Trojan.MulDrop11.20267

Technical Information

Modifies file system

Creates the following files

<Current directory>\d.cab
<Current directory>\$dpx$.tmp\6b489a21fd66dd4faaf8c3bcd8a8ef58.tmp
<Current directory>\$dpx$.tmp\0775ff4753a58246b860a167c4b7a743.tmp
<Current directory>\$dpx$.tmp\27da8484fd741849ba2a16e436b5881a.tmp
<Current directory>\$dpx$.tmp\637193cc695b444d8f9336fb3ec894c9.tmp
<Current directory>\$dpx$.tmp\7c6cf0da0db9d441a22a57ab46e923cc.tmp
<Current directory>\$dpx$.tmp\692890a77c199744a02ac0723b270f1d.tmp
<Current directory>\$dpx$.tmp\c1774a644ab42d4eafb2410667fc8542.tmp
<Current directory>\$dpx$.tmp\b10136b30752de439dc339c763a256bb.tmp
<Current directory>\$dpx$.tmp\9f407f0eb04af14c97573fe01b9e88ae.tmp
<Current directory>\$dpx$.tmp\d50961b4fe02cc4981f226823ae40d41.tmp
<Current directory>\$dpx$.tmp\eed52d9ab8fccc4e850559bff26714fe.tmp
<Current directory>\$dpx$.tmp\95f3d3e70cc11641bfdebb9a2de7fac3.tmp
<Current directory>\$dpx$.tmp\20e7f131fb09ad4eb50c3f98dafe57bd.tmp
<Current directory>\$dpx$.tmp\3f4892b51546394da62cd7bf802070f8.tmp
<Current directory>\$dpx$.tmp\e54bc5bf17088f47966b9c82d81b6238.tmp
<Current directory>\$dpx$.tmp\29807d85b99f504ea14ce145532b1c31.tmp
<Current directory>\$dpx$.tmp\31bcf505fadb07489b49cef2549cc707.tmp
<Current directory>\$dpx$.tmp\b0b9bde897aa274a88e08ba28f73be06.tmp
<Current directory>\$dpx$.tmp\a40ee292c7aa884cbffce8ddaa82d09b.tmp
<Current directory>\$dpx$.tmp\af06d7d38af5644d907649a07466eda2.tmp
<Current directory>\$dpx$.tmp\c4bd928a9d7a3045ba6809332573b02d.tmp
<Current directory>\$dpx$.tmp\61a4df304a0b4d4ca68030be1d47f5a2.tmp
<Current directory>\$dpx$.tmp\e80d8c86062b434eb9cf1f5819364e11.tmp
<Current directory>\$dpx$.tmp\c7e48c4481d1584bbda0826940b621d7.tmp
<Current directory>\$dpx$.tmp\8ccda433f9bd084f852b6f9b481d4ded.tmp
<Current directory>\$dpx$.tmp\13d5478eb341e8459477574ef37f36d9.tmp
<Current directory>\$dpx$.tmp\17aaf4a9166c2342a3f6c8150249f9d2.tmp
<Current directory>\$dpx$.tmp\eebf1fcdc982554fa2c20ffea4e87226.tmp
<Current directory>\$dpx$.tmp\2ddc30464efb0f4c8ef1c24b47dc2464.tmp
<Current directory>\$dpx$.tmp\89af312a03a02644823a348088aee7c8.tmp
<Current directory>\$dpx$.tmp\03c4360a062cdd4b9fa8745d133b6f99.tmp
<Current directory>\$dpx$.tmp\39fab0e286a97c489e3783d775dc1bd5.tmp
<Current directory>\$dpx$.tmp\13f55b9b5b6f12428e8a771ee52dc154.tmp
<Current directory>\$dpx$.tmp\5cfcfd5f16f77e4ea3bde31e88b522e8.tmp
<Current directory>\$dpx$.tmp\20400fccc9752d4bbd78ebec1504eb8f.tmp
<Current directory>\$dpx$.tmp\f265abacaae3954da8401abfc3167d74.tmp
<Current directory>\$dpx$.tmp\f7c9e3ac2cf6c54580a2c5b4d7e00fac.tmp
<Current directory>\$dpx$.tmp\004fe060a6dbd24baa01e4c73d7d4e49.tmp
<Current directory>\$dpx$.tmp\b0874ac6a7984641a9abf68cb8a3c05d.tmp
<Current directory>\$dpx$.tmp\6e6013afe7948c4ca240489c4f760f99.tmp
<Current directory>\$dpx$.tmp\730c96e87144e54e8b29870946b6bbd1.tmp
<Current directory>\$dpx$.tmp\217cc7a67b27324494ff21fc0aa5e37a.tmp
<Current directory>\$dpx$.tmp\8888855bbff92545bdc7525a7ebd6b37.tmp
<Current directory>\$dpx$.tmp\e31e41bf2380504782fab37227df42fa.tmp

Sets the 'hidden' attribute to the following files

<Current directory>\api-ms-win-core-console-l1-1-0.dll
<Current directory>\api-ms-win-crt-conio-l1-1-0.dll
<Current directory>\api-ms-win-crt-convert-l1-1-0.dll
<Current directory>\api-ms-win-crt-environment-l1-1-0.dll
<Current directory>\api-ms-win-crt-filesystem-l1-1-0.dll
<Current directory>\api-ms-win-crt-heap-l1-1-0.dll
<Current directory>\api-ms-win-crt-locale-l1-1-0.dll
<Current directory>\api-ms-win-crt-math-l1-1-0.dll
<Current directory>\api-ms-win-core-timezone-l1-1-0.dll
<Current directory>\api-ms-win-core-util-l1-1-0.dll
<Current directory>\api-ms-win-crt-multibyte-l1-1-0.dll
<Current directory>\api-ms-win-crt-runtime-l1-1-0.dll
<Current directory>\api-ms-win-crt-stdio-l1-1-0.dll
<Current directory>\api-ms-win-crt-string-l1-1-0.dll
<Current directory>\api-ms-win-crt-time-l1-1-0.dll
<Current directory>\api-ms-win-crt-utility-l1-1-0.dll
<Current directory>\msvcp140.dll
<Current directory>\opencl.dll
<Current directory>\api-ms-win-crt-private-l1-1-0.dll
<Current directory>\api-ms-win-crt-process-l1-1-0.dll
<Current directory>\api-ms-win-core-sysinfo-l1-1-0.dll
<Current directory>\api-ms-win-core-synch-l1-2-0.dll
<Current directory>\api-ms-win-core-synch-l1-1-0.dll
<Current directory>\api-ms-win-core-debug-l1-1-0.dll
<Current directory>\api-ms-win-core-errorhandling-l1-1-0.dll
<Current directory>\api-ms-win-core-file-l1-1-0.dll
<Current directory>\api-ms-win-core-file-l1-2-0.dll
<Current directory>\api-ms-win-core-file-l2-1-0.dll
<Current directory>\api-ms-win-core-handle-l1-1-0.dll
<Current directory>\api-ms-win-core-heap-l1-1-0.dll
<Current directory>\api-ms-win-core-interlocked-l1-1-0.dll
<Current directory>\api-ms-win-core-datetime-l1-1-0.dll
<Current directory>\api-ms-win-core-libraryloader-l1-1-0.dll
<Current directory>\api-ms-win-core-memory-l1-1-0.dll
<Current directory>\api-ms-win-core-namedpipe-l1-1-0.dll
<Current directory>\api-ms-win-core-processenvironment-l1-1-0.dll
<Current directory>\api-ms-win-core-processthreads-l1-1-0.dll
<Current directory>\api-ms-win-core-processthreads-l1-1-1.dll
<Current directory>\api-ms-win-core-profile-l1-1-0.dll
<Current directory>\api-ms-win-core-rtlsupport-l1-1-0.dll
<Current directory>\api-ms-win-core-string-l1-1-0.dll
<Current directory>\api-ms-win-core-localization-l1-2-0.dll
<Current directory>\ucrtbase.dll
<Current directory>\vcruntime140.dll

Deletes the following files

<Current directory>\d.cab

Moves the following files

from <Current directory>\$dpx$.tmp\c7e48c4481d1584bbda0826940b621d7.tmp to <Current directory>\api-ms-win-core-console-l1-1-0.dll
from <Current directory>\$dpx$.tmp\27da8484fd741849ba2a16e436b5881a.tmp to <Current directory>\api-ms-win-crt-conio-l1-1-0.dll
from <Current directory>\$dpx$.tmp\637193cc695b444d8f9336fb3ec894c9.tmp to <Current directory>\api-ms-win-crt-convert-l1-1-0.dll
from <Current directory>\$dpx$.tmp\7c6cf0da0db9d441a22a57ab46e923cc.tmp to <Current directory>\api-ms-win-crt-environment-l1-1-0.dll
from <Current directory>\$dpx$.tmp\692890a77c199744a02ac0723b270f1d.tmp to <Current directory>\api-ms-win-crt-filesystem-l1-1-0.dll
from <Current directory>\$dpx$.tmp\c1774a644ab42d4eafb2410667fc8542.tmp to <Current directory>\api-ms-win-crt-heap-l1-1-0.dll
from <Current directory>\$dpx$.tmp\b10136b30752de439dc339c763a256bb.tmp to <Current directory>\api-ms-win-crt-locale-l1-1-0.dll
from <Current directory>\$dpx$.tmp\9f407f0eb04af14c97573fe01b9e88ae.tmp to <Current directory>\api-ms-win-crt-math-l1-1-0.dll
from <Current directory>\$dpx$.tmp\6b489a21fd66dd4faaf8c3bcd8a8ef58.tmp to <Current directory>\api-ms-win-core-timezone-l1-1-0.dll
from <Current directory>\$dpx$.tmp\0775ff4753a58246b860a167c4b7a743.tmp to <Current directory>\api-ms-win-core-util-l1-1-0.dll
from <Current directory>\$dpx$.tmp\d50961b4fe02cc4981f226823ae40d41.tmp to <Current directory>\api-ms-win-crt-multibyte-l1-1-0.dll
from <Current directory>\$dpx$.tmp\20e7f131fb09ad4eb50c3f98dafe57bd.tmp to <Current directory>\api-ms-win-crt-runtime-l1-1-0.dll
from <Current directory>\$dpx$.tmp\3f4892b51546394da62cd7bf802070f8.tmp to <Current directory>\api-ms-win-crt-stdio-l1-1-0.dll
from <Current directory>\$dpx$.tmp\e54bc5bf17088f47966b9c82d81b6238.tmp to <Current directory>\api-ms-win-crt-string-l1-1-0.dll
from <Current directory>\$dpx$.tmp\29807d85b99f504ea14ce145532b1c31.tmp to <Current directory>\api-ms-win-crt-time-l1-1-0.dll
from <Current directory>\$dpx$.tmp\31bcf505fadb07489b49cef2549cc707.tmp to <Current directory>\api-ms-win-crt-utility-l1-1-0.dll
from <Current directory>\$dpx$.tmp\b0b9bde897aa274a88e08ba28f73be06.tmp to <Current directory>\msvcp140.dll
from <Current directory>\$dpx$.tmp\a40ee292c7aa884cbffce8ddaa82d09b.tmp to <Current directory>\opencl.dll
from <Current directory>\$dpx$.tmp\eed52d9ab8fccc4e850559bff26714fe.tmp to <Current directory>\api-ms-win-crt-private-l1-1-0.dll
from <Current directory>\$dpx$.tmp\95f3d3e70cc11641bfdebb9a2de7fac3.tmp to <Current directory>\api-ms-win-crt-process-l1-1-0.dll
from <Current directory>\$dpx$.tmp\af06d7d38af5644d907649a07466eda2.tmp to <Current directory>\api-ms-win-core-sysinfo-l1-1-0.dll
from <Current directory>\$dpx$.tmp\61a4df304a0b4d4ca68030be1d47f5a2.tmp to <Current directory>\api-ms-win-core-synch-l1-2-0.dll
from <Current directory>\$dpx$.tmp\8888855bbff92545bdc7525a7ebd6b37.tmp to <Current directory>\api-ms-win-core-synch-l1-1-0.dll
from <Current directory>\$dpx$.tmp\13d5478eb341e8459477574ef37f36d9.tmp to <Current directory>\api-ms-win-core-debug-l1-1-0.dll
from <Current directory>\$dpx$.tmp\17aaf4a9166c2342a3f6c8150249f9d2.tmp to <Current directory>\api-ms-win-core-errorhandling-l1-1-0.dll
from <Current directory>\$dpx$.tmp\eebf1fcdc982554fa2c20ffea4e87226.tmp to <Current directory>\api-ms-win-core-file-l1-1-0.dll
from <Current directory>\$dpx$.tmp\2ddc30464efb0f4c8ef1c24b47dc2464.tmp to <Current directory>\api-ms-win-core-file-l1-2-0.dll
from <Current directory>\$dpx$.tmp\89af312a03a02644823a348088aee7c8.tmp to <Current directory>\api-ms-win-core-file-l2-1-0.dll
from <Current directory>\$dpx$.tmp\03c4360a062cdd4b9fa8745d133b6f99.tmp to <Current directory>\api-ms-win-core-handle-l1-1-0.dll
from <Current directory>\$dpx$.tmp\39fab0e286a97c489e3783d775dc1bd5.tmp to <Current directory>\api-ms-win-core-heap-l1-1-0.dll
from <Current directory>\$dpx$.tmp\13f55b9b5b6f12428e8a771ee52dc154.tmp to <Current directory>\api-ms-win-core-interlocked-l1-1-0.dll
from <Current directory>\$dpx$.tmp\8ccda433f9bd084f852b6f9b481d4ded.tmp to <Current directory>\api-ms-win-core-datetime-l1-1-0.dll
from <Current directory>\$dpx$.tmp\5cfcfd5f16f77e4ea3bde31e88b522e8.tmp to <Current directory>\api-ms-win-core-libraryloader-l1-1-0.dll
from <Current directory>\$dpx$.tmp\f265abacaae3954da8401abfc3167d74.tmp to <Current directory>\api-ms-win-core-memory-l1-1-0.dll
from <Current directory>\$dpx$.tmp\f7c9e3ac2cf6c54580a2c5b4d7e00fac.tmp to <Current directory>\api-ms-win-core-namedpipe-l1-1-0.dll
from <Current directory>\$dpx$.tmp\004fe060a6dbd24baa01e4c73d7d4e49.tmp to <Current directory>\api-ms-win-core-processenvironment-l1-1-0.dll
from <Current directory>\$dpx$.tmp\b0874ac6a7984641a9abf68cb8a3c05d.tmp to <Current directory>\api-ms-win-core-processthreads-l1-1-0.dll
from <Current directory>\$dpx$.tmp\6e6013afe7948c4ca240489c4f760f99.tmp to <Current directory>\api-ms-win-core-processthreads-l1-1-1.dll
from <Current directory>\$dpx$.tmp\730c96e87144e54e8b29870946b6bbd1.tmp to <Current directory>\api-ms-win-core-profile-l1-1-0.dll
from <Current directory>\$dpx$.tmp\217cc7a67b27324494ff21fc0aa5e37a.tmp to <Current directory>\api-ms-win-core-rtlsupport-l1-1-0.dll
from <Current directory>\$dpx$.tmp\e80d8c86062b434eb9cf1f5819364e11.tmp to <Current directory>\api-ms-win-core-string-l1-1-0.dll
from <Current directory>\$dpx$.tmp\20400fccc9752d4bbd78ebec1504eb8f.tmp to <Current directory>\api-ms-win-core-localization-l1-2-0.dll
from <Current directory>\$dpx$.tmp\c4bd928a9d7a3045ba6809332573b02d.tmp to <Current directory>\ucrtbase.dll
from <Current directory>\$dpx$.tmp\e31e41bf2380504782fab37227df42fa.tmp to <Current directory>\vcruntime140.dll

Network activity

UDP

DNS ASK lp##.beahh.com
DNS ASK lp##.abbny.com
DNS ASK lp##.haqo.net

Miscellaneous

Creates and executes the following

'<SYSTEM32>\cmd.exe' /c expand d.cab -f:* . & del d.cab /a' (with hidden window)

Executes the following

'<SYSTEM32>\cmd.exe' /c expand d.cab -f:* . & del d.cab /a
'<SYSTEM32>\expand.exe' d.cab -f:* .

Технології

Терміни

Навчання

Міфи

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней