Trojan.MulDrop8.32912

Technical Information

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKCU>\Software\VOS\Internet Download Manager\Registry\%CurrentUser%\Software\Microsoft\Windows\CurrentVersion\Run] 'IDMan' = '[#CAMEYO-VAR#]%Program Files%\Internet Download Manager\IDMan.exe...
[<HKCU>\Software\VOS\Internet Download Manager<HKLM>\SOFTWARE\Classes\Applications\WinRAR.exe\shell\open\command] '' = '[#CAMEYO-VAR#]"%Program Files%\WinRAR\WinRAR.exe" "%1"'

Creates the following services:

[<HKCU>\Software\VOS\Internet Download Manager<HKLM>\SYSTEM\ControlSet001\Services\IDMTDI] 'Start' = '00000001'
[<HKCU>\Software\VOS\Internet Download Manager<HKLM>\SYSTEM\ControlSet001\Services\IDMTDI] 'ImagePath' = 'system32\DRIVERS\idmtdi.sys'
[<HKCU>\Software\VOS\Internet Download Manager<HKLM>\SYSTEM\CurrentControlSet\Services\IDMTDI] 'Start' = '00000001'
[<HKCU>\Software\VOS\Internet Download Manager<HKLM>\SYSTEM\CurrentControlSet\Services\IDMTDI] 'ImagePath' = 'system32\DRIVERS\idmtdi.sys'

Modifies file system:

Creates the following files:

%APPDATA%\VOS\Internet Download Manager\VirtApp.ini
%APPDATA%\VOS\Internet Download Manager\PROG\%Common Programs%\Internet Download Manager\IDM Help.lnk
%APPDATA%\VOS\Internet Download Manager\PROG\%Common Programs%\Internet Download Manager\Internet Download Manager.lnk
%APPDATA%\VOS\Internet Download Manager\PROG\%Common Programs%\Internet Download Manager\license.lnk
%APPDATA%\VOS\Internet Download Manager\PROG\%Common Programs%\Internet Download Manager\TUTORIALS.lnk
%APPDATA%\VOS\Internet Download Manager\PROG\%Common Programs%\Internet Download Manager\Uninstall IDM.lnk
%APPDATA%\VOS\Internet Download Manager\PROG\%Program Files%\Internet Download Manager\Microsoft.VC90.CRT\Microsoft.VC90.CRT.manifest
%APPDATA%\VOS\Internet Download Manager\PROG\%Program Files%\Internet Download Manager\Microsoft.VC90.CRT\msvcm90.dll
%APPDATA%\VOS\Internet Download Manager\PROG\%Program Files%\Internet Download Manager\Microsoft.VC90.CRT\msvcp90.dll
%APPDATA%\VOS\Internet Download Manager\PROG\%Program Files%\Internet Download Manager\Microsoft.VC90.CRT\msvcr90.dll
%APPDATA%\VOS\Internet Download Manager\EngineStamps\SandboxCfg.db.20180730-122856.458.stamp
%APPDATA%\VOS\Internet Download Manager\PROG\%Windows%\WinSxs\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.6161_x-ww_31a54e43\msvcm90.dll
%APPDATA%\VOS\Internet Download Manager\PROG\%Windows%\WinSxs\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.6161_x-ww_31a54e43\msvcr90.dll
%APPDATA%\VOS\Internet Download Manager\PROG\Icons\IDMan.exe.ico
%APPDATA%\VOS\Internet Download Manager\PROG\Icons\Uninstall.exe.ico
%APPDATA%\VOS\Internet Download Manager\PROG\Icons\grabber.chm.ico
%APPDATA%\VOS\Internet Download Manager\PROG\Icons\idman.chm.ico
%APPDATA%\VOS\Internet Download Manager\PROG\Icons\license.txt.ico
%APPDATA%\VOS\Internet Download Manager\PROG\Icons\tutor.chm.ico
%APPDATA%\VOS\Internet Download Manager\EngineStamps\DiskModeDeploy.marker
%APPDATA%\VOS\Internet Download Manager\ZipCache
%APPDATA%\VOS\Internet Download Manager\PROG\%Programs%\Internet Download Manager\Uninstall IDM.lnk
%APPDATA%\VOS\Internet Download Manager\PROG\%Common Programs%\Internet Download Manager\Grabber Help.lnk
%APPDATA%\VOS\Internet Download Manager\PROG\%Programs%\Internet Download Manager\TUTORIALS.lnk
%APPDATA%\VOS\Internet Download Manager\PROG\%Programs%\Internet Download Manager\license.lnk
%APPDATA%\VOS\Internet Download Manager\PROG\%Programs%\Internet Download Manager\Internet Download Manager.lnk
%APPDATA%\VOS\Internet Download Manager\EngineStamps\AppVirtDll_Internet Download Manager.dll.20180730-122856.442.stamp
%APPDATA%\VOS\Internet Download Manager\AppVirtDll64_Internet Download Manager.dll
%APPDATA%\VOS\Internet Download Manager\EngineStamps\AppVirtDll64_Internet Download Manager.dll.20180730-122856.442.stamp
%APPDATA%\VOS\Internet Download Manager\Internet Download Manager.exe
%APPDATA%\VOS\Internet Download Manager\EngineStamps\Internet Download Manager.exe.20180730-122856.458.stamp
%APPDATA%\VOS\Internet Download Manager\Internet Download Manager64.exe
%APPDATA%\VOS\Internet Download Manager\EngineStamps\Internet Download Manager64.exe.20180730-122856.458.stamp
%APPDATA%\VOS\Internet Download Manager\VirtFiles.Prog.db
%APPDATA%\VOS\Internet Download Manager\EngineStamps\VirtFiles.Prog.db.20180730-122856.458.stamp
%APPDATA%\VOS\Internet Download Manager\EngineStamps\ZipCache.20180730-122856.458.stamp
%APPDATA%\VOS\Internet Download Manager\PROG\%Windows%\WinSxs\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.6161_x-ww_31a54e43\msvcp90.dll
%APPDATA%\VOS\Internet Download Manager\SandboxCfg.db
%APPDATA%\VOS\Internet Download Manager\EngineStamps\VirtReg.Prog.dat.20180730-122856.458.stamp
%APPDATA%\VOS\Internet Download Manager\CHANGES\VirtFiles.db
%APPDATA%\VOS\Internet Download Manager\CHANGES\VirtReg.dat
%APPDATA%\VOS\Internet Download Manager\CHANGES\VirtReg.Base.dat
%APPDATA%\VOS\Internet Download Manager\CHANGES\VirtFiles.db.2868.tmp
%APPDATA%\VOS\Internet Download Manager\PROG\%AppData%\IDM\idmmzcc5\chrome.manifest
%APPDATA%\VOS\Internet Download Manager\PROG\%Desktop%\Internet Download Manager.lnk
%APPDATA%\VOS\Internet Download Manager\PROG\%Programs%\Internet Download Manager\Grabber Help.lnk
%APPDATA%\VOS\Internet Download Manager\PROG\%Programs%\Internet Download Manager\IDM Help.lnk
%APPDATA%\VOS\Internet Download Manager\AppVirtDll_Internet Download Manager.dll
%APPDATA%\VOS\Internet Download Manager\VirtReg.Prog.dat
%APPDATA%\VOS\Internet Download Manager\CHANGES\CryptCheck.dat