Favorites\쿠팡.url
<Current directory>\cls$$$$-.bat
%HOMEPATH%\Favorites\플라이워치.url
%HOMEPATH%\Favorites\티몬.url
%HOMEPATH%\Favorites\G마켓.url
%HOMEPATH%\Favorites\gmarket.url
%HOMEPATH%\Favorites\CJON마트.url
%HOMEPATH%\Favorites\G마캣.url
%HOMEPATH%\Favorites\gseshop.url
%HOMEPATH%\Favorites\H몰.url
%HOMEPATH%\Favorites\GS SHOP.url
%HOMEPATH%\Favorites\GS샵.url
%HOMEPATH%\Favorites\롯데마트.url
%HOMEPATH%\Favorites\롯데마트쇼핑몰.url
%HOMEPATH%\Favorites\더페이스샵.url
%HOMEPATH%\Favorites\디앤샵.url
%HOMEPATH%\Favorites\롯데홈쇼핑.url
%HOMEPATH%\Favorites\면세점.url
%HOMEPATH%\Favorites\롯데마트인터넷쇼핑몰.url
%HOMEPATH%\Favorites\롯데인터넷면세점.url
%HOMEPATH%\Favorites\11st.url
%HOMEPATH%\Favorites\1300k.url
%HOMEPATH%\Favorites\11번가.url
%HOMEPATH%\Favorites\11qjsrk.url
%HOMEPATH%\Favorites\농수산홈쇼핑.url
%HOMEPATH%\Favorites\대출.url
%HOMEPATH%\Favorites\가방팝.url
%HOMEPATH%\Favorites\꽃배달.url
%HOMEPATH%\Favorites\명품관.url
%HOMEPATH%\Favorites\아이스타일24.url
%HOMEPATH%\Favorites\연예인디씨.url
%HOMEPATH%\Favorites\아싸컴.url
%HOMEPATH%\Favorites\아이스타일.url
%HOMEPATH%\Favorites\옥션.url
%HOMEPATH%\Favorites\우체국쇼핑.url
%HOMEPATH%\Favorites\예스24.url
%HOMEPATH%\Favorites\예스이십사.url
%HOMEPATH%\Favorites\신세계.url
%HOMEPATH%\Favorites\씨제이마트.url
%HOMEPATH%\Favorites\신라면세점.url
%HOMEPATH%\Favorites\신라인터넷면세점.url
%HOMEPATH%\Favorites\씨제이오쇼핑.url
%HOMEPATH%\Favorites\씨제이온마트.url
%HOMEPATH%\Favorites\씨제이몰.url
%HOMEPATH%\Favorites\씨제이쇼핑.url

Deletes itself.

Tecnologías

Términos

Formación y educación

Mitos

Technical Information

Curing recommendations

Free trial