Trojan.MulDrop11.18209

Technical Information

Modifies file system

Creates the following files

<Current directory>\d.cab
<Current directory>\$dpx$.tmp\3fd4d8658937064885d2067d8c175721.tmp
<Current directory>\$dpx$.tmp\9d10c2de395eb644a537563ed7858a7b.tmp
<Current directory>\$dpx$.tmp\ef928163a8d6514bb44df88e5f539a9f.tmp
<Current directory>\$dpx$.tmp\14b1c05abbecf349afe657c7f230268b.tmp
<Current directory>\$dpx$.tmp\775fec14456fe7448b5606c041ba4c0c.tmp
<Current directory>\$dpx$.tmp\b71a7f45d7a6d44fae943f9eebed686c.tmp
<Current directory>\$dpx$.tmp\c192d66ce5c0f04290a48ab7247ec00d.tmp
<Current directory>\$dpx$.tmp\24b9680ba07f734f9681f3ff6147d632.tmp
<Current directory>\$dpx$.tmp\97439dc9424ab64697061aaab388f953.tmp
<Current directory>\$dpx$.tmp\f67114fd60d22e4282917d0ddc026c00.tmp
<Current directory>\$dpx$.tmp\3de9f05ae8c49c4dbfa54025a7c26655.tmp
<Current directory>\$dpx$.tmp\162effb1558d2342b108bed65708bfb7.tmp
<Current directory>\$dpx$.tmp\d4039cfe5835e44089592c6af8a363cf.tmp
<Current directory>\$dpx$.tmp\9baafa92a29fcd4699264d21d07acea8.tmp
<Current directory>\$dpx$.tmp\fdf297fe68ad0441877a18c63f3f2d50.tmp
<Current directory>\$dpx$.tmp\44778b57d42c36418363cbba594de8c2.tmp
<Current directory>\$dpx$.tmp\a44db2cbd85a8f45affbb5e362374786.tmp
<Current directory>\$dpx$.tmp\fa388428bbafd041a4599dc550909398.tmp
<Current directory>\$dpx$.tmp\c720dda5a04a264ba6f0d63b39a2d929.tmp
<Current directory>\$dpx$.tmp\9fa99ae48de77e49899adbdc42a89f10.tmp
<Current directory>\$dpx$.tmp\9ef0ed96614a8944b2d6f70a66a278af.tmp
<Current directory>\$dpx$.tmp\79320fb91dd52046beafd4f76275de9e.tmp
<Current directory>\$dpx$.tmp\06fd39ec52c4f742b9a5192822d908bd.tmp
<Current directory>\$dpx$.tmp\f931c9f4df37464e84f0e66926051156.tmp
<Current directory>\$dpx$.tmp\39e6e5aaeb91d2449ea1b2f36f6bea5d.tmp
<Current directory>\$dpx$.tmp\0a78aa68b5287741b2088140044e2b8c.tmp
<Current directory>\$dpx$.tmp\f3d3562da5eab0439e8fbc2c96e716c4.tmp
<Current directory>\$dpx$.tmp\a3c9281a7fd3234a8732cf07a360e1cd.tmp
<Current directory>\$dpx$.tmp\b1304e9f1261a742a68377aa2d22d173.tmp
<Current directory>\$dpx$.tmp\132cf22bd9db3146a60bfe34f8eb48d1.tmp
<Current directory>\$dpx$.tmp\00715d886a1aaf4c8ea195ac140257c1.tmp
<Current directory>\$dpx$.tmp\4e33dd75bbf2e94d88efbfa3075270e9.tmp
<Current directory>\$dpx$.tmp\aa6407df37cbc442a39c7734bbbe5320.tmp
<Current directory>\$dpx$.tmp\9f572397510163478fb57f03b12739b0.tmp
<Current directory>\$dpx$.tmp\fec2dc33dc0e6c4591373506831f918b.tmp
<Current directory>\$dpx$.tmp\4670d5d6f8a745448200b67a13edf6ec.tmp
<Current directory>\$dpx$.tmp\66e2c5f814fa484fa6897e9268ae4c46.tmp
<Current directory>\$dpx$.tmp\1a4e84d4ca557b44b7354d36b2c5f1e3.tmp
<Current directory>\$dpx$.tmp\e195e06c278bcc41855ce483dcb0911e.tmp
<Current directory>\$dpx$.tmp\b8541d99252bd547a203360a950d0c5d.tmp
<Current directory>\$dpx$.tmp\f7e926986efe2f45a62d79afdf248e40.tmp
<Current directory>\$dpx$.tmp\7b025ff11a792c4786c74d2dfe24cbc7.tmp
<Current directory>\$dpx$.tmp\d0fc22a3da4d354ea8fa945fd3d17389.tmp
<Current directory>\$dpx$.tmp\8265194016db5a4b864d9712c5b4f59b.tmp

Sets the 'hidden' attribute to the following files

<Current directory>\api-ms-win-core-console-l1-1-0.dll
<Current directory>\api-ms-win-crt-conio-l1-1-0.dll
<Current directory>\api-ms-win-crt-convert-l1-1-0.dll
<Current directory>\api-ms-win-crt-environment-l1-1-0.dll
<Current directory>\api-ms-win-crt-filesystem-l1-1-0.dll
<Current directory>\api-ms-win-crt-heap-l1-1-0.dll
<Current directory>\api-ms-win-crt-locale-l1-1-0.dll
<Current directory>\api-ms-win-crt-math-l1-1-0.dll
<Current directory>\api-ms-win-core-timezone-l1-1-0.dll
<Current directory>\api-ms-win-core-util-l1-1-0.dll
<Current directory>\api-ms-win-crt-multibyte-l1-1-0.dll
<Current directory>\api-ms-win-crt-runtime-l1-1-0.dll
<Current directory>\api-ms-win-crt-stdio-l1-1-0.dll
<Current directory>\api-ms-win-crt-string-l1-1-0.dll
<Current directory>\api-ms-win-crt-time-l1-1-0.dll
<Current directory>\api-ms-win-crt-utility-l1-1-0.dll
<Current directory>\msvcp140.dll
<Current directory>\opencl.dll
<Current directory>\api-ms-win-crt-private-l1-1-0.dll
<Current directory>\api-ms-win-crt-process-l1-1-0.dll
<Current directory>\api-ms-win-core-sysinfo-l1-1-0.dll
<Current directory>\api-ms-win-core-synch-l1-2-0.dll
<Current directory>\api-ms-win-core-synch-l1-1-0.dll
<Current directory>\api-ms-win-core-debug-l1-1-0.dll
<Current directory>\api-ms-win-core-errorhandling-l1-1-0.dll
<Current directory>\api-ms-win-core-file-l1-1-0.dll
<Current directory>\api-ms-win-core-file-l1-2-0.dll
<Current directory>\api-ms-win-core-file-l2-1-0.dll
<Current directory>\api-ms-win-core-handle-l1-1-0.dll
<Current directory>\api-ms-win-core-heap-l1-1-0.dll
<Current directory>\api-ms-win-core-interlocked-l1-1-0.dll
<Current directory>\api-ms-win-core-datetime-l1-1-0.dll
<Current directory>\api-ms-win-core-libraryloader-l1-1-0.dll
<Current directory>\api-ms-win-core-memory-l1-1-0.dll
<Current directory>\api-ms-win-core-namedpipe-l1-1-0.dll
<Current directory>\api-ms-win-core-processenvironment-l1-1-0.dll
<Current directory>\api-ms-win-core-processthreads-l1-1-0.dll
<Current directory>\api-ms-win-core-processthreads-l1-1-1.dll
<Current directory>\api-ms-win-core-profile-l1-1-0.dll
<Current directory>\api-ms-win-core-rtlsupport-l1-1-0.dll
<Current directory>\api-ms-win-core-string-l1-1-0.dll
<Current directory>\api-ms-win-core-localization-l1-2-0.dll
<Current directory>\ucrtbase.dll
<Current directory>\vcruntime140.dll

Deletes the following files

<Current directory>\d.cab

Moves the following files

from <Current directory>\$dpx$.tmp\f931c9f4df37464e84f0e66926051156.tmp to <Current directory>\api-ms-win-core-console-l1-1-0.dll
from <Current directory>\$dpx$.tmp\ef928163a8d6514bb44df88e5f539a9f.tmp to <Current directory>\api-ms-win-crt-conio-l1-1-0.dll
from <Current directory>\$dpx$.tmp\14b1c05abbecf349afe657c7f230268b.tmp to <Current directory>\api-ms-win-crt-convert-l1-1-0.dll
from <Current directory>\$dpx$.tmp\775fec14456fe7448b5606c041ba4c0c.tmp to <Current directory>\api-ms-win-crt-environment-l1-1-0.dll
from <Current directory>\$dpx$.tmp\b71a7f45d7a6d44fae943f9eebed686c.tmp to <Current directory>\api-ms-win-crt-filesystem-l1-1-0.dll
from <Current directory>\$dpx$.tmp\c192d66ce5c0f04290a48ab7247ec00d.tmp to <Current directory>\api-ms-win-crt-heap-l1-1-0.dll
from <Current directory>\$dpx$.tmp\24b9680ba07f734f9681f3ff6147d632.tmp to <Current directory>\api-ms-win-crt-locale-l1-1-0.dll
from <Current directory>\$dpx$.tmp\97439dc9424ab64697061aaab388f953.tmp to <Current directory>\api-ms-win-crt-math-l1-1-0.dll
from <Current directory>\$dpx$.tmp\3fd4d8658937064885d2067d8c175721.tmp to <Current directory>\api-ms-win-core-timezone-l1-1-0.dll
from <Current directory>\$dpx$.tmp\9d10c2de395eb644a537563ed7858a7b.tmp to <Current directory>\api-ms-win-core-util-l1-1-0.dll
from <Current directory>\$dpx$.tmp\f67114fd60d22e4282917d0ddc026c00.tmp to <Current directory>\api-ms-win-crt-multibyte-l1-1-0.dll
from <Current directory>\$dpx$.tmp\d4039cfe5835e44089592c6af8a363cf.tmp to <Current directory>\api-ms-win-crt-runtime-l1-1-0.dll
from <Current directory>\$dpx$.tmp\9baafa92a29fcd4699264d21d07acea8.tmp to <Current directory>\api-ms-win-crt-stdio-l1-1-0.dll
from <Current directory>\$dpx$.tmp\fdf297fe68ad0441877a18c63f3f2d50.tmp to <Current directory>\api-ms-win-crt-string-l1-1-0.dll
from <Current directory>\$dpx$.tmp\44778b57d42c36418363cbba594de8c2.tmp to <Current directory>\api-ms-win-crt-time-l1-1-0.dll
from <Current directory>\$dpx$.tmp\a44db2cbd85a8f45affbb5e362374786.tmp to <Current directory>\api-ms-win-crt-utility-l1-1-0.dll
from <Current directory>\$dpx$.tmp\fa388428bbafd041a4599dc550909398.tmp to <Current directory>\msvcp140.dll
from <Current directory>\$dpx$.tmp\c720dda5a04a264ba6f0d63b39a2d929.tmp to <Current directory>\opencl.dll
from <Current directory>\$dpx$.tmp\3de9f05ae8c49c4dbfa54025a7c26655.tmp to <Current directory>\api-ms-win-crt-private-l1-1-0.dll
from <Current directory>\$dpx$.tmp\162effb1558d2342b108bed65708bfb7.tmp to <Current directory>\api-ms-win-crt-process-l1-1-0.dll
from <Current directory>\$dpx$.tmp\9fa99ae48de77e49899adbdc42a89f10.tmp to <Current directory>\api-ms-win-core-sysinfo-l1-1-0.dll
from <Current directory>\$dpx$.tmp\79320fb91dd52046beafd4f76275de9e.tmp to <Current directory>\api-ms-win-core-synch-l1-2-0.dll
from <Current directory>\$dpx$.tmp\d0fc22a3da4d354ea8fa945fd3d17389.tmp to <Current directory>\api-ms-win-core-synch-l1-1-0.dll
from <Current directory>\$dpx$.tmp\0a78aa68b5287741b2088140044e2b8c.tmp to <Current directory>\api-ms-win-core-debug-l1-1-0.dll
from <Current directory>\$dpx$.tmp\f3d3562da5eab0439e8fbc2c96e716c4.tmp to <Current directory>\api-ms-win-core-errorhandling-l1-1-0.dll
from <Current directory>\$dpx$.tmp\a3c9281a7fd3234a8732cf07a360e1cd.tmp to <Current directory>\api-ms-win-core-file-l1-1-0.dll
from <Current directory>\$dpx$.tmp\b1304e9f1261a742a68377aa2d22d173.tmp to <Current directory>\api-ms-win-core-file-l1-2-0.dll
from <Current directory>\$dpx$.tmp\132cf22bd9db3146a60bfe34f8eb48d1.tmp to <Current directory>\api-ms-win-core-file-l2-1-0.dll
from <Current directory>\$dpx$.tmp\00715d886a1aaf4c8ea195ac140257c1.tmp to <Current directory>\api-ms-win-core-handle-l1-1-0.dll
from <Current directory>\$dpx$.tmp\4e33dd75bbf2e94d88efbfa3075270e9.tmp to <Current directory>\api-ms-win-core-heap-l1-1-0.dll
from <Current directory>\$dpx$.tmp\aa6407df37cbc442a39c7734bbbe5320.tmp to <Current directory>\api-ms-win-core-interlocked-l1-1-0.dll
from <Current directory>\$dpx$.tmp\39e6e5aaeb91d2449ea1b2f36f6bea5d.tmp to <Current directory>\api-ms-win-core-datetime-l1-1-0.dll
from <Current directory>\$dpx$.tmp\9f572397510163478fb57f03b12739b0.tmp to <Current directory>\api-ms-win-core-libraryloader-l1-1-0.dll
from <Current directory>\$dpx$.tmp\4670d5d6f8a745448200b67a13edf6ec.tmp to <Current directory>\api-ms-win-core-memory-l1-1-0.dll
from <Current directory>\$dpx$.tmp\66e2c5f814fa484fa6897e9268ae4c46.tmp to <Current directory>\api-ms-win-core-namedpipe-l1-1-0.dll
from <Current directory>\$dpx$.tmp\1a4e84d4ca557b44b7354d36b2c5f1e3.tmp to <Current directory>\api-ms-win-core-processenvironment-l1-1-0.dll
from <Current directory>\$dpx$.tmp\e195e06c278bcc41855ce483dcb0911e.tmp to <Current directory>\api-ms-win-core-processthreads-l1-1-0.dll
from <Current directory>\$dpx$.tmp\b8541d99252bd547a203360a950d0c5d.tmp to <Current directory>\api-ms-win-core-processthreads-l1-1-1.dll
from <Current directory>\$dpx$.tmp\f7e926986efe2f45a62d79afdf248e40.tmp to <Current directory>\api-ms-win-core-profile-l1-1-0.dll
from <Current directory>\$dpx$.tmp\7b025ff11a792c4786c74d2dfe24cbc7.tmp to <Current directory>\api-ms-win-core-rtlsupport-l1-1-0.dll
from <Current directory>\$dpx$.tmp\06fd39ec52c4f742b9a5192822d908bd.tmp to <Current directory>\api-ms-win-core-string-l1-1-0.dll
from <Current directory>\$dpx$.tmp\fec2dc33dc0e6c4591373506831f918b.tmp to <Current directory>\api-ms-win-core-localization-l1-2-0.dll
from <Current directory>\$dpx$.tmp\9ef0ed96614a8944b2d6f70a66a278af.tmp to <Current directory>\ucrtbase.dll
from <Current directory>\$dpx$.tmp\8265194016db5a4b864d9712c5b4f59b.tmp to <Current directory>\vcruntime140.dll

Network activity

UDP

DNS ASK lp##.beahh.com
DNS ASK lp##.abbny.com
DNS ASK lp##.haqo.net

Miscellaneous

Creates and executes the following

'<SYSTEM32>\cmd.exe' /c expand d.cab -f:* . & del d.cab /a' (with hidden window)

Executes the following

'<SYSTEM32>\cmd.exe' /c expand d.cab -f:* . & del d.cab /a
'<SYSTEM32>\expand.exe' d.cab -f:* .

Технології

Терміни

Навчання

Міфи

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней