Trojan.MulDrop38.28995

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'WindowsSecurityHealth' = '%APPDATA%\Microsoft\Windows\SecurityHealthService.exe'

Modifies file system

Creates the following files

%APPDATA%\microsoft\windows\securityhealthservice.exe
%TEMP%\ld_1781584036325.db
%TEMP%\ffck_1781584038957.db
%TEMP%\ffck_1781584038957.db-shm

Deletes following files that it created itself

%TEMP%\ld_1781584036325.db
%TEMP%\ffck_1781584038957.db-shm
%TEMP%\ffck_1781584038957.db

Network activity

Connects to

'localhost':8000

Miscellaneous

Executes the following

'<SYSTEM32>\wbem\wmic.exe' bios get serialnumber
'<SYSTEM32>\wbem\wmic.exe' process get ProcessId
'<SYSTEM32>\wbem\wmic.exe' path AntivirusProduct get displayName /format:csv
'<SYSTEM32>\netsh.exe' wlan show profiles
'<SYSTEM32>\cmd.exe' /C dir %HOMEPATH%\Documents\*.rdp "/s /b"
'<SYSTEM32>\cmd.exe' /C cmdkey /list
'<SYSTEM32>\cmdkey.exe' /list
'<SYSTEM32>\cmd.exe' /C dir %HOMEPATH%\Documents\**\*.txt "/s /b /a-d"
'<SYSTEM32>\cmd.exe' /C dir %HOMEPATH%\Documents\**\*.doc "/s /b /a-d"
'<SYSTEM32>\cmd.exe' /C dir %HOMEPATH%\Documents\**\*.docx "/s /b /a-d"
'<SYSTEM32>\cmd.exe' /C dir %HOMEPATH%\Documents\**\*.xls "/s /b /a-d"
'<SYSTEM32>\cmd.exe' /C dir %HOMEPATH%\Documents\**\*.xlsx "/s /b /a-d"
'<SYSTEM32>\cmd.exe' /C dir %HOMEPATH%\Documents\**\*.pdf "/s /b /a-d"
'<SYSTEM32>\cmd.exe' /C dir %HOMEPATH%\Documents\**\*.ppt "/s /b /a-d"
'<SYSTEM32>\cmd.exe' /C dir %HOMEPATH%\Documents\**\*.pptx "/s /b /a-d"
'<SYSTEM32>\cmd.exe' /C dir %HOMEPATH%\Documents\**\*.odt "/s /b /a-d"
'<SYSTEM32>\cmd.exe' /C dir %HOMEPATH%\Documents\**\*.csv "/s /b /a-d"
'<SYSTEM32>\cmd.exe' /C dir %HOMEPATH%\Documents\**\*.xml "/s /b /a-d"
'<SYSTEM32>\cmd.exe' /C dir %HOMEPATH%\Documents\**\*.json "/s /b /a-d"
'<SYSTEM32>\cmd.exe' /C dir %HOMEPATH%\Documents\**\*.key "/s /b /a-d"
'<SYSTEM32>\cmd.exe' /C dir %HOMEPATH%\Documents\**\*.kdbx "/s /b /a-d"
'<SYSTEM32>\cmd.exe' /C dir %HOMEPATH%\Documents\**\*.ovpn "/s /b /a-d"
'<SYSTEM32>\cmd.exe' /C dir %HOMEPATH%\Desktop\**\*.txt "/s /b /a-d"
'<SYSTEM32>\cmd.exe' /C dir %HOMEPATH%\Desktop\**\*.doc "/s /b /a-d"
'<SYSTEM32>\cmd.exe' /C dir %HOMEPATH%\Desktop\**\*.docx "/s /b /a-d"
'<SYSTEM32>\cmd.exe' /C dir %HOMEPATH%\Desktop\**\*.xls "/s /b /a-d"
'<SYSTEM32>\cmd.exe' /C dir %HOMEPATH%\Desktop\**\*.xlsx "/s /b /a-d"
'<SYSTEM32>\cmd.exe' /C dir %HOMEPATH%\Desktop\**\*.pdf "/s /b /a-d"
'<SYSTEM32>\cmd.exe' /C dir %HOMEPATH%\Desktop\**\*.ppt "/s /b /a-d"
'<SYSTEM32>\cmd.exe' /C dir %HOMEPATH%\Desktop\**\*.pptx "/s /b /a-d"
'<SYSTEM32>\cmd.exe' /C dir %HOMEPATH%\Desktop\**\*.odt "/s /b /a-d"
'<SYSTEM32>\cmd.exe' /C dir %HOMEPATH%\Desktop\**\*.csv "/s /b /a-d"
'<SYSTEM32>\cmd.exe' /C dir %HOMEPATH%\Desktop\**\*.xml "/s /b /a-d"
'<SYSTEM32>\cmd.exe' /C dir %HOMEPATH%\Desktop\**\*.json "/s /b /a-d"
'<SYSTEM32>\cmd.exe' /C dir %HOMEPATH%\Desktop\**\*.key "/s /b /a-d"
'<SYSTEM32>\cmd.exe' /C dir %HOMEPATH%\Desktop\**\*.kdbx "/s /b /a-d"
'<SYSTEM32>\cmd.exe' /C dir %HOMEPATH%\Desktop\**\*.ovpn "/s /b /a-d"
'<SYSTEM32>\wbem\wmic.exe' bios get serialnumber' (with hidden window)
'<SYSTEM32>\wbem\wmic.exe' process get ProcessId' (with hidden window)
'<SYSTEM32>\wbem\wmic.exe' path AntivirusProduct get displayName /format:csv' (with hidden window)
'<SYSTEM32>\netsh.exe' wlan show profiles' (with hidden window)
'<SYSTEM32>\cmd.exe' /C dir %HOMEPATH%\Documents\*.rdp "/s /b"' (with hidden window)
'<SYSTEM32>\cmd.exe' /C cmdkey /list' (with hidden window)
'<SYSTEM32>\cmd.exe' /C dir %HOMEPATH%\Documents\**\*.txt "/s /b /a-d"' (with hidden window)
'<SYSTEM32>\cmd.exe' /C dir %HOMEPATH%\Documents\**\*.doc "/s /b /a-d"' (with hidden window)
'<SYSTEM32>\cmd.exe' /C dir %HOMEPATH%\Documents\**\*.docx "/s /b /a-d"' (with hidden window)
'<SYSTEM32>\cmd.exe' /C dir %HOMEPATH%\Documents\**\*.xls "/s /b /a-d"' (with hidden window)
'<SYSTEM32>\cmd.exe' /C dir %HOMEPATH%\Documents\**\*.xlsx "/s /b /a-d"' (with hidden window)
'<SYSTEM32>\cmd.exe' /C dir %HOMEPATH%\Documents\**\*.pdf "/s /b /a-d"' (with hidden window)
'<SYSTEM32>\cmd.exe' /C dir %HOMEPATH%\Documents\**\*.ppt "/s /b /a-d"' (with hidden window)
'<SYSTEM32>\cmd.exe' /C dir %HOMEPATH%\Documents\**\*.pptx "/s /b /a-d"' (with hidden window)
'<SYSTEM32>\cmd.exe' /C dir %HOMEPATH%\Documents\**\*.odt "/s /b /a-d"' (with hidden window)
'<SYSTEM32>\cmd.exe' /C dir %HOMEPATH%\Documents\**\*.csv "/s /b /a-d"' (with hidden window)
'<SYSTEM32>\cmd.exe' /C dir %HOMEPATH%\Documents\**\*.xml "/s /b /a-d"' (with hidden window)
'<SYSTEM32>\cmd.exe' /C dir %HOMEPATH%\Documents\**\*.json "/s /b /a-d"' (with hidden window)
'<SYSTEM32>\cmd.exe' /C dir %HOMEPATH%\Documents\**\*.key "/s /b /a-d"' (with hidden window)
'<SYSTEM32>\cmd.exe' /C dir %HOMEPATH%\Documents\**\*.kdbx "/s /b /a-d"' (with hidden window)
'<SYSTEM32>\cmd.exe' /C dir %HOMEPATH%\Documents\**\*.ovpn "/s /b /a-d"' (with hidden window)
'<SYSTEM32>\cmd.exe' /C dir %HOMEPATH%\Desktop\**\*.txt "/s /b /a-d"' (with hidden window)
'<SYSTEM32>\cmd.exe' /C dir %HOMEPATH%\Desktop\**\*.doc "/s /b /a-d"' (with hidden window)
'<SYSTEM32>\cmd.exe' /C dir %HOMEPATH%\Desktop\**\*.docx "/s /b /a-d"' (with hidden window)
'<SYSTEM32>\cmd.exe' /C dir %HOMEPATH%\Desktop\**\*.xls "/s /b /a-d"' (with hidden window)
'<SYSTEM32>\cmd.exe' /C dir %HOMEPATH%\Desktop\**\*.xlsx "/s /b /a-d"' (with hidden window)
'<SYSTEM32>\cmd.exe' /C dir %HOMEPATH%\Desktop\**\*.pdf "/s /b /a-d"' (with hidden window)
'<SYSTEM32>\cmd.exe' /C dir %HOMEPATH%\Desktop\**\*.ppt "/s /b /a-d"' (with hidden window)
'<SYSTEM32>\cmd.exe' /C dir %HOMEPATH%\Desktop\**\*.pptx "/s /b /a-d"' (with hidden window)
'<SYSTEM32>\cmd.exe' /C dir %HOMEPATH%\Desktop\**\*.odt "/s /b /a-d"' (with hidden window)
'<SYSTEM32>\cmd.exe' /C dir %HOMEPATH%\Desktop\**\*.csv "/s /b /a-d"' (with hidden window)
'<SYSTEM32>\cmd.exe' /C dir %HOMEPATH%\Desktop\**\*.xml "/s /b /a-d"' (with hidden window)
'<SYSTEM32>\cmd.exe' /C dir %HOMEPATH%\Desktop\**\*.json "/s /b /a-d"' (with hidden window)
'<SYSTEM32>\cmd.exe' /C dir %HOMEPATH%\Desktop\**\*.key "/s /b /a-d"' (with hidden window)
'<SYSTEM32>\cmd.exe' /C dir %HOMEPATH%\Desktop\**\*.kdbx "/s /b /a-d"' (with hidden window)
'<SYSTEM32>\cmd.exe' /C dir %HOMEPATH%\Desktop\**\*.ovpn "/s /b /a-d"' (with hidden window)