Trojan.MulDrop13.59194

Technical Information

To ensure autorun and distribution

Sets the following service settings

[<HKLM>\System\CurrentControlSet\Services\NPF] 'ImagePath' = 'system32\drivers\NPF.sys'
[<HKLM>\SYSTEM\CurrentControlSet\Services\NPF] 'Start' = '00000001'

Creates the following services

'NPF' system32\drivers\NPF.sys

Modifies file system

Creates the following files

%TEMP%\rarsfx0\asmassistant.exe
%ProgramFiles(x86)%\asm\stateportopen.ico
%ProgramFiles(x86)%\asm\msacasscommunicate.dll
%ProgramFiles(x86)%\asm\msacassconfigmgr.dll
%ProgramFiles(x86)%\asm\asmdot1xclientinstall.exe
%ProgramFiles(x86)%\asm\config.ini
%ProgramFiles(x86)%\asm\gdiplus.dll
%ProgramFiles(x86)%\asm\msachttpclient.dll
%WINDIR%\syswow64\npptools.dll
%WINDIR%\syswow64\packet.dll
%WINDIR%\syswow64\wanpacket.dll
%WINDIR%\syswow64\wpcap.dll
%ProgramFiles(x86)%\asm\assistant\msac\msacassconfigmgr.dll
%TEMP%\rarsfx0\msacasslog.dll
%ProgramFiles(x86)%\asm\assistant\msac\msacasscommunicate.dll
%ProgramFiles(x86)%\asm\assistant\msac\msacassregistermgr.dll
%ProgramFiles(x86)%\asm\assistant\msac\msacassshowicon.dll
%ProgramFiles(x86)%\asm\assistant\msac\msacassautocheck.dll
%ProgramFiles(x86)%\asm\assistant\msac\asmassistant.exe
%ProgramFiles(x86)%\asm\assistant\msac\asmassistant.inf
%ProgramFiles(x86)%\asm\assistant\msac\asmassistantload.inf
%ProgramFiles(x86)%\asm\assistant\msac\dbghelp.dll
%ProgramFiles(x86)%\asm\assistant\msac\assfilelist.ini
%ProgramFiles(x86)%\asm\assistant\msac\msacactivex.dll
%ProgramFiles(x86)%\asm\assistant\msac\msacchecksecurityset.dll
%ALLUSERSPROFILE%\ВЎВёВїВЄГЄВјВЎВ№ВІГ«ВµВҐ\ВіГ¬Г°ГІ\Г¶ГµВ¶Г«ГГёГўГ§Г—ВјГЁГ«\Г¦ГґВ¶ВЇГ—ВјГЁГ«ВїГВ»В§В¶Г«.lnk
%ALLUSERSPROFILE%\ВЎВёВїВЄГЄВјВЎВ№ВІГ«ВµВҐ\ВіГ¬Г°ГІ\Г¶ГµВ¶Г«ГГёГўГ§Г—ВјГЁГ«\Г°В¶ГґГёГ—ВјГЁГ«ВїГВ»В§В¶Г«.lnk
%ProgramFiles(x86)%\asm\msacassshowicon.dll
%ProgramFiles(x86)%\asm\stateportclose.ico
%ProgramFiles(x86)%\asm\asmdot1xclient.exe
<DRIVERS>\npf.sys
%TEMP%\rarsfx0\config.ini.bak
%TEMP%\rarsfx0\asmassistantload.inf
%TEMP%\rarsfx0\asmdot1xclient.exe
%TEMP%\rarsfx0\asmdot1xclientinstall.exe
%TEMP%\rarsfx0\assfilelist.ini
%TEMP%\rarsfx0\assinstallconfig.ini
%TEMP%\rarsfx0\config.ini
%TEMP%\rarsfx0\dbghelp.dll
%TEMP%\rarsfx0\gdiplus.dll
%TEMP%\rarsfx0\main.ico
%TEMP%\rarsfx0\msacactivex.dll
%TEMP%\rarsfx0\msacassautocheck.dll
%TEMP%\rarsfx0\msacasscommunicate.dll
%WINDIR%\temp\uddfe4b.tmp
%ProgramFiles(x86)%\asm\assistant\msac\msacasslog.dll
%TEMP%\rarsfx0\msacassconfigmgr.dll
%TEMP%\rarsfx0\msacassshowicon.dll
%TEMP%\rarsfx0\msacchecksecurityset.dll
%TEMP%\rarsfx0\npf_x64.sys
%TEMP%\rarsfx0\npf_x86.sys
%TEMP%\rarsfx0\npptools.dll
%TEMP%\rarsfx0\packet.dll
%TEMP%\rarsfx0\stateportclose.ico
%TEMP%\rarsfx0\stateportopen.ico
%TEMP%\rarsfx0\wanpacket.dll
%TEMP%\rarsfx0\wpcap.dll
%TEMP%\rarsfx0\msachttpclient.dll
%TEMP%\rarsfx0\assinstallconfig.ini.bak
%TEMP%\rarsfx0\asmassistant.inf
%TEMP%\rarsfx0\msacassregistermgr.dll
%ProgramFiles(x86)%\asm\log.txt

Deletes the following files

%WINDIR%\temp\uddfe4b.tmp

Miscellaneous

Searches for the following windows

ClassName: 'EDIT' WindowName: ''
ClassName: '' WindowName: 'Г€Г«ГЌГёГђВЎГ–ГєГЉГ–-Г‰ГВ·ГќГ€ГЏГ–В¤Г“Г«В°ВІГ€В«ВјГ¬ВІГ©'
ClassName: '' WindowName: 'Г€Г«ГЌГёГђВЎГ–ГєГЉГ–-ГЉГ–В¶ВЇГђГћВёВґ'
ClassName: '' WindowName: 'Г€Г«ГЌГёГђВЎГ–ГєГЉГ–-Г—Г”В¶ВЇГђГћВёВґ'
ClassName: '' WindowName: 'Г€Г«ГЌГёГђВЎГ–ГєГЉГ–-В°ВІГ€В«ВјГ¬ВІГ©ВЅГЎВ№Г»'
ClassName: '' WindowName: 'Г€Г«ГЌГёГђВЎГ–ГєГЉГ–-Г‡ВїГ–Г†В°ВІГ€В«ВјГ¬ВІГ©'
ClassName: '' WindowName: 'Г–Г•В¶Г‹ГЌГёГ‚Г§Г—ВјГ€Г« 3.4.0'

Creates and executes the following