Trojan.MulDrop8.25290

Technical Information

To ensure autorun and distribution:

Creates or modifies the following files:

%ALLUSERSPROFILE%\Start Menu\Programs\Startup\EVAS Control Console.lnk

Modifies file system:

Creates the following files:

C:\CONSOLE_ROOT_UPDATE_12_3\CONSOLE_12_3.msi
%ProgramFiles%\EVAS\EVAS Control Console\EVAScontrolConsole.mht
%ProgramFiles%\EVAS\EVAS Control Console\Interop.IasHelperLib.dll
%ProgramFiles%\EVAS\EVAS Control Console\EVAS Control Console.exe
%ProgramFiles%\EVAS\EVAS Control Console\EVAS Control Console.exe.config
%ProgramFiles%\EVAS\EVAS Control Console\iKeyBoardCore.dll
%ProgramFiles%\EVAS\EVAS Control Console\EVAS Control Console.mht
%ProgramFiles%\EVAS\EVAS Control Console\Interop.SpeechLib.dll
%ProgramFiles%\EVAS\EVAS Control Console\custom.xml
%ProgramFiles%\EVAS\EVAS Control Console\The EVAS Control Console License Agreement.rtf
%ProgramFiles%\EVAS\EVAS Control Console\The EVAS Control Console License Agreement.mht
%ProgramFiles%\EVAS\EVAS Control Console\The EVAS Control Console License Agreement.doc
%ProgramFiles%\EVAS\EVAS Control Console\Customize.ico
%ProgramFiles%\EVAS\EVAS Control Console\EVAS Control Console.doc
%WINDIR%\Installer\{295DF773-FADE-4680-B1A7-2A21B832D836}\_A939C67D77EFA0BA32C561.exe
%ALLUSERSPROFILE%\Start Menu\Programs\EVAS Utility Programs\The EVAS Control Console License Agreement.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\EVAS Utility Programs\EVAS Control Console.lnk
%ALLUSERSPROFILE%\Desktop\EVAS Control Console.lnk
%ALLUSERSPROFILE%\Start Menu\Programs\EVAS Utility Programs\About The EVAS Control Console.lnk
%WINDIR%\Installer\MSI6.tmp
%ProgramFiles%\EVAS\EVAS Control Console\EVAS Control Console.InstallState
%WINDIR%\Installer\28b23.msi
%WINDIR%\Installer\{295DF773-FADE-4680-B1A7-2A21B832D836}\_6FEFF9B68218417F98F549.exe
%WINDIR%\Installer\{295DF773-FADE-4680-B1A7-2A21B832D836}\_978D96180B5BFEFD537D76.exe
%WINDIR%\Installer\{295DF773-FADE-4680-B1A7-2A21B832D836}\_2500615784883837CB440B.exe
%WINDIR%\Installer\{295DF773-FADE-4680-B1A7-2A21B832D836}\_F405745AD193DE64C4767A.exe
%WINDIR%\Installer\{295DF773-FADE-4680-B1A7-2A21B832D836}\_FA39D36EFA8E977DDE2ECB.exe
%ProgramFiles%\EVAS\EVAS Control Console\Connect.ico
%ProgramFiles%\EVAS\EVAS Control Console\updater.exe
C:\Config.Msi\28b22.rbs
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SECURITY
%WINDIR%\Installer\28b1f.msi
%WINDIR%\Installer\MSI1.tmp
%TEMP%\CFG2.tmp
%WINDIR%\Installer\MSI3.tmp
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-18
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-19
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-19
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-20
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-20
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-21-2052111302-484763869-725345543-1003
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-21-2052111302-484763869-725345543-1003
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_.DEFAULT
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SOFTWARE
%WINDIR%\Installer\MSI4.tmp
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SYSTEM
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SAM
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\ComDb.Dat
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\domain.txt
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\$WinMgmt.CFG
%WINDIR%\Installer\28b21.ipi
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\INDEX.BTR
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\INDEX.MAP
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING.VER
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING1.MAP
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING2.MAP
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\OBJECTS.DATA
C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\OBJECTS.MAP
%WINDIR%\Installer\MSI7.tmp

Deletes the following files:

%WINDIR%\Installer\MSI1.tmp
%WINDIR%\Installer\MSI3.tmp
%WINDIR%\Installer\MSI6.tmp
%WINDIR%\Installer\MSI4.tmp
%WINDIR%\Installer\MSI7.tmp
C:\Config.Msi\28b22.rbs

Miscellaneous:

Executes the following:

'<SYSTEM32>\msiexec.exe' /i "C:\CONSOLE_ROOT_UPDATE_12_3\CONSOLE_12_3.msi" /qb+
'<SYSTEM32>\msiexec.exe' /V
'<SYSTEM32>\msiexec.exe' -Embedding E95127B7D0B6DB0F1BC78581D9B13C18
'<SYSTEM32>\msiexec.exe' -Embedding D0C0867C84038E08A7465EDE9FA45624 M Global\MSI0000