Trojan.MulDrop11.19471

Technical Information

Modifies file system

Creates the following files

<Current directory>\d.cab
<Current directory>\$dpx$.tmp\8585d93e132bc24ab60952ee6646fb84.tmp
<Current directory>\$dpx$.tmp\37f298490fef144387777275d78f56e5.tmp
<Current directory>\$dpx$.tmp\20d47ce85764f14094530fd62fb16d48.tmp
<Current directory>\$dpx$.tmp\79aa02ab716dcd4c9497b2ca19da94eb.tmp
<Current directory>\$dpx$.tmp\6698d3f27b9bcf4681acfbf869e41de1.tmp
<Current directory>\$dpx$.tmp\f07c60ac26863342be8d56a7508d62ca.tmp
<Current directory>\$dpx$.tmp\4d339ef56651d24ea0a0ba50bea874b0.tmp
<Current directory>\$dpx$.tmp\26c43ab22d5dd84bb6fb786f465fccba.tmp
<Current directory>\$dpx$.tmp\a47fcaa3e2888c40a00c38c5750bdf09.tmp
<Current directory>\$dpx$.tmp\2e070322681f314f840808adf991eea0.tmp
<Current directory>\$dpx$.tmp\58d117bad40a5e4dbc9895dde0b272ab.tmp
<Current directory>\$dpx$.tmp\cc504175af9bcb42829f662fef8459db.tmp
<Current directory>\$dpx$.tmp\ad7a4c2c1cdc614aa950166246cd7f12.tmp
<Current directory>\$dpx$.tmp\8bbe3a67bf88194cbc89f7569d22682b.tmp
<Current directory>\$dpx$.tmp\84e2522fbebf6145bd81034f58582829.tmp
<Current directory>\$dpx$.tmp\36687ce9adc7ab4292ef65c062c8e0c1.tmp
<Current directory>\$dpx$.tmp\32095ef2e110a34d86cacae2b54d2874.tmp
<Current directory>\$dpx$.tmp\01a4a4002b07c449b44a46c8a5767323.tmp
<Current directory>\$dpx$.tmp\221557dd2293e24eae7f548aa329f575.tmp
<Current directory>\$dpx$.tmp\d42c079c6b063049a8eed4e3f7564264.tmp
<Current directory>\$dpx$.tmp\a67dbc7ced3ed441a74d713f22b5f063.tmp
<Current directory>\$dpx$.tmp\492633c065b5b540a63cb8868772b088.tmp
<Current directory>\$dpx$.tmp\c2fce19407ed1148b603bd5f7b07674d.tmp
<Current directory>\$dpx$.tmp\8b491598f6e1dd4aaceda0949e51ae8f.tmp
<Current directory>\$dpx$.tmp\ff81600c477d4f48a56212e48a24dd69.tmp
<Current directory>\$dpx$.tmp\f03d0a1fbe42124994ea677d6abbd45f.tmp
<Current directory>\$dpx$.tmp\94b7b3e04454c240b697288632a2055a.tmp
<Current directory>\$dpx$.tmp\08209cfd2953cc4085601b97e78fa286.tmp
<Current directory>\$dpx$.tmp\ca441e248a05054ba80e410bbac99193.tmp
<Current directory>\$dpx$.tmp\b29b22c32db04a41ae08f2c3c72af254.tmp
<Current directory>\$dpx$.tmp\b6aab9700601b44d9f77af67893554cc.tmp
<Current directory>\$dpx$.tmp\6f408f4dd121464e836734d9eb9bbc0c.tmp
<Current directory>\$dpx$.tmp\500cfcefe3eaa54299bce1ca7fd6ded4.tmp
<Current directory>\$dpx$.tmp\c09b60ebfa8bad4a8182cddceae54aa6.tmp
<Current directory>\$dpx$.tmp\40311ff7d176db48b70b645535bc3d34.tmp
<Current directory>\$dpx$.tmp\8b93e96d0492a4428786339128705135.tmp
<Current directory>\$dpx$.tmp\ce35abfc4770134f8589e523165e36d3.tmp
<Current directory>\$dpx$.tmp\dd242f2e3e33864e9a929bbb99290f2d.tmp
<Current directory>\$dpx$.tmp\0522f9fd71f2e145a20e6866298dd64c.tmp
<Current directory>\$dpx$.tmp\84f9e421a8e3744b84f5b240809bbba2.tmp
<Current directory>\$dpx$.tmp\0ae403fdc8c21c4ba86388743630852a.tmp
<Current directory>\$dpx$.tmp\f28d03e666724843ae7278ed4ea4ae8f.tmp
<Current directory>\$dpx$.tmp\36649b5dcfd8bc4a89b1d582c6af4a22.tmp
<Current directory>\$dpx$.tmp\e7a570c3a866514abb51288cabaa61a9.tmp

Sets the 'hidden' attribute to the following files

<Current directory>\api-ms-win-core-console-l1-1-0.dll
<Current directory>\api-ms-win-crt-conio-l1-1-0.dll
<Current directory>\api-ms-win-crt-convert-l1-1-0.dll
<Current directory>\api-ms-win-crt-environment-l1-1-0.dll
<Current directory>\api-ms-win-crt-filesystem-l1-1-0.dll
<Current directory>\api-ms-win-crt-heap-l1-1-0.dll
<Current directory>\api-ms-win-crt-locale-l1-1-0.dll
<Current directory>\api-ms-win-crt-math-l1-1-0.dll
<Current directory>\api-ms-win-core-timezone-l1-1-0.dll
<Current directory>\api-ms-win-core-util-l1-1-0.dll
<Current directory>\api-ms-win-crt-multibyte-l1-1-0.dll
<Current directory>\api-ms-win-crt-runtime-l1-1-0.dll
<Current directory>\api-ms-win-crt-stdio-l1-1-0.dll
<Current directory>\api-ms-win-crt-string-l1-1-0.dll
<Current directory>\api-ms-win-crt-time-l1-1-0.dll
<Current directory>\api-ms-win-crt-utility-l1-1-0.dll
<Current directory>\msvcp140.dll
<Current directory>\opencl.dll
<Current directory>\api-ms-win-crt-private-l1-1-0.dll
<Current directory>\api-ms-win-crt-process-l1-1-0.dll
<Current directory>\api-ms-win-core-sysinfo-l1-1-0.dll
<Current directory>\api-ms-win-core-synch-l1-2-0.dll
<Current directory>\api-ms-win-core-synch-l1-1-0.dll
<Current directory>\api-ms-win-core-debug-l1-1-0.dll
<Current directory>\api-ms-win-core-errorhandling-l1-1-0.dll
<Current directory>\api-ms-win-core-file-l1-1-0.dll
<Current directory>\api-ms-win-core-file-l1-2-0.dll
<Current directory>\api-ms-win-core-file-l2-1-0.dll
<Current directory>\api-ms-win-core-handle-l1-1-0.dll
<Current directory>\api-ms-win-core-heap-l1-1-0.dll
<Current directory>\api-ms-win-core-interlocked-l1-1-0.dll
<Current directory>\api-ms-win-core-datetime-l1-1-0.dll
<Current directory>\api-ms-win-core-libraryloader-l1-1-0.dll
<Current directory>\api-ms-win-core-memory-l1-1-0.dll
<Current directory>\api-ms-win-core-namedpipe-l1-1-0.dll
<Current directory>\api-ms-win-core-processenvironment-l1-1-0.dll
<Current directory>\api-ms-win-core-processthreads-l1-1-0.dll
<Current directory>\api-ms-win-core-processthreads-l1-1-1.dll
<Current directory>\api-ms-win-core-profile-l1-1-0.dll
<Current directory>\api-ms-win-core-rtlsupport-l1-1-0.dll
<Current directory>\api-ms-win-core-string-l1-1-0.dll
<Current directory>\api-ms-win-core-localization-l1-2-0.dll
<Current directory>\ucrtbase.dll
<Current directory>\vcruntime140.dll

Deletes the following files

<Current directory>\d.cab

Moves the following files

from <Current directory>\$dpx$.tmp\8b491598f6e1dd4aaceda0949e51ae8f.tmp to <Current directory>\api-ms-win-core-console-l1-1-0.dll
from <Current directory>\$dpx$.tmp\20d47ce85764f14094530fd62fb16d48.tmp to <Current directory>\api-ms-win-crt-conio-l1-1-0.dll
from <Current directory>\$dpx$.tmp\79aa02ab716dcd4c9497b2ca19da94eb.tmp to <Current directory>\api-ms-win-crt-convert-l1-1-0.dll
from <Current directory>\$dpx$.tmp\6698d3f27b9bcf4681acfbf869e41de1.tmp to <Current directory>\api-ms-win-crt-environment-l1-1-0.dll
from <Current directory>\$dpx$.tmp\f07c60ac26863342be8d56a7508d62ca.tmp to <Current directory>\api-ms-win-crt-filesystem-l1-1-0.dll
from <Current directory>\$dpx$.tmp\4d339ef56651d24ea0a0ba50bea874b0.tmp to <Current directory>\api-ms-win-crt-heap-l1-1-0.dll
from <Current directory>\$dpx$.tmp\26c43ab22d5dd84bb6fb786f465fccba.tmp to <Current directory>\api-ms-win-crt-locale-l1-1-0.dll
from <Current directory>\$dpx$.tmp\a47fcaa3e2888c40a00c38c5750bdf09.tmp to <Current directory>\api-ms-win-crt-math-l1-1-0.dll
from <Current directory>\$dpx$.tmp\8585d93e132bc24ab60952ee6646fb84.tmp to <Current directory>\api-ms-win-core-timezone-l1-1-0.dll
from <Current directory>\$dpx$.tmp\37f298490fef144387777275d78f56e5.tmp to <Current directory>\api-ms-win-core-util-l1-1-0.dll
from <Current directory>\$dpx$.tmp\2e070322681f314f840808adf991eea0.tmp to <Current directory>\api-ms-win-crt-multibyte-l1-1-0.dll
from <Current directory>\$dpx$.tmp\ad7a4c2c1cdc614aa950166246cd7f12.tmp to <Current directory>\api-ms-win-crt-runtime-l1-1-0.dll
from <Current directory>\$dpx$.tmp\8bbe3a67bf88194cbc89f7569d22682b.tmp to <Current directory>\api-ms-win-crt-stdio-l1-1-0.dll
from <Current directory>\$dpx$.tmp\84e2522fbebf6145bd81034f58582829.tmp to <Current directory>\api-ms-win-crt-string-l1-1-0.dll
from <Current directory>\$dpx$.tmp\36687ce9adc7ab4292ef65c062c8e0c1.tmp to <Current directory>\api-ms-win-crt-time-l1-1-0.dll
from <Current directory>\$dpx$.tmp\32095ef2e110a34d86cacae2b54d2874.tmp to <Current directory>\api-ms-win-crt-utility-l1-1-0.dll
from <Current directory>\$dpx$.tmp\01a4a4002b07c449b44a46c8a5767323.tmp to <Current directory>\msvcp140.dll
from <Current directory>\$dpx$.tmp\221557dd2293e24eae7f548aa329f575.tmp to <Current directory>\opencl.dll
from <Current directory>\$dpx$.tmp\58d117bad40a5e4dbc9895dde0b272ab.tmp to <Current directory>\api-ms-win-crt-private-l1-1-0.dll
from <Current directory>\$dpx$.tmp\cc504175af9bcb42829f662fef8459db.tmp to <Current directory>\api-ms-win-crt-process-l1-1-0.dll
from <Current directory>\$dpx$.tmp\d42c079c6b063049a8eed4e3f7564264.tmp to <Current directory>\api-ms-win-core-sysinfo-l1-1-0.dll
from <Current directory>\$dpx$.tmp\492633c065b5b540a63cb8868772b088.tmp to <Current directory>\api-ms-win-core-synch-l1-2-0.dll
from <Current directory>\$dpx$.tmp\36649b5dcfd8bc4a89b1d582c6af4a22.tmp to <Current directory>\api-ms-win-core-synch-l1-1-0.dll
from <Current directory>\$dpx$.tmp\f03d0a1fbe42124994ea677d6abbd45f.tmp to <Current directory>\api-ms-win-core-debug-l1-1-0.dll
from <Current directory>\$dpx$.tmp\94b7b3e04454c240b697288632a2055a.tmp to <Current directory>\api-ms-win-core-errorhandling-l1-1-0.dll
from <Current directory>\$dpx$.tmp\08209cfd2953cc4085601b97e78fa286.tmp to <Current directory>\api-ms-win-core-file-l1-1-0.dll
from <Current directory>\$dpx$.tmp\ca441e248a05054ba80e410bbac99193.tmp to <Current directory>\api-ms-win-core-file-l1-2-0.dll
from <Current directory>\$dpx$.tmp\b29b22c32db04a41ae08f2c3c72af254.tmp to <Current directory>\api-ms-win-core-file-l2-1-0.dll
from <Current directory>\$dpx$.tmp\b6aab9700601b44d9f77af67893554cc.tmp to <Current directory>\api-ms-win-core-handle-l1-1-0.dll
from <Current directory>\$dpx$.tmp\6f408f4dd121464e836734d9eb9bbc0c.tmp to <Current directory>\api-ms-win-core-heap-l1-1-0.dll
from <Current directory>\$dpx$.tmp\500cfcefe3eaa54299bce1ca7fd6ded4.tmp to <Current directory>\api-ms-win-core-interlocked-l1-1-0.dll
from <Current directory>\$dpx$.tmp\ff81600c477d4f48a56212e48a24dd69.tmp to <Current directory>\api-ms-win-core-datetime-l1-1-0.dll
from <Current directory>\$dpx$.tmp\c09b60ebfa8bad4a8182cddceae54aa6.tmp to <Current directory>\api-ms-win-core-libraryloader-l1-1-0.dll
from <Current directory>\$dpx$.tmp\8b93e96d0492a4428786339128705135.tmp to <Current directory>\api-ms-win-core-memory-l1-1-0.dll
from <Current directory>\$dpx$.tmp\ce35abfc4770134f8589e523165e36d3.tmp to <Current directory>\api-ms-win-core-namedpipe-l1-1-0.dll
from <Current directory>\$dpx$.tmp\dd242f2e3e33864e9a929bbb99290f2d.tmp to <Current directory>\api-ms-win-core-processenvironment-l1-1-0.dll
from <Current directory>\$dpx$.tmp\0522f9fd71f2e145a20e6866298dd64c.tmp to <Current directory>\api-ms-win-core-processthreads-l1-1-0.dll
from <Current directory>\$dpx$.tmp\84f9e421a8e3744b84f5b240809bbba2.tmp to <Current directory>\api-ms-win-core-processthreads-l1-1-1.dll
from <Current directory>\$dpx$.tmp\0ae403fdc8c21c4ba86388743630852a.tmp to <Current directory>\api-ms-win-core-profile-l1-1-0.dll
from <Current directory>\$dpx$.tmp\f28d03e666724843ae7278ed4ea4ae8f.tmp to <Current directory>\api-ms-win-core-rtlsupport-l1-1-0.dll
from <Current directory>\$dpx$.tmp\c2fce19407ed1148b603bd5f7b07674d.tmp to <Current directory>\api-ms-win-core-string-l1-1-0.dll
from <Current directory>\$dpx$.tmp\40311ff7d176db48b70b645535bc3d34.tmp to <Current directory>\api-ms-win-core-localization-l1-2-0.dll
from <Current directory>\$dpx$.tmp\a67dbc7ced3ed441a74d713f22b5f063.tmp to <Current directory>\ucrtbase.dll
from <Current directory>\$dpx$.tmp\e7a570c3a866514abb51288cabaa61a9.tmp to <Current directory>\vcruntime140.dll

Network activity

UDP

DNS ASK lp##.beahh.com
DNS ASK lp##.abbny.com
DNS ASK lp##.haqo.net

Miscellaneous

Creates and executes the following

'<SYSTEM32>\cmd.exe' /c expand d.cab -f:* . & del d.cab /a' (with hidden window)

Executes the following

'<SYSTEM32>\cmd.exe' /c expand d.cab -f:* . & del d.cab /a
'<SYSTEM32>\expand.exe' d.cab -f:* .

Технології

Терміни

Навчання

Міфи

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней