Trojan.MulDrop13.2813

Technical Information

Modifies file system

Creates the following files

%TEMP%\7za.dll
%LOCALAPPDATA%\theworld6\user data\default\shortcuts
%LOCALAPPDATA%\theworld6\user data\default\secure preferences
%LOCALAPPDATA%\theworld6\user data\default\quotamanager
%LOCALAPPDATA%\theworld6\user data\default\preferences
%LOCALAPPDATA%\theworld6\user data\default\history
%LOCALAPPDATA%\theworld6\user data\default\bookmarks
%LOCALAPPDATA%\tencent\qqbrowser\user data\default\web data
%LOCALAPPDATA%\tencent\qqbrowser\user data\default\top sites
%LOCALAPPDATA%\tencent\qqbrowser\user data\default\shortcuts
%LOCALAPPDATA%\tencent\qqbrowser\user data\default\secure preferences
%LOCALAPPDATA%\theworld6\user data\default\top sites
%LOCALAPPDATA%\tencent\qqbrowser\user data\default\preferences
%LOCALAPPDATA%\tencent\qqbrowser\user data\default\bookmarks
%LOCALAPPDATA%\google\chrome\user data\default\bookmarks
%LOCALAPPDATA%\360chrome\chrome\user data\default\local storage\leveldb\manifest-000001
%LOCALAPPDATA%\360chrome\chrome\user data\default\local storage\leveldb\log.old
%LOCALAPPDATA%\360chrome\chrome\user data\default\local storage\leveldb\log
%LOCALAPPDATA%\360chrome\chrome\user data\default\local storage\leveldb\current
%LOCALAPPDATA%\360chrome\chrome\user data\default\local storage\leveldb\000012.ldb
%LOCALAPPDATA%\360chrome\chrome\user data\default\local storage\leveldb\000011.log
%LOCALAPPDATA%\360chrome\chrome\user data\default\local storage\leveldb\000009.ldb
%LOCALAPPDATA%\360chrome\chrome\user data\default\local storage\leveldb\000007.ldb
%LOCALAPPDATA%\tencent\qqbrowser\user data\default\config bookmarks
%LOCALAPPDATA%\liebao\user data\default\quotamanager
%HOMEPATH%\favorites\links\Г ГЇГЈВ«Г¬ГІВ№Г№ГГё.url
%LOCALAPPDATA%\ucbrowser\user data\default\bookmarks
%HOMEPATH%\favorites\links\ГГёГ¶В·ВµВјВєВЅ.url
%HOMEPATH%\favorites\links\В°Г№В¶ГЁГ«Г±Г«Г·.url
%HOMEPATH%\favorites\links\ГЁГЁВµГЈГ°ГўГ®ГҐ.url
%HOMEPATH%\favorites\links\ГіГ®ГЇВ·ГіГ©Г Г¶.url
%HOMEPATH%\favorites\links\Г¬ГґВ±В¦ГГё.url
%HOMEPATH%\favorites\links\Г¬Г¬ГЈВЁ.url
%HOMEPATH%\favorites\links\ВѕВ©В¶В«В№ВєГ®ГЇ.url
%TEMP%\nsod9ba.tmp\system.dll
%LOCALAPPDATA%\liebao\user data\default\usertyped
%LOCALAPPDATA%\liebao\user data\default\web data
%LOCALAPPDATA%\360chrome\chrome\user data\default\local storage\leveldb\000005.ldb
%LOCALAPPDATA%\liebao\user data\default\top sites
%LOCALAPPDATA%\liebao\user data\default\preferences
%LOCALAPPDATA%\liebao\user data\default\login data
%LOCALAPPDATA%\liebao\user data\default\bookmarks
%LOCALAPPDATA%\ucbrowser\user data\default\web data.67
%LOCALAPPDATA%\ucbrowser\user data\default\top sites.3
%LOCALAPPDATA%\ucbrowser\user data\default\secure preferences
%LOCALAPPDATA%\ucbrowser\user data\default\retailer
%LOCALAPPDATA%\ucbrowser\user data\default\quotamanager.5
%LOCALAPPDATA%\ucbrowser\user data\default\preferences
%LOCALAPPDATA%\ucbrowser\user data\default\omnibox
%LOCALAPPDATA%\theworld6\user data\default\web data
%LOCALAPPDATA%\ucbrowser\user data\local state
%LOCALAPPDATA%\360chrome\chrome\user data\default\local storage\leveldb\000003.log
%APPDATA%\baidu\baidubrowser\user_data\default\settings\settings.db
%APPDATA%\baidu\baidubrowser\user_data\default\data_misc\data_misc.db
%APPDATA%\baidu\baidubrowser\user_data\default\bookmark\bookmark.db.bak
%APPDATA%\baidu\baidubrowser\user_data\default\bookmark\bookmark.db
%APPDATA%\baidu\baidubrowser\user_data\default\blank_tab\new_tab.db
%APPDATA%\baidu\baidubrowser\user_data\default\ad_block\ad_block.db
%APPDATA%\baidu\baidubrowser\rpt.dat
%APPDATA%\360se6\user data\default\local storage\chrome_newtab_0.localstorage
%APPDATA%\360se6\user data\default\web data
%APPDATA%\360se6\user data\default\top sites
%APPDATA%\360se6\user data\default\quotamanager
%APPDATA%\baidu\baidubrowser\user_data\default\plugin_setting\plugin_setting.db
%APPDATA%\360se6\user data\default\preferences
%APPDATA%\360se6\user data\default\bookmarks
%TEMP%\nsrd544.tmp
%TEMP%\d35f.tmp
%ProgramFiles(x86)%\360\360safe\softmgr\somextrainfo.ini
%ProgramFiles(x86)%\360\360safe\deepscan\speedmem2.hg
%ProgramFiles(x86)%\360\360sd\sl2plugin.db
%ProgramFiles(x86)%\360\360sd\sl2.db
%ProgramFiles(x86)%\360\360safe\ipc\kpuaf.dat
%ProgramFiles(x86)%\360\360safe\360ss2.dat
%TEMP%\360safe.dll
%APPDATA%\360se6\user data\default\history
%APPDATA%\sogouexplorer\favicon\favoricon.db
%LOCALAPPDATA%\360chrome\chrome\user data\default\top sites
%APPDATA%\baidu\baidubrowser\user_data\default\settings\user_setting.db
%LOCALAPPDATA%\360chrome\chrome\user data\default\secure preferences
%LOCALAPPDATA%\360chrome\chrome\user data\default\quotamanager
%LOCALAPPDATA%\360chrome\chrome\user data\default\preferences
%LOCALAPPDATA%\360chrome\chrome\user data\default\history
%LOCALAPPDATA%\360chrome\chrome\user data\default\bookmarks
%LOCALAPPDATA%\2345explorer\user data\default\page_file.dat
%LOCALAPPDATA%\2345explorer\user data\default\web datav3
%LOCALAPPDATA%\2345explorer\user data\default\top sites
%LOCALAPPDATA%\2345explorer\user data\default\secure preferences
%LOCALAPPDATA%\2345explorer\user data\default\preferencesv2
%LOCALAPPDATA%\360chrome\chrome\user data\default\web data
%LOCALAPPDATA%\2345explorer\user data\default\bookmarks
%APPDATA%\sogouexplorer\favorite3mob.dat
%APPDATA%\sogouexplorer\favorite3.dat
%APPDATA%\sogouexplorer\config.xml
%APPDATA%\sogouexplorer\commcfg.xml
%APPDATA%\sogouexplorer\misc.db
%APPDATA%\sogouexplorer\historyurl3.db
%APPDATA%\mozilla\firefox\profiles\default\xulstore.json
%APPDATA%\mozilla\firefox\profiles\default\prefs.js
%APPDATA%\mozilla\firefox\profiles\default\places.sqlite
%APPDATA%\baidu\baidubrowser\user_data\default\suggestion\suggestion.db
%APPDATA%\baidu\baidubrowser\user_data\default\render_info\web_compatability2.db
%HOMEPATH%\favorites\links\В»Г¦Г ГєГГё.url

Deletes the following files

%TEMP%\7za.dll
%TEMP%\360safe.dll
%TEMP%\nsod9ba.tmp\system.dll
%TEMP%\d35f.tmp

Moves the following files

from <Full path to file> to %TEMP%\e821.tmp

Deletes itself.

Miscellaneous

Creates and executes the following

'%TEMP%\7za.dll' x "%TEMP%\360Safe.dll" -o"%ProgramFiles(x86)%\360" -r -y
'%TEMP%\d35f.tmp'
'<Full path to file>' ' (with hidden window)
'%TEMP%\7za.dll' x "%TEMP%\360Safe.dll" -o"%ProgramFiles(x86)%\360" -r -y' (with hidden window)
'<SYSTEM32>\cmd.exe' /C WMIC BIOS get Manufacturer' (with hidden window)
'%TEMP%\d35f.tmp' ' (with hidden window)

Executes the following