Trojan.MulDrop11.19362

Technical Information

Modifies file system

Creates the following files

<Current directory>\d.cab
<Current directory>\$dpx$.tmp\5843f9d1487d9844be769e3a31ec5073.tmp
<Current directory>\$dpx$.tmp\20503966a8c51f4eb0afa85d94b3d8c3.tmp
<Current directory>\$dpx$.tmp\8430a844db5c24459d53e6e1ed57255c.tmp
<Current directory>\$dpx$.tmp\81fc6cea5cf13242bebd37adf825a8ac.tmp
<Current directory>\$dpx$.tmp\759f48565d2c3640b4b46cce7a3e0c54.tmp
<Current directory>\$dpx$.tmp\d2b94adbcd64eb4d87300391acbb7b72.tmp
<Current directory>\$dpx$.tmp\c6b92968595b1a4087d2a3fff39c82e2.tmp
<Current directory>\$dpx$.tmp\1e6483edbb76ea479510a402d46afa5c.tmp
<Current directory>\$dpx$.tmp\d99278092da66d45bd81cd9eface1da3.tmp
<Current directory>\$dpx$.tmp\400f2e4dcbbcaf4b945764dde3d5f340.tmp
<Current directory>\$dpx$.tmp\3c396b6fe839784bb13e35f263d847bf.tmp
<Current directory>\$dpx$.tmp\91281e6f2ecf674ab542a39bc6a48eba.tmp
<Current directory>\$dpx$.tmp\cdc398eba0ee43428824334e359883a8.tmp
<Current directory>\$dpx$.tmp\9d946ad88a20304aacbe3adfd0323213.tmp
<Current directory>\$dpx$.tmp\ce1ff581b3f28947a8571806b394ed9c.tmp
<Current directory>\$dpx$.tmp\2c5c67f9ae4fb24d94dfac723763cc1a.tmp
<Current directory>\$dpx$.tmp\0ce987f0bda0f04cbcd8585500faefe3.tmp
<Current directory>\$dpx$.tmp\8229780e6da1f34baa85efb4a0c88adf.tmp
<Current directory>\$dpx$.tmp\005913df25c0f64e806200fdbfcc9047.tmp
<Current directory>\$dpx$.tmp\da5f1e62cf75b7458d4123b775246dd0.tmp
<Current directory>\$dpx$.tmp\0d268d030c2ee64ca41f0bd9a540cdea.tmp
<Current directory>\$dpx$.tmp\1509197c65e3914b933b8f0690e6b007.tmp
<Current directory>\$dpx$.tmp\994d0005defdc649a9615946a3190c37.tmp
<Current directory>\$dpx$.tmp\e6584b665532074eb8c84c3aba876d37.tmp
<Current directory>\$dpx$.tmp\9882db8da3e18a4c9897feb500c2f7a8.tmp
<Current directory>\$dpx$.tmp\bbc6d897a1ff3d41b37123d5ada5033e.tmp
<Current directory>\$dpx$.tmp\08ca9e68856c8240b9b2e759b042c139.tmp
<Current directory>\$dpx$.tmp\1ca88e2b3a8dde45bb644823251f1edb.tmp
<Current directory>\$dpx$.tmp\48ff20c1aeb1bb458f8920eb3997fac1.tmp
<Current directory>\$dpx$.tmp\313292e50cc5534eb536f2d87048b81a.tmp
<Current directory>\$dpx$.tmp\40db1f77d4132740b3f477094c49b1a1.tmp
<Current directory>\$dpx$.tmp\1a75f13af06ec047b09652ac69ddbc9e.tmp
<Current directory>\$dpx$.tmp\33ccdd9ea95bab4d910278cfed078a5a.tmp
<Current directory>\$dpx$.tmp\891fdaf3394dde40903f8e613599ca37.tmp
<Current directory>\$dpx$.tmp\e5a0172edc49474f994adee33f26f450.tmp
<Current directory>\$dpx$.tmp\433c19b7486f0a409a6dda14909aa016.tmp
<Current directory>\$dpx$.tmp\95be7b2d7747e94aa5a7c09b713f8932.tmp
<Current directory>\$dpx$.tmp\018394e59bb80f41ba466f4146181e28.tmp
<Current directory>\$dpx$.tmp\29eeb6f70722de4baaa20278553f0bef.tmp
<Current directory>\$dpx$.tmp\61216317f85d80458e0a5ee07b4b607c.tmp
<Current directory>\$dpx$.tmp\c2581aec769884459d14c4d6c609780e.tmp
<Current directory>\$dpx$.tmp\7b365d3e77637041b499b32de2f093eb.tmp
<Current directory>\$dpx$.tmp\13d5fc0802c05743a501c757287f8340.tmp
<Current directory>\$dpx$.tmp\50ede5c6c21b6b43ae5cce2902152156.tmp

Sets the 'hidden' attribute to the following files

<Current directory>\api-ms-win-core-console-l1-1-0.dll
<Current directory>\api-ms-win-crt-conio-l1-1-0.dll
<Current directory>\api-ms-win-crt-convert-l1-1-0.dll
<Current directory>\api-ms-win-crt-environment-l1-1-0.dll
<Current directory>\api-ms-win-crt-filesystem-l1-1-0.dll
<Current directory>\api-ms-win-crt-heap-l1-1-0.dll
<Current directory>\api-ms-win-crt-locale-l1-1-0.dll
<Current directory>\api-ms-win-crt-math-l1-1-0.dll
<Current directory>\api-ms-win-core-timezone-l1-1-0.dll
<Current directory>\api-ms-win-core-util-l1-1-0.dll
<Current directory>\api-ms-win-crt-multibyte-l1-1-0.dll
<Current directory>\api-ms-win-crt-runtime-l1-1-0.dll
<Current directory>\api-ms-win-crt-stdio-l1-1-0.dll
<Current directory>\api-ms-win-crt-string-l1-1-0.dll
<Current directory>\api-ms-win-crt-time-l1-1-0.dll
<Current directory>\api-ms-win-crt-utility-l1-1-0.dll
<Current directory>\msvcp140.dll
<Current directory>\opencl.dll
<Current directory>\api-ms-win-crt-private-l1-1-0.dll
<Current directory>\api-ms-win-crt-process-l1-1-0.dll
<Current directory>\api-ms-win-core-sysinfo-l1-1-0.dll
<Current directory>\api-ms-win-core-synch-l1-2-0.dll
<Current directory>\api-ms-win-core-synch-l1-1-0.dll
<Current directory>\api-ms-win-core-debug-l1-1-0.dll
<Current directory>\api-ms-win-core-errorhandling-l1-1-0.dll
<Current directory>\api-ms-win-core-file-l1-1-0.dll
<Current directory>\api-ms-win-core-file-l1-2-0.dll
<Current directory>\api-ms-win-core-file-l2-1-0.dll
<Current directory>\api-ms-win-core-handle-l1-1-0.dll
<Current directory>\api-ms-win-core-heap-l1-1-0.dll
<Current directory>\api-ms-win-core-interlocked-l1-1-0.dll
<Current directory>\api-ms-win-core-datetime-l1-1-0.dll
<Current directory>\api-ms-win-core-libraryloader-l1-1-0.dll
<Current directory>\api-ms-win-core-memory-l1-1-0.dll
<Current directory>\api-ms-win-core-namedpipe-l1-1-0.dll
<Current directory>\api-ms-win-core-processenvironment-l1-1-0.dll
<Current directory>\api-ms-win-core-processthreads-l1-1-0.dll
<Current directory>\api-ms-win-core-processthreads-l1-1-1.dll
<Current directory>\api-ms-win-core-profile-l1-1-0.dll
<Current directory>\api-ms-win-core-rtlsupport-l1-1-0.dll
<Current directory>\api-ms-win-core-string-l1-1-0.dll
<Current directory>\api-ms-win-core-localization-l1-2-0.dll
<Current directory>\ucrtbase.dll
<Current directory>\vcruntime140.dll

Deletes the following files

<Current directory>\d.cab

Moves the following files

from <Current directory>\$dpx$.tmp\e6584b665532074eb8c84c3aba876d37.tmp to <Current directory>\api-ms-win-core-console-l1-1-0.dll
from <Current directory>\$dpx$.tmp\8430a844db5c24459d53e6e1ed57255c.tmp to <Current directory>\api-ms-win-crt-conio-l1-1-0.dll
from <Current directory>\$dpx$.tmp\81fc6cea5cf13242bebd37adf825a8ac.tmp to <Current directory>\api-ms-win-crt-convert-l1-1-0.dll
from <Current directory>\$dpx$.tmp\759f48565d2c3640b4b46cce7a3e0c54.tmp to <Current directory>\api-ms-win-crt-environment-l1-1-0.dll
from <Current directory>\$dpx$.tmp\d2b94adbcd64eb4d87300391acbb7b72.tmp to <Current directory>\api-ms-win-crt-filesystem-l1-1-0.dll
from <Current directory>\$dpx$.tmp\c6b92968595b1a4087d2a3fff39c82e2.tmp to <Current directory>\api-ms-win-crt-heap-l1-1-0.dll
from <Current directory>\$dpx$.tmp\1e6483edbb76ea479510a402d46afa5c.tmp to <Current directory>\api-ms-win-crt-locale-l1-1-0.dll
from <Current directory>\$dpx$.tmp\d99278092da66d45bd81cd9eface1da3.tmp to <Current directory>\api-ms-win-crt-math-l1-1-0.dll
from <Current directory>\$dpx$.tmp\5843f9d1487d9844be769e3a31ec5073.tmp to <Current directory>\api-ms-win-core-timezone-l1-1-0.dll
from <Current directory>\$dpx$.tmp\20503966a8c51f4eb0afa85d94b3d8c3.tmp to <Current directory>\api-ms-win-core-util-l1-1-0.dll
from <Current directory>\$dpx$.tmp\400f2e4dcbbcaf4b945764dde3d5f340.tmp to <Current directory>\api-ms-win-crt-multibyte-l1-1-0.dll
from <Current directory>\$dpx$.tmp\cdc398eba0ee43428824334e359883a8.tmp to <Current directory>\api-ms-win-crt-runtime-l1-1-0.dll
from <Current directory>\$dpx$.tmp\9d946ad88a20304aacbe3adfd0323213.tmp to <Current directory>\api-ms-win-crt-stdio-l1-1-0.dll
from <Current directory>\$dpx$.tmp\ce1ff581b3f28947a8571806b394ed9c.tmp to <Current directory>\api-ms-win-crt-string-l1-1-0.dll
from <Current directory>\$dpx$.tmp\2c5c67f9ae4fb24d94dfac723763cc1a.tmp to <Current directory>\api-ms-win-crt-time-l1-1-0.dll
from <Current directory>\$dpx$.tmp\0ce987f0bda0f04cbcd8585500faefe3.tmp to <Current directory>\api-ms-win-crt-utility-l1-1-0.dll
from <Current directory>\$dpx$.tmp\8229780e6da1f34baa85efb4a0c88adf.tmp to <Current directory>\msvcp140.dll
from <Current directory>\$dpx$.tmp\005913df25c0f64e806200fdbfcc9047.tmp to <Current directory>\opencl.dll
from <Current directory>\$dpx$.tmp\3c396b6fe839784bb13e35f263d847bf.tmp to <Current directory>\api-ms-win-crt-private-l1-1-0.dll
from <Current directory>\$dpx$.tmp\91281e6f2ecf674ab542a39bc6a48eba.tmp to <Current directory>\api-ms-win-crt-process-l1-1-0.dll
from <Current directory>\$dpx$.tmp\da5f1e62cf75b7458d4123b775246dd0.tmp to <Current directory>\api-ms-win-core-sysinfo-l1-1-0.dll
from <Current directory>\$dpx$.tmp\1509197c65e3914b933b8f0690e6b007.tmp to <Current directory>\api-ms-win-core-synch-l1-2-0.dll
from <Current directory>\$dpx$.tmp\13d5fc0802c05743a501c757287f8340.tmp to <Current directory>\api-ms-win-core-synch-l1-1-0.dll
from <Current directory>\$dpx$.tmp\bbc6d897a1ff3d41b37123d5ada5033e.tmp to <Current directory>\api-ms-win-core-debug-l1-1-0.dll
from <Current directory>\$dpx$.tmp\08ca9e68856c8240b9b2e759b042c139.tmp to <Current directory>\api-ms-win-core-errorhandling-l1-1-0.dll
from <Current directory>\$dpx$.tmp\1ca88e2b3a8dde45bb644823251f1edb.tmp to <Current directory>\api-ms-win-core-file-l1-1-0.dll
from <Current directory>\$dpx$.tmp\48ff20c1aeb1bb458f8920eb3997fac1.tmp to <Current directory>\api-ms-win-core-file-l1-2-0.dll
from <Current directory>\$dpx$.tmp\313292e50cc5534eb536f2d87048b81a.tmp to <Current directory>\api-ms-win-core-file-l2-1-0.dll
from <Current directory>\$dpx$.tmp\40db1f77d4132740b3f477094c49b1a1.tmp to <Current directory>\api-ms-win-core-handle-l1-1-0.dll
from <Current directory>\$dpx$.tmp\1a75f13af06ec047b09652ac69ddbc9e.tmp to <Current directory>\api-ms-win-core-heap-l1-1-0.dll
from <Current directory>\$dpx$.tmp\33ccdd9ea95bab4d910278cfed078a5a.tmp to <Current directory>\api-ms-win-core-interlocked-l1-1-0.dll
from <Current directory>\$dpx$.tmp\9882db8da3e18a4c9897feb500c2f7a8.tmp to <Current directory>\api-ms-win-core-datetime-l1-1-0.dll
from <Current directory>\$dpx$.tmp\891fdaf3394dde40903f8e613599ca37.tmp to <Current directory>\api-ms-win-core-libraryloader-l1-1-0.dll
from <Current directory>\$dpx$.tmp\433c19b7486f0a409a6dda14909aa016.tmp to <Current directory>\api-ms-win-core-memory-l1-1-0.dll
from <Current directory>\$dpx$.tmp\95be7b2d7747e94aa5a7c09b713f8932.tmp to <Current directory>\api-ms-win-core-namedpipe-l1-1-0.dll
from <Current directory>\$dpx$.tmp\018394e59bb80f41ba466f4146181e28.tmp to <Current directory>\api-ms-win-core-processenvironment-l1-1-0.dll
from <Current directory>\$dpx$.tmp\29eeb6f70722de4baaa20278553f0bef.tmp to <Current directory>\api-ms-win-core-processthreads-l1-1-0.dll
from <Current directory>\$dpx$.tmp\61216317f85d80458e0a5ee07b4b607c.tmp to <Current directory>\api-ms-win-core-processthreads-l1-1-1.dll
from <Current directory>\$dpx$.tmp\c2581aec769884459d14c4d6c609780e.tmp to <Current directory>\api-ms-win-core-profile-l1-1-0.dll
from <Current directory>\$dpx$.tmp\7b365d3e77637041b499b32de2f093eb.tmp to <Current directory>\api-ms-win-core-rtlsupport-l1-1-0.dll
from <Current directory>\$dpx$.tmp\994d0005defdc649a9615946a3190c37.tmp to <Current directory>\api-ms-win-core-string-l1-1-0.dll
from <Current directory>\$dpx$.tmp\e5a0172edc49474f994adee33f26f450.tmp to <Current directory>\api-ms-win-core-localization-l1-2-0.dll
from <Current directory>\$dpx$.tmp\0d268d030c2ee64ca41f0bd9a540cdea.tmp to <Current directory>\ucrtbase.dll
from <Current directory>\$dpx$.tmp\50ede5c6c21b6b43ae5cce2902152156.tmp to <Current directory>\vcruntime140.dll

Network activity

UDP

DNS ASK lp##.beahh.com
DNS ASK lp##.abbny.com
DNS ASK lp##.haqo.net

Miscellaneous

Creates and executes the following

'<SYSTEM32>\cmd.exe' /c expand d.cab -f:* . & del d.cab /a' (with hidden window)

Executes the following

'<SYSTEM32>\cmd.exe' /c expand d.cab -f:* . & del d.cab /a
'<SYSTEM32>\expand.exe' d.cab -f:* .

Технології

Терміни

Навчання

Міфи

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней