Trojan.MulDrop11.19767

Technical Information

Modifies file system

Creates the following files

<Current directory>\d.cab
<Current directory>\$dpx$.tmp\314c12a8c03107498e1b68546172d560.tmp
<Current directory>\$dpx$.tmp\bd79bf6ecf3c5042942c27cc116f4128.tmp
<Current directory>\$dpx$.tmp\69124843adee1a4cb04deb8da7acd432.tmp
<Current directory>\$dpx$.tmp\9b51c4358c85c14d9ea3c93f238eedb5.tmp
<Current directory>\$dpx$.tmp\2926c59c2a68984c84ec955314e1212e.tmp
<Current directory>\$dpx$.tmp\ec8b502cff813a46abab250f398f7770.tmp
<Current directory>\$dpx$.tmp\eead4329f0f789468e5ecc87e9507512.tmp
<Current directory>\$dpx$.tmp\5a4a5784a33fe5468e20d66116399708.tmp
<Current directory>\$dpx$.tmp\1f191d824a4b164999d094cfc18cb519.tmp
<Current directory>\$dpx$.tmp\e9606fce2960964fb06606811d114504.tmp
<Current directory>\$dpx$.tmp\d45e4695f6d91e4a8a655e781c16f916.tmp
<Current directory>\$dpx$.tmp\bbbd5bfc0e58214d9ced7fef7226fb64.tmp
<Current directory>\$dpx$.tmp\0ccc437a399a3841a68e3f6b0fb02ccf.tmp
<Current directory>\$dpx$.tmp\baaa901fdd89b146bf06b3dd27629ae8.tmp
<Current directory>\$dpx$.tmp\982c5e008a303a4d91d1fdcb30966628.tmp
<Current directory>\$dpx$.tmp\98a62a2bc7bd744a81507a716d407214.tmp
<Current directory>\$dpx$.tmp\eecc9cf0e04f994d8737e67440ec3422.tmp
<Current directory>\$dpx$.tmp\4aaa5f4fd783d141ba124e7e24907f25.tmp
<Current directory>\$dpx$.tmp\6be15a8cf767b544afaf6aa47cca0fb2.tmp
<Current directory>\$dpx$.tmp\e7c5a1fb7ef7944189462c97cb488022.tmp
<Current directory>\$dpx$.tmp\bfea46b79299624d8d91e4d076df2a2d.tmp
<Current directory>\$dpx$.tmp\41f93dbb50af474ea4007d19b3bd9a8a.tmp
<Current directory>\$dpx$.tmp\97a7d669ff5dca48b6c4627834d9b7a0.tmp
<Current directory>\$dpx$.tmp\fa09a6ccba0b5a449b9061751b940251.tmp
<Current directory>\$dpx$.tmp\cedf27cb63ce824f917219654b11ccef.tmp
<Current directory>\$dpx$.tmp\4556e6e28e92b54a951541a4ce480233.tmp
<Current directory>\$dpx$.tmp\3d0b25fdcdf5cb47b9de7596df7ad93a.tmp
<Current directory>\$dpx$.tmp\49aaddca34a0814bb373beec5fe726c9.tmp
<Current directory>\$dpx$.tmp\6c923ccd04c8ed488631241a2d735ec1.tmp
<Current directory>\$dpx$.tmp\c086a2f57d2c924a9d3e354f124073ea.tmp
<Current directory>\$dpx$.tmp\040506d8dafd144997534823a9feabd3.tmp
<Current directory>\$dpx$.tmp\1c853d007f82334393aeaf2d23d3ab9f.tmp
<Current directory>\$dpx$.tmp\c2587db6b66d7748828b5d043609266f.tmp
<Current directory>\$dpx$.tmp\ac8ebd45d25b6d4f9e2be2542a87189f.tmp
<Current directory>\$dpx$.tmp\062667befe32954caba6f5066806633e.tmp
<Current directory>\$dpx$.tmp\67a51b317acfe14aa63869948b20edea.tmp
<Current directory>\$dpx$.tmp\d531c3693c64ed42b312ffc8d6ee0e99.tmp
<Current directory>\$dpx$.tmp\3794ebfa4d8bf04eb15e5f74114c8eb1.tmp
<Current directory>\$dpx$.tmp\8a7d415b49737a48857693b6f24320e3.tmp
<Current directory>\$dpx$.tmp\3f3608400901a845860325f854a404f7.tmp
<Current directory>\$dpx$.tmp\5a1a84715035764d8c517fcc07964e1d.tmp
<Current directory>\$dpx$.tmp\1ccaf88f63948b48a26ff9b5e83e5a10.tmp
<Current directory>\$dpx$.tmp\f3acf7babc9dcd44bb3074d87138e671.tmp
<Current directory>\$dpx$.tmp\1a417dbb9684b74c92f1a6b5922db401.tmp

Sets the 'hidden' attribute to the following files

<Current directory>\api-ms-win-core-console-l1-1-0.dll
<Current directory>\api-ms-win-crt-conio-l1-1-0.dll
<Current directory>\api-ms-win-crt-convert-l1-1-0.dll
<Current directory>\api-ms-win-crt-environment-l1-1-0.dll
<Current directory>\api-ms-win-crt-filesystem-l1-1-0.dll
<Current directory>\api-ms-win-crt-heap-l1-1-0.dll
<Current directory>\api-ms-win-crt-locale-l1-1-0.dll
<Current directory>\api-ms-win-crt-math-l1-1-0.dll
<Current directory>\api-ms-win-core-timezone-l1-1-0.dll
<Current directory>\api-ms-win-core-util-l1-1-0.dll
<Current directory>\api-ms-win-crt-multibyte-l1-1-0.dll
<Current directory>\api-ms-win-crt-runtime-l1-1-0.dll
<Current directory>\api-ms-win-crt-stdio-l1-1-0.dll
<Current directory>\api-ms-win-crt-string-l1-1-0.dll
<Current directory>\api-ms-win-crt-time-l1-1-0.dll
<Current directory>\api-ms-win-crt-utility-l1-1-0.dll
<Current directory>\msvcp140.dll
<Current directory>\opencl.dll
<Current directory>\api-ms-win-crt-private-l1-1-0.dll
<Current directory>\api-ms-win-crt-process-l1-1-0.dll
<Current directory>\api-ms-win-core-sysinfo-l1-1-0.dll
<Current directory>\api-ms-win-core-synch-l1-2-0.dll
<Current directory>\api-ms-win-core-synch-l1-1-0.dll
<Current directory>\api-ms-win-core-debug-l1-1-0.dll
<Current directory>\api-ms-win-core-errorhandling-l1-1-0.dll
<Current directory>\api-ms-win-core-file-l1-1-0.dll
<Current directory>\api-ms-win-core-file-l1-2-0.dll
<Current directory>\api-ms-win-core-file-l2-1-0.dll
<Current directory>\api-ms-win-core-handle-l1-1-0.dll
<Current directory>\api-ms-win-core-heap-l1-1-0.dll
<Current directory>\api-ms-win-core-interlocked-l1-1-0.dll
<Current directory>\api-ms-win-core-datetime-l1-1-0.dll
<Current directory>\api-ms-win-core-libraryloader-l1-1-0.dll
<Current directory>\api-ms-win-core-memory-l1-1-0.dll
<Current directory>\api-ms-win-core-namedpipe-l1-1-0.dll
<Current directory>\api-ms-win-core-processenvironment-l1-1-0.dll
<Current directory>\api-ms-win-core-processthreads-l1-1-0.dll
<Current directory>\api-ms-win-core-processthreads-l1-1-1.dll
<Current directory>\api-ms-win-core-profile-l1-1-0.dll
<Current directory>\api-ms-win-core-rtlsupport-l1-1-0.dll
<Current directory>\api-ms-win-core-string-l1-1-0.dll
<Current directory>\api-ms-win-core-localization-l1-2-0.dll
<Current directory>\ucrtbase.dll
<Current directory>\vcruntime140.dll

Deletes the following files

<Current directory>\d.cab

Moves the following files

from <Current directory>\$dpx$.tmp\fa09a6ccba0b5a449b9061751b940251.tmp to <Current directory>\api-ms-win-core-console-l1-1-0.dll
from <Current directory>\$dpx$.tmp\69124843adee1a4cb04deb8da7acd432.tmp to <Current directory>\api-ms-win-crt-conio-l1-1-0.dll
from <Current directory>\$dpx$.tmp\9b51c4358c85c14d9ea3c93f238eedb5.tmp to <Current directory>\api-ms-win-crt-convert-l1-1-0.dll
from <Current directory>\$dpx$.tmp\2926c59c2a68984c84ec955314e1212e.tmp to <Current directory>\api-ms-win-crt-environment-l1-1-0.dll
from <Current directory>\$dpx$.tmp\ec8b502cff813a46abab250f398f7770.tmp to <Current directory>\api-ms-win-crt-filesystem-l1-1-0.dll
from <Current directory>\$dpx$.tmp\eead4329f0f789468e5ecc87e9507512.tmp to <Current directory>\api-ms-win-crt-heap-l1-1-0.dll
from <Current directory>\$dpx$.tmp\5a4a5784a33fe5468e20d66116399708.tmp to <Current directory>\api-ms-win-crt-locale-l1-1-0.dll
from <Current directory>\$dpx$.tmp\1f191d824a4b164999d094cfc18cb519.tmp to <Current directory>\api-ms-win-crt-math-l1-1-0.dll
from <Current directory>\$dpx$.tmp\314c12a8c03107498e1b68546172d560.tmp to <Current directory>\api-ms-win-core-timezone-l1-1-0.dll
from <Current directory>\$dpx$.tmp\bd79bf6ecf3c5042942c27cc116f4128.tmp to <Current directory>\api-ms-win-core-util-l1-1-0.dll
from <Current directory>\$dpx$.tmp\e9606fce2960964fb06606811d114504.tmp to <Current directory>\api-ms-win-crt-multibyte-l1-1-0.dll
from <Current directory>\$dpx$.tmp\0ccc437a399a3841a68e3f6b0fb02ccf.tmp to <Current directory>\api-ms-win-crt-runtime-l1-1-0.dll
from <Current directory>\$dpx$.tmp\baaa901fdd89b146bf06b3dd27629ae8.tmp to <Current directory>\api-ms-win-crt-stdio-l1-1-0.dll
from <Current directory>\$dpx$.tmp\982c5e008a303a4d91d1fdcb30966628.tmp to <Current directory>\api-ms-win-crt-string-l1-1-0.dll
from <Current directory>\$dpx$.tmp\98a62a2bc7bd744a81507a716d407214.tmp to <Current directory>\api-ms-win-crt-time-l1-1-0.dll
from <Current directory>\$dpx$.tmp\eecc9cf0e04f994d8737e67440ec3422.tmp to <Current directory>\api-ms-win-crt-utility-l1-1-0.dll
from <Current directory>\$dpx$.tmp\4aaa5f4fd783d141ba124e7e24907f25.tmp to <Current directory>\msvcp140.dll
from <Current directory>\$dpx$.tmp\6be15a8cf767b544afaf6aa47cca0fb2.tmp to <Current directory>\opencl.dll
from <Current directory>\$dpx$.tmp\d45e4695f6d91e4a8a655e781c16f916.tmp to <Current directory>\api-ms-win-crt-private-l1-1-0.dll
from <Current directory>\$dpx$.tmp\bbbd5bfc0e58214d9ced7fef7226fb64.tmp to <Current directory>\api-ms-win-crt-process-l1-1-0.dll
from <Current directory>\$dpx$.tmp\e7c5a1fb7ef7944189462c97cb488022.tmp to <Current directory>\api-ms-win-core-sysinfo-l1-1-0.dll
from <Current directory>\$dpx$.tmp\41f93dbb50af474ea4007d19b3bd9a8a.tmp to <Current directory>\api-ms-win-core-synch-l1-2-0.dll
from <Current directory>\$dpx$.tmp\f3acf7babc9dcd44bb3074d87138e671.tmp to <Current directory>\api-ms-win-core-synch-l1-1-0.dll
from <Current directory>\$dpx$.tmp\4556e6e28e92b54a951541a4ce480233.tmp to <Current directory>\api-ms-win-core-debug-l1-1-0.dll
from <Current directory>\$dpx$.tmp\3d0b25fdcdf5cb47b9de7596df7ad93a.tmp to <Current directory>\api-ms-win-core-errorhandling-l1-1-0.dll
from <Current directory>\$dpx$.tmp\49aaddca34a0814bb373beec5fe726c9.tmp to <Current directory>\api-ms-win-core-file-l1-1-0.dll
from <Current directory>\$dpx$.tmp\6c923ccd04c8ed488631241a2d735ec1.tmp to <Current directory>\api-ms-win-core-file-l1-2-0.dll
from <Current directory>\$dpx$.tmp\c086a2f57d2c924a9d3e354f124073ea.tmp to <Current directory>\api-ms-win-core-file-l2-1-0.dll
from <Current directory>\$dpx$.tmp\040506d8dafd144997534823a9feabd3.tmp to <Current directory>\api-ms-win-core-handle-l1-1-0.dll
from <Current directory>\$dpx$.tmp\1c853d007f82334393aeaf2d23d3ab9f.tmp to <Current directory>\api-ms-win-core-heap-l1-1-0.dll
from <Current directory>\$dpx$.tmp\c2587db6b66d7748828b5d043609266f.tmp to <Current directory>\api-ms-win-core-interlocked-l1-1-0.dll
from <Current directory>\$dpx$.tmp\cedf27cb63ce824f917219654b11ccef.tmp to <Current directory>\api-ms-win-core-datetime-l1-1-0.dll
from <Current directory>\$dpx$.tmp\ac8ebd45d25b6d4f9e2be2542a87189f.tmp to <Current directory>\api-ms-win-core-libraryloader-l1-1-0.dll
from <Current directory>\$dpx$.tmp\67a51b317acfe14aa63869948b20edea.tmp to <Current directory>\api-ms-win-core-memory-l1-1-0.dll
from <Current directory>\$dpx$.tmp\d531c3693c64ed42b312ffc8d6ee0e99.tmp to <Current directory>\api-ms-win-core-namedpipe-l1-1-0.dll
from <Current directory>\$dpx$.tmp\3794ebfa4d8bf04eb15e5f74114c8eb1.tmp to <Current directory>\api-ms-win-core-processenvironment-l1-1-0.dll
from <Current directory>\$dpx$.tmp\8a7d415b49737a48857693b6f24320e3.tmp to <Current directory>\api-ms-win-core-processthreads-l1-1-0.dll
from <Current directory>\$dpx$.tmp\3f3608400901a845860325f854a404f7.tmp to <Current directory>\api-ms-win-core-processthreads-l1-1-1.dll
from <Current directory>\$dpx$.tmp\5a1a84715035764d8c517fcc07964e1d.tmp to <Current directory>\api-ms-win-core-profile-l1-1-0.dll
from <Current directory>\$dpx$.tmp\1ccaf88f63948b48a26ff9b5e83e5a10.tmp to <Current directory>\api-ms-win-core-rtlsupport-l1-1-0.dll
from <Current directory>\$dpx$.tmp\97a7d669ff5dca48b6c4627834d9b7a0.tmp to <Current directory>\api-ms-win-core-string-l1-1-0.dll
from <Current directory>\$dpx$.tmp\062667befe32954caba6f5066806633e.tmp to <Current directory>\api-ms-win-core-localization-l1-2-0.dll
from <Current directory>\$dpx$.tmp\bfea46b79299624d8d91e4d076df2a2d.tmp to <Current directory>\ucrtbase.dll
from <Current directory>\$dpx$.tmp\1a417dbb9684b74c92f1a6b5922db401.tmp to <Current directory>\vcruntime140.dll

Network activity

UDP

DNS ASK lp##.beahh.com
DNS ASK lp##.abbny.com
DNS ASK lp##.haqo.net

Miscellaneous

Creates and executes the following

'<SYSTEM32>\cmd.exe' /c expand d.cab -f:* . & del d.cab /a' (with hidden window)

Executes the following

'<SYSTEM32>\cmd.exe' /c expand d.cab -f:* . & del d.cab /a
'<SYSTEM32>\expand.exe' d.cab -f:* .

Технології

Терміни

Навчання

Міфи

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней