Trojan.MulDrop7.47190

Technical Information

To ensure autorun and distribution:

Modifies the following registry keys:

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'StartCatMr' = '"%ProgramFiles%\MOTEX\LanScope Cat MR\Startmr.exe"'

Creates the following services:

[<HKLM>\SYSTEM\ControlSet001\Services\LSPSERVICE_MR] 'ImagePath' = '%ProgramFiles%\MOTEX\LanScope Cat MR\LspSrvAny.exe'
[<HKLM>\SYSTEM\ControlSet001\Services\LSPSERVICE_MR] 'Start' = '00000002'

Malicious functions:

To bypass firewall, removes or modifies the following registry keys:

[<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%WINDIR%\TEMPLSPCATMR\SETMR.exe' = '%WINDIR%\TEMPLSPCATMR\SETMR.exe:*:...
[<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List] '%WINDIR%\TEMPLSPCATMR\SETMR.exe' = '%WINDIR%\TEMPLSPCATMR\SETMR.exe:*:En...

Creates and executes the following:

'%ProgramFiles%\MOTEX\LanScope Cat MR\LspSrvAny.exe' -Install /silent
'%WINDIR%\TEMPLSPCATMR\SETMR.exe' i t

Executes the following:

'<SYSTEM32>\ping.exe' localhost -n 2
'<SYSTEM32>\netsh.exe' firewall add allowedprogram program = "%WINDIR%\TEMPLSPCATMR\Setmr.exe" name = "LanScope Cat" profile = ALL
'<SYSTEM32>\cmd.exe' /c %WINDIR%\TEMPLSPCATMR\_netsh.bat
'<SYSTEM32>\chcp.com' 65001

Modifies file system:

Creates the following files:

%WINDIR%\mru.ini
%WINDIR%\TEMPLSPCATMR\_netsh.bat
%TEMP%\MrInst_Decmp_Utf8.log
%TEMP%\MrInst_Set_Utf8.log

Sets the 'hidden' attribute to the following files:

%WINDIR%\mru.ini

Deletes the following files:

%WINDIR%\TEMPLSPCATMR\_netsh.bat

Moves the following files:

from %WINDIR%\TEMPLSPCATMR\LspcUninst.exe to %ProgramFiles%\MOTEX\LanScope Cat MR\LspcUninst.exe
from %WINDIR%\TEMPLSPCATMR\LspCfm.exe to %ProgramFiles%\MOTEX\LanScope Cat MR\LspCfm.exe
from %WINDIR%\TEMPLSPCATMR\LspDevConf.exe to %ProgramFiles%\MOTEX\LanScope Cat MR\LspDevConf.exe
from %WINDIR%\TEMPLSPCATMR\LspcUninst.exe.manifest to %ProgramFiles%\MOTEX\LanScope Cat MR\LspcUninst.exe.manifest
from %WINDIR%\TEMPLSPCATMR\LspBho64.dll to %ProgramFiles%\MOTEX\LanScope Cat MR\LspBho64.dll
from %WINDIR%\TEMPLSPCATMR\LspBho.dll to %ProgramFiles%\MOTEX\LanScope Cat MR\LspBho.dll
from %WINDIR%\TEMPLSPCATMR\Lspcdw.dll to %ProgramFiles%\MOTEX\LanScope Cat MR\Lspcdw.dll
from %WINDIR%\TEMPLSPCATMR\LspBits.exe to %ProgramFiles%\MOTEX\LanScope Cat MR\LspBits.exe
from %WINDIR%\TEMPLSPCATMR\LspFilter_2k3.sys to %ProgramFiles%\MOTEX\LanScope Cat MR\LspFilter_2k3.sys
from %WINDIR%\TEMPLSPCATMR\LspFilter_2k.sys to %ProgramFiles%\MOTEX\LanScope Cat MR\LspFilter_2k.sys
from %WINDIR%\TEMPLSPCATMR\LspFilter_vista.sys to %ProgramFiles%\MOTEX\LanScope Cat MR\LspFilter_vista.sys
from %WINDIR%\TEMPLSPCATMR\LspFilter_2k3_x64.sys to %ProgramFiles%\MOTEX\LanScope Cat MR\LspFilter_2k3_x64.sys
from %WINDIR%\TEMPLSPCATMR\LspDnD64.dll to %ProgramFiles%\MOTEX\LanScope Cat MR\LspDnD64.dll
from %WINDIR%\TEMPLSPCATMR\LspDnD.dll to %ProgramFiles%\MOTEX\LanScope Cat MR\LspDnD.dll
from %WINDIR%\TEMPLSPCATMR\LspEvmon64.exe to %ProgramFiles%\MOTEX\LanScope Cat MR\LspEvmon64.exe
from %WINDIR%\TEMPLSPCATMR\LspEvMon.exe to %ProgramFiles%\MOTEX\LanScope Cat MR\LspEvMon.exe
from %WINDIR%\TEMPLSPCATMR\DWPD6891_x86.sys to %ProgramFiles%\MOTEX\LanScope Cat MR\DWPD6891_x86.sys
from %WINDIR%\TEMPLSPCATMR\DWCO6891_1607_x64.sys to %ProgramFiles%\MOTEX\LanScope Cat MR\DWCO6891_1607_x64.sys
from %WINDIR%\TEMPLSPCATMR\dsofile.dll to %ProgramFiles%\MOTEX\LanScope Cat MR\dsofile.dll
from %WINDIR%\TEMPLSPCATMR\DWCO6891_x64.sys to %ProgramFiles%\MOTEX\LanScope Cat MR\DWCO6891_x64.sys
from %WINDIR%\TEMPLSPCATMR\DWCO6891_1607_x86.sys to %ProgramFiles%\MOTEX\LanScope Cat MR\DWCO6891_1607_x86.sys
from %TEMP%\TEMPLSPCAT\Startmr.exe to %WINDIR%\TEMPLSPCATMR\Startmr.exe
from %TEMP%\TEMPLSPCAT\spflog.dll to %WINDIR%\TEMPLSPCATMR\spflog.dll
from %WINDIR%\TEMPLSPCATMR\cmr.exe to %ProgramFiles%\MOTEX\LanScope Cat MR\cmr.exe
from %WINDIR%\TEMPLSPCATMR\4THEYESDK6891.dll to %ProgramFiles%\MOTEX\LanScope Cat MR\4THEYESDK6891.dll
from %WINDIR%\TEMPLSPCATMR\DWPD6891_1607_x64.sys to %ProgramFiles%\MOTEX\LanScope Cat MR\DWPD6891_1607_x64.sys
from %WINDIR%\TEMPLSPCATMR\DWFI6891_x86.sys to %ProgramFiles%\MOTEX\LanScope Cat MR\DWFI6891_x86.sys
from %WINDIR%\TEMPLSPCATMR\DWPD6891_x64.sys to %ProgramFiles%\MOTEX\LanScope Cat MR\DWPD6891_x64.sys
from %WINDIR%\TEMPLSPCATMR\DWPD6891_1607_x86.sys to %ProgramFiles%\MOTEX\LanScope Cat MR\DWPD6891_1607_x86.sys
from %WINDIR%\TEMPLSPCATMR\DWFI6891_1607_x64.sys to %ProgramFiles%\MOTEX\LanScope Cat MR\DWFI6891_1607_x64.sys
from %WINDIR%\TEMPLSPCATMR\DWCO6891_x86.sys to %ProgramFiles%\MOTEX\LanScope Cat MR\DWCO6891_x86.sys
from %WINDIR%\TEMPLSPCATMR\DWFI6891_x64.sys to %ProgramFiles%\MOTEX\LanScope Cat MR\DWFI6891_x64.sys
from %WINDIR%\TEMPLSPCATMR\DWFI6891_1607_x86.sys to %ProgramFiles%\MOTEX\LanScope Cat MR\DWFI6891_1607_x86.sys
from %WINDIR%\TEMPLSPCATMR\LspFilter_vista_x64.sys to %ProgramFiles%\MOTEX\LanScope Cat MR\LspFilter_vista_x64.sys
from %WINDIR%\TEMPLSPCATMR\LspWaoicon48.png to %ProgramFiles%\MOTEX\LanScope Cat MR\LspWaoicon48.png
from %WINDIR%\TEMPLSPCATMR\LspWaoGcToMR.json to %ProgramFiles%\MOTEX\LanScope Cat MR\LspWaoGcToMR.json
from %WINDIR%\TEMPLSPCATMR\LspWaoIe.dll to %ProgramFiles%\MOTEX\LanScope Cat MR\LspWaoIe.dll
from %WINDIR%\TEMPLSPCATMR\LspWaoicon64.png to %ProgramFiles%\MOTEX\LanScope Cat MR\LspWaoicon64.png
from %WINDIR%\TEMPLSPCATMR\LspWaoFf.js to %ProgramFiles%\MOTEX\LanScope Cat MR\LspWaoFf.js
from %WINDIR%\TEMPLSPCATMR\LspWaoconfig.cfg to %ProgramFiles%\MOTEX\LanScope Cat MR\LspWaoconfig.cfg
from %WINDIR%\TEMPLSPCATMR\LspWaoGcToMR.exe to %ProgramFiles%\MOTEX\LanScope Cat MR\LspWaoGcToMR.exe
from %WINDIR%\TEMPLSPCATMR\LspWaoFf.xul to %ProgramFiles%\MOTEX\LanScope Cat MR\LspWaoFf.xul
from %WINDIR%\TEMPLSPCATMR\LspWeb64.dll to %ProgramFiles%\MOTEX\LanScope Cat MR\LspWeb64.dll
from %WINDIR%\TEMPLSPCATMR\LspWeb.dll to %ProgramFiles%\MOTEX\LanScope Cat MR\LspWeb.dll
from %WINDIR%\TEMPLSPCATMR\Startmr.exe to %ProgramFiles%\MOTEX\LanScope Cat MR\Startmr.exe
from %WINDIR%\TEMPLSPCATMR\spflog.dll to %ProgramFiles%\MOTEX\LanScope Cat MR\spflog.dll
from %WINDIR%\TEMPLSPCATMR\LspWaomanifest.mf to %ProgramFiles%\MOTEX\LanScope Cat MR\LspWaomanifest.mf
from %WINDIR%\TEMPLSPCATMR\LspWaoinstall.rdf to %ProgramFiles%\MOTEX\LanScope Cat MR\LspWaoinstall.rdf
from %WINDIR%\TEMPLSPCATMR\LspWaomozilla.sf to %ProgramFiles%\MOTEX\LanScope Cat MR\LspWaomozilla.sf
from %WINDIR%\TEMPLSPCATMR\LspWaomozilla.rsa to %ProgramFiles%\MOTEX\LanScope Cat MR\LspWaomozilla.rsa
from %WINDIR%\TEMPLSPCATMR\LspWaochrome.manifest to %ProgramFiles%\MOTEX\LanScope Cat MR\LspWaochrome.manifest
from %WINDIR%\TEMPLSPCATMR\LspMLAddin2x64.msi to %ProgramFiles%\MOTEX\LanScope Cat MR\LspMLAddin2x64.msi
from %WINDIR%\TEMPLSPCATMR\LspHook64.dll to %ProgramFiles%\MOTEX\LanScope Cat MR\LspHook64.dll
from %WINDIR%\TEMPLSPCATMR\LspMLAddin4x64.msi to %ProgramFiles%\MOTEX\LanScope Cat MR\LspMLAddin4x64.msi
from %WINDIR%\TEMPLSPCATMR\LspMLAddin2x86.msi to %ProgramFiles%\MOTEX\LanScope Cat MR\LspMLAddin2x86.msi
from %WINDIR%\TEMPLSPCATMR\LspFilter_win7_x64.sys to %ProgramFiles%\MOTEX\LanScope Cat MR\LspFilter_win7_x64.sys
from %WINDIR%\TEMPLSPCATMR\LspFilter_win7.sys to %ProgramFiles%\MOTEX\LanScope Cat MR\LspFilter_win7.sys
from %WINDIR%\TEMPLSPCATMR\LspHook.dll to %ProgramFiles%\MOTEX\LanScope Cat MR\LspHook.dll
from %WINDIR%\TEMPLSPCATMR\LspFilter_xp.sys to %ProgramFiles%\MOTEX\LanScope Cat MR\LspFilter_xp.sys
from %WINDIR%\TEMPLSPCATMR\LspSrvAny.exe to %ProgramFiles%\MOTEX\LanScope Cat MR\LspSrvAny.exe
from %WINDIR%\TEMPLSPCATMR\LspRelay.exe to %ProgramFiles%\MOTEX\LanScope Cat MR\LspRelay.exe
from %WINDIR%\TEMPLSPCATMR\LspUtil.dll to %ProgramFiles%\MOTEX\LanScope Cat MR\LspUtil.dll
from %WINDIR%\TEMPLSPCATMR\LspStop.exe to %ProgramFiles%\MOTEX\LanScope Cat MR\LspStop.exe
from %WINDIR%\TEMPLSPCATMR\LspOffDev.exe to %ProgramFiles%\MOTEX\LanScope Cat MR\LspOffDev.exe
from %WINDIR%\TEMPLSPCATMR\LspMLAddin4x86.msi to %ProgramFiles%\MOTEX\LanScope Cat MR\LspMLAddin4x86.msi
from %WINDIR%\TEMPLSPCATMR\LspQuest.exe to %ProgramFiles%\MOTEX\LanScope Cat MR\LspQuest.exe
from %WINDIR%\TEMPLSPCATMR\LspOffDevq.exe to %ProgramFiles%\MOTEX\LanScope Cat MR\LspOffDevq.exe
from %TEMP%\TEMPLSPCAT\LspcUninst.exe.manifest to %WINDIR%\TEMPLSPCATMR\LspcUninst.exe.manifest
from %TEMP%\TEMPLSPCAT\LspcUninst.exe to %WINDIR%\TEMPLSPCATMR\LspcUninst.exe
from %TEMP%\TEMPLSPCAT\LspDnD.dll to %WINDIR%\TEMPLSPCATMR\LspDnD.dll
from %TEMP%\TEMPLSPCAT\LspDevConf.exe to %WINDIR%\TEMPLSPCATMR\LspDevConf.exe
from %TEMP%\TEMPLSPCAT\LspBits.exe to %WINDIR%\TEMPLSPCATMR\LspBits.exe
from %TEMP%\TEMPLSPCAT\LspBho64.dll to %WINDIR%\TEMPLSPCATMR\LspBho64.dll
from %TEMP%\TEMPLSPCAT\LspCfm.exe to %WINDIR%\TEMPLSPCATMR\LspCfm.exe
from %TEMP%\TEMPLSPCAT\Lspcdw.dll to %WINDIR%\TEMPLSPCATMR\Lspcdw.dll
from %TEMP%\TEMPLSPCAT\LspFilter_2k3_x64.sys to %WINDIR%\TEMPLSPCATMR\LspFilter_2k3_x64.sys
from %TEMP%\TEMPLSPCAT\LspFilter_2k3.sys to %WINDIR%\TEMPLSPCATMR\LspFilter_2k3.sys
from %TEMP%\TEMPLSPCAT\LspFilter_vista_x64.sys to %WINDIR%\TEMPLSPCATMR\LspFilter_vista_x64.sys
from %TEMP%\TEMPLSPCAT\LspFilter_vista.sys to %WINDIR%\TEMPLSPCATMR\LspFilter_vista.sys
from %TEMP%\TEMPLSPCAT\LspEvMon.exe to %WINDIR%\TEMPLSPCATMR\LspEvMon.exe
from %TEMP%\TEMPLSPCAT\LspDnD64.dll to %WINDIR%\TEMPLSPCATMR\LspDnD64.dll
from %TEMP%\TEMPLSPCAT\LspFilter_2k.sys to %WINDIR%\TEMPLSPCATMR\LspFilter_2k.sys
from %TEMP%\TEMPLSPCAT\LspEvmon64.exe to %WINDIR%\TEMPLSPCATMR\LspEvmon64.exe
from %TEMP%\TEMPLSPCAT\LspBho.dll to %WINDIR%\TEMPLSPCATMR\LspBho.dll
from %TEMP%\TEMPLSPCAT\DWCO6891_1607_x86.sys to %WINDIR%\TEMPLSPCATMR\DWCO6891_1607_x86.sys
from %TEMP%\TEMPLSPCAT\DWCO6891_1607_x64.sys to %WINDIR%\TEMPLSPCATMR\DWCO6891_1607_x64.sys
from %TEMP%\TEMPLSPCAT\DWCO6891_x86.sys to %WINDIR%\TEMPLSPCATMR\DWCO6891_x86.sys
from %TEMP%\TEMPLSPCAT\DWCO6891_x64.sys to %WINDIR%\TEMPLSPCATMR\DWCO6891_x64.sys
from %TEMP%\TEMPLSPCAT\4THEYESDK6891.dll to %WINDIR%\TEMPLSPCATMR\4THEYESDK6891.dll
from %TEMP%\TEMPLSPCAT\$ to %WINDIR%\TEMPLSPCATMR\$
from %TEMP%\TEMPLSPCAT\dsofile.dll to %WINDIR%\TEMPLSPCATMR\dsofile.dll
from %TEMP%\TEMPLSPCAT\cmr.exe to %WINDIR%\TEMPLSPCATMR\cmr.exe
from %TEMP%\TEMPLSPCAT\DWPD6891_1607_x86.sys to %WINDIR%\TEMPLSPCATMR\DWPD6891_1607_x86.sys
from %TEMP%\TEMPLSPCAT\DWPD6891_1607_x64.sys to %WINDIR%\TEMPLSPCATMR\DWPD6891_1607_x64.sys
from %TEMP%\TEMPLSPCAT\DWPD6891_x86.sys to %WINDIR%\TEMPLSPCATMR\DWPD6891_x86.sys
from %TEMP%\TEMPLSPCAT\DWPD6891_x64.sys to %WINDIR%\TEMPLSPCATMR\DWPD6891_x64.sys
from %TEMP%\TEMPLSPCAT\DWFI6891_1607_x86.sys to %WINDIR%\TEMPLSPCATMR\DWFI6891_1607_x86.sys
from %TEMP%\TEMPLSPCAT\DWFI6891_1607_x64.sys to %WINDIR%\TEMPLSPCATMR\DWFI6891_1607_x64.sys
from %TEMP%\TEMPLSPCAT\DWFI6891_x86.sys to %WINDIR%\TEMPLSPCATMR\DWFI6891_x86.sys
from %TEMP%\TEMPLSPCAT\DWFI6891_x64.sys to %WINDIR%\TEMPLSPCATMR\DWFI6891_x64.sys
from %TEMP%\TEMPLSPCAT\LspFilter_win7.sys to %WINDIR%\TEMPLSPCATMR\LspFilter_win7.sys
from %TEMP%\TEMPLSPCAT\LspWaoicon64.png to %WINDIR%\TEMPLSPCATMR\LspWaoicon64.png
from %TEMP%\TEMPLSPCAT\LspWaoicon48.png to %WINDIR%\TEMPLSPCATMR\LspWaoicon48.png
from %TEMP%\TEMPLSPCAT\LspWaoinstall.rdf to %WINDIR%\TEMPLSPCATMR\LspWaoinstall.rdf
from %TEMP%\TEMPLSPCAT\LspWaoIe.dll to %WINDIR%\TEMPLSPCATMR\LspWaoIe.dll
from %TEMP%\TEMPLSPCAT\LspWaoFf.xul to %WINDIR%\TEMPLSPCATMR\LspWaoFf.xul
from %TEMP%\TEMPLSPCAT\LspWaoFf.js to %WINDIR%\TEMPLSPCATMR\LspWaoFf.js
from %TEMP%\TEMPLSPCAT\LspWaoGcToMR.json to %WINDIR%\TEMPLSPCATMR\LspWaoGcToMR.json
from %TEMP%\TEMPLSPCAT\LspWaoGcToMR.exe to %WINDIR%\TEMPLSPCATMR\LspWaoGcToMR.exe
from %TEMP%\TEMPLSPCAT\Mr.ini to %WINDIR%\TEMPLSPCATMR\Mr.ini
from %TEMP%\TEMPLSPCAT\LspWeb64.dll to %WINDIR%\TEMPLSPCATMR\LspWeb64.dll
from %TEMP%\TEMPLSPCAT\SETMR.exe to %WINDIR%\TEMPLSPCATMR\SETMR.exe
from %TEMP%\TEMPLSPCAT\Msg to %WINDIR%\TEMPLSPCATMR\Msg
from %TEMP%\TEMPLSPCAT\LspWaomozilla.rsa to %WINDIR%\TEMPLSPCATMR\LspWaomozilla.rsa
from %TEMP%\TEMPLSPCAT\LspWaomanifest.mf to %WINDIR%\TEMPLSPCATMR\LspWaomanifest.mf
from %TEMP%\TEMPLSPCAT\LspWeb.dll to %WINDIR%\TEMPLSPCATMR\LspWeb.dll
from %TEMP%\TEMPLSPCAT\LspWaomozilla.sf to %WINDIR%\TEMPLSPCATMR\LspWaomozilla.sf
from %TEMP%\TEMPLSPCAT\LspWaoconfig.cfg to %WINDIR%\TEMPLSPCATMR\LspWaoconfig.cfg
from %TEMP%\TEMPLSPCAT\LspMLAddin2x86.msi to %WINDIR%\TEMPLSPCATMR\LspMLAddin2x86.msi
from %TEMP%\TEMPLSPCAT\LspMLAddin2x64.msi to %WINDIR%\TEMPLSPCATMR\LspMLAddin2x64.msi
from %TEMP%\TEMPLSPCAT\LspMLAddin4x86.msi to %WINDIR%\TEMPLSPCATMR\LspMLAddin4x86.msi
from %TEMP%\TEMPLSPCAT\LspMLAddin4x64.msi to %WINDIR%\TEMPLSPCATMR\LspMLAddin4x64.msi
from %TEMP%\TEMPLSPCAT\LspFilter_xp.sys to %WINDIR%\TEMPLSPCATMR\LspFilter_xp.sys
from %TEMP%\TEMPLSPCAT\LspFilter_win7_x64.sys to %WINDIR%\TEMPLSPCATMR\LspFilter_win7_x64.sys
from %TEMP%\TEMPLSPCAT\LspHook64.dll to %WINDIR%\TEMPLSPCATMR\LspHook64.dll
from %TEMP%\TEMPLSPCAT\LspHook.dll to %WINDIR%\TEMPLSPCATMR\LspHook.dll
from %TEMP%\TEMPLSPCAT\LspStop.exe to %WINDIR%\TEMPLSPCATMR\LspStop.exe
from %TEMP%\TEMPLSPCAT\LspSrvAny.exe to %WINDIR%\TEMPLSPCATMR\LspSrvAny.exe
from %TEMP%\TEMPLSPCAT\LspWaochrome.manifest to %WINDIR%\TEMPLSPCATMR\LspWaochrome.manifest
from %TEMP%\TEMPLSPCAT\LspUtil.dll to %WINDIR%\TEMPLSPCATMR\LspUtil.dll
from %TEMP%\TEMPLSPCAT\LspOffDevq.exe to %WINDIR%\TEMPLSPCATMR\LspOffDevq.exe
from %TEMP%\TEMPLSPCAT\LspOffDev.exe to %WINDIR%\TEMPLSPCATMR\LspOffDev.exe
from %TEMP%\TEMPLSPCAT\LspRelay.exe to %WINDIR%\TEMPLSPCATMR\LspRelay.exe
from %TEMP%\TEMPLSPCAT\LspQuest.exe to %WINDIR%\TEMPLSPCATMR\LspQuest.exe

Miscellaneous:

Searches for the following windows:

ClassName: 'TMainForm' WindowName: 'LanScope Cat'
ClassName: 'LanScopeCat3 SWITCH USER' WindowName: ''

Tecnologie

Termini

Formazione ed informazione

Falsi miti

Technical Information

Curing recommendations

Free trial