Trojan.MulDrop11.20729

Technical Information

Modifies file system

Creates the following files

<Current directory>\d.cab
<Current directory>\$dpx$.tmp\074d9146e039654e9ae240cd0c1507ee.tmp
<Current directory>\$dpx$.tmp\86c8ff88f12eda4aaae15f0adb1c10d5.tmp
<Current directory>\$dpx$.tmp\6af9db2f14b01849b0bcbd9b33f31542.tmp
<Current directory>\$dpx$.tmp\adf5743a92918848a3c5078a67bfeb09.tmp
<Current directory>\$dpx$.tmp\064d315bae12e54f8c9b1667565c9a0a.tmp
<Current directory>\$dpx$.tmp\09ab679d1c5306439d229b2802224c4b.tmp
<Current directory>\$dpx$.tmp\508faec631aeec49a254f9dfa5c2e926.tmp
<Current directory>\$dpx$.tmp\fb5497c860ee1d4ba41858fe6ecb7514.tmp
<Current directory>\$dpx$.tmp\907a4c45d0b915479cceedf07e9b4c2a.tmp
<Current directory>\$dpx$.tmp\9ea77035a85a8340b3bdfbd8dd926227.tmp
<Current directory>\$dpx$.tmp\5c612b914c97384d9f3b972d385bf9c0.tmp
<Current directory>\$dpx$.tmp\144d52507f9b654385b74f8265d11724.tmp
<Current directory>\$dpx$.tmp\570cc4b99cbc064b95afccd2b10bdb0b.tmp
<Current directory>\$dpx$.tmp\663d3a53916bd44a9e34cda640560f01.tmp
<Current directory>\$dpx$.tmp\6b1c067f9b6d2d4887a5a979f3ec40fb.tmp
<Current directory>\$dpx$.tmp\40f559f5185bae4985a85a266f65293f.tmp
<Current directory>\$dpx$.tmp\a7c2c605e61db0429a6b947fc30ab442.tmp
<Current directory>\$dpx$.tmp\fe844ed41de32948b51f18dce1abdd97.tmp
<Current directory>\$dpx$.tmp\d1eb5a7634d04e4593a906d29d477e90.tmp
<Current directory>\$dpx$.tmp\a72ef826fb827445aa86e977aa0f3617.tmp
<Current directory>\$dpx$.tmp\baf407d470daff4590b2f2d30fbc122c.tmp
<Current directory>\$dpx$.tmp\593a60ef6214c947ab14ed04ba97ca9b.tmp
<Current directory>\$dpx$.tmp\e1270d8140f4654aab5d7b887d7eda8c.tmp
<Current directory>\$dpx$.tmp\1700ffad6ac163468075db4610bc3fb1.tmp
<Current directory>\$dpx$.tmp\e69e56f0fb1cfc4490ec5968eff8b054.tmp
<Current directory>\$dpx$.tmp\0d05887242c3d14f90be96651d60ea15.tmp
<Current directory>\$dpx$.tmp\6674149d99352b469211574c87137b0f.tmp
<Current directory>\$dpx$.tmp\ab674218a1dfb342b093727756cc061d.tmp
<Current directory>\$dpx$.tmp\bdfba27244b7194f834c1b498bf51ca3.tmp
<Current directory>\$dpx$.tmp\1340e8643f3dae43b748283085c53903.tmp
<Current directory>\$dpx$.tmp\82c6fd51118bf34fac5d8aacbe216a35.tmp
<Current directory>\$dpx$.tmp\65eeae09f975a6478175aeba57fe66fc.tmp
<Current directory>\$dpx$.tmp\14e2552083ad394e922a782ddf6b87b3.tmp
<Current directory>\$dpx$.tmp\b23ad800cc76b14b82e36c00d9336968.tmp
<Current directory>\$dpx$.tmp\a2f8f4cbb854a14482e75f0ff763d51c.tmp
<Current directory>\$dpx$.tmp\826c9577c346ac4db6dbd069211e8bbf.tmp
<Current directory>\$dpx$.tmp\bb675823b193ed4c85efb0164022c5b2.tmp
<Current directory>\$dpx$.tmp\5084e82b3e349a4b9a3f90ce50f7d7f7.tmp
<Current directory>\$dpx$.tmp\33e61bab72f63147bc7b27c1bca623ff.tmp
<Current directory>\$dpx$.tmp\954df7c5bda61d47a5d51ab03348dae0.tmp
<Current directory>\$dpx$.tmp\067a0a61890ac144a0e681030e6a4855.tmp
<Current directory>\$dpx$.tmp\5e433832c09b5e4fb1c06644d425e537.tmp
<Current directory>\$dpx$.tmp\f7cf1c63665f184a90b4ab4d32fa96aa.tmp
<Current directory>\$dpx$.tmp\b3f4fda0d76c3c4d895573f1b4149cca.tmp

Sets the 'hidden' attribute to the following files

<Current directory>\api-ms-win-core-console-l1-1-0.dll
<Current directory>\api-ms-win-crt-conio-l1-1-0.dll
<Current directory>\api-ms-win-crt-convert-l1-1-0.dll
<Current directory>\api-ms-win-crt-environment-l1-1-0.dll
<Current directory>\api-ms-win-crt-filesystem-l1-1-0.dll
<Current directory>\api-ms-win-crt-heap-l1-1-0.dll
<Current directory>\api-ms-win-crt-locale-l1-1-0.dll
<Current directory>\api-ms-win-crt-math-l1-1-0.dll
<Current directory>\api-ms-win-core-timezone-l1-1-0.dll
<Current directory>\api-ms-win-core-util-l1-1-0.dll
<Current directory>\api-ms-win-crt-multibyte-l1-1-0.dll
<Current directory>\api-ms-win-crt-runtime-l1-1-0.dll
<Current directory>\api-ms-win-crt-stdio-l1-1-0.dll
<Current directory>\api-ms-win-crt-string-l1-1-0.dll
<Current directory>\api-ms-win-crt-time-l1-1-0.dll
<Current directory>\api-ms-win-crt-utility-l1-1-0.dll
<Current directory>\msvcp140.dll
<Current directory>\opencl.dll
<Current directory>\api-ms-win-crt-private-l1-1-0.dll
<Current directory>\api-ms-win-crt-process-l1-1-0.dll
<Current directory>\api-ms-win-core-sysinfo-l1-1-0.dll
<Current directory>\api-ms-win-core-synch-l1-2-0.dll
<Current directory>\api-ms-win-core-synch-l1-1-0.dll
<Current directory>\api-ms-win-core-debug-l1-1-0.dll
<Current directory>\api-ms-win-core-errorhandling-l1-1-0.dll
<Current directory>\api-ms-win-core-file-l1-1-0.dll
<Current directory>\api-ms-win-core-file-l1-2-0.dll
<Current directory>\api-ms-win-core-file-l2-1-0.dll
<Current directory>\api-ms-win-core-handle-l1-1-0.dll
<Current directory>\api-ms-win-core-heap-l1-1-0.dll
<Current directory>\api-ms-win-core-interlocked-l1-1-0.dll
<Current directory>\api-ms-win-core-datetime-l1-1-0.dll
<Current directory>\api-ms-win-core-libraryloader-l1-1-0.dll
<Current directory>\api-ms-win-core-memory-l1-1-0.dll
<Current directory>\api-ms-win-core-namedpipe-l1-1-0.dll
<Current directory>\api-ms-win-core-processenvironment-l1-1-0.dll
<Current directory>\api-ms-win-core-processthreads-l1-1-0.dll
<Current directory>\api-ms-win-core-processthreads-l1-1-1.dll
<Current directory>\api-ms-win-core-profile-l1-1-0.dll
<Current directory>\api-ms-win-core-rtlsupport-l1-1-0.dll
<Current directory>\api-ms-win-core-string-l1-1-0.dll
<Current directory>\api-ms-win-core-localization-l1-2-0.dll
<Current directory>\ucrtbase.dll
<Current directory>\vcruntime140.dll

Deletes the following files

<Current directory>\d.cab

Moves the following files

from <Current directory>\$dpx$.tmp\1700ffad6ac163468075db4610bc3fb1.tmp to <Current directory>\api-ms-win-core-console-l1-1-0.dll
from <Current directory>\$dpx$.tmp\6af9db2f14b01849b0bcbd9b33f31542.tmp to <Current directory>\api-ms-win-crt-conio-l1-1-0.dll
from <Current directory>\$dpx$.tmp\adf5743a92918848a3c5078a67bfeb09.tmp to <Current directory>\api-ms-win-crt-convert-l1-1-0.dll
from <Current directory>\$dpx$.tmp\064d315bae12e54f8c9b1667565c9a0a.tmp to <Current directory>\api-ms-win-crt-environment-l1-1-0.dll
from <Current directory>\$dpx$.tmp\09ab679d1c5306439d229b2802224c4b.tmp to <Current directory>\api-ms-win-crt-filesystem-l1-1-0.dll
from <Current directory>\$dpx$.tmp\508faec631aeec49a254f9dfa5c2e926.tmp to <Current directory>\api-ms-win-crt-heap-l1-1-0.dll
from <Current directory>\$dpx$.tmp\fb5497c860ee1d4ba41858fe6ecb7514.tmp to <Current directory>\api-ms-win-crt-locale-l1-1-0.dll
from <Current directory>\$dpx$.tmp\907a4c45d0b915479cceedf07e9b4c2a.tmp to <Current directory>\api-ms-win-crt-math-l1-1-0.dll
from <Current directory>\$dpx$.tmp\074d9146e039654e9ae240cd0c1507ee.tmp to <Current directory>\api-ms-win-core-timezone-l1-1-0.dll
from <Current directory>\$dpx$.tmp\86c8ff88f12eda4aaae15f0adb1c10d5.tmp to <Current directory>\api-ms-win-core-util-l1-1-0.dll
from <Current directory>\$dpx$.tmp\9ea77035a85a8340b3bdfbd8dd926227.tmp to <Current directory>\api-ms-win-crt-multibyte-l1-1-0.dll
from <Current directory>\$dpx$.tmp\570cc4b99cbc064b95afccd2b10bdb0b.tmp to <Current directory>\api-ms-win-crt-runtime-l1-1-0.dll
from <Current directory>\$dpx$.tmp\663d3a53916bd44a9e34cda640560f01.tmp to <Current directory>\api-ms-win-crt-stdio-l1-1-0.dll
from <Current directory>\$dpx$.tmp\6b1c067f9b6d2d4887a5a979f3ec40fb.tmp to <Current directory>\api-ms-win-crt-string-l1-1-0.dll
from <Current directory>\$dpx$.tmp\40f559f5185bae4985a85a266f65293f.tmp to <Current directory>\api-ms-win-crt-time-l1-1-0.dll
from <Current directory>\$dpx$.tmp\a7c2c605e61db0429a6b947fc30ab442.tmp to <Current directory>\api-ms-win-crt-utility-l1-1-0.dll
from <Current directory>\$dpx$.tmp\fe844ed41de32948b51f18dce1abdd97.tmp to <Current directory>\msvcp140.dll
from <Current directory>\$dpx$.tmp\d1eb5a7634d04e4593a906d29d477e90.tmp to <Current directory>\opencl.dll
from <Current directory>\$dpx$.tmp\5c612b914c97384d9f3b972d385bf9c0.tmp to <Current directory>\api-ms-win-crt-private-l1-1-0.dll
from <Current directory>\$dpx$.tmp\144d52507f9b654385b74f8265d11724.tmp to <Current directory>\api-ms-win-crt-process-l1-1-0.dll
from <Current directory>\$dpx$.tmp\a72ef826fb827445aa86e977aa0f3617.tmp to <Current directory>\api-ms-win-core-sysinfo-l1-1-0.dll
from <Current directory>\$dpx$.tmp\593a60ef6214c947ab14ed04ba97ca9b.tmp to <Current directory>\api-ms-win-core-synch-l1-2-0.dll
from <Current directory>\$dpx$.tmp\f7cf1c63665f184a90b4ab4d32fa96aa.tmp to <Current directory>\api-ms-win-core-synch-l1-1-0.dll
from <Current directory>\$dpx$.tmp\0d05887242c3d14f90be96651d60ea15.tmp to <Current directory>\api-ms-win-core-debug-l1-1-0.dll
from <Current directory>\$dpx$.tmp\6674149d99352b469211574c87137b0f.tmp to <Current directory>\api-ms-win-core-errorhandling-l1-1-0.dll
from <Current directory>\$dpx$.tmp\ab674218a1dfb342b093727756cc061d.tmp to <Current directory>\api-ms-win-core-file-l1-1-0.dll
from <Current directory>\$dpx$.tmp\bdfba27244b7194f834c1b498bf51ca3.tmp to <Current directory>\api-ms-win-core-file-l1-2-0.dll
from <Current directory>\$dpx$.tmp\1340e8643f3dae43b748283085c53903.tmp to <Current directory>\api-ms-win-core-file-l2-1-0.dll
from <Current directory>\$dpx$.tmp\82c6fd51118bf34fac5d8aacbe216a35.tmp to <Current directory>\api-ms-win-core-handle-l1-1-0.dll
from <Current directory>\$dpx$.tmp\65eeae09f975a6478175aeba57fe66fc.tmp to <Current directory>\api-ms-win-core-heap-l1-1-0.dll
from <Current directory>\$dpx$.tmp\14e2552083ad394e922a782ddf6b87b3.tmp to <Current directory>\api-ms-win-core-interlocked-l1-1-0.dll
from <Current directory>\$dpx$.tmp\e69e56f0fb1cfc4490ec5968eff8b054.tmp to <Current directory>\api-ms-win-core-datetime-l1-1-0.dll
from <Current directory>\$dpx$.tmp\b23ad800cc76b14b82e36c00d9336968.tmp to <Current directory>\api-ms-win-core-libraryloader-l1-1-0.dll
from <Current directory>\$dpx$.tmp\826c9577c346ac4db6dbd069211e8bbf.tmp to <Current directory>\api-ms-win-core-memory-l1-1-0.dll
from <Current directory>\$dpx$.tmp\bb675823b193ed4c85efb0164022c5b2.tmp to <Current directory>\api-ms-win-core-namedpipe-l1-1-0.dll
from <Current directory>\$dpx$.tmp\5084e82b3e349a4b9a3f90ce50f7d7f7.tmp to <Current directory>\api-ms-win-core-processenvironment-l1-1-0.dll
from <Current directory>\$dpx$.tmp\33e61bab72f63147bc7b27c1bca623ff.tmp to <Current directory>\api-ms-win-core-processthreads-l1-1-0.dll
from <Current directory>\$dpx$.tmp\954df7c5bda61d47a5d51ab03348dae0.tmp to <Current directory>\api-ms-win-core-processthreads-l1-1-1.dll
from <Current directory>\$dpx$.tmp\067a0a61890ac144a0e681030e6a4855.tmp to <Current directory>\api-ms-win-core-profile-l1-1-0.dll
from <Current directory>\$dpx$.tmp\5e433832c09b5e4fb1c06644d425e537.tmp to <Current directory>\api-ms-win-core-rtlsupport-l1-1-0.dll
from <Current directory>\$dpx$.tmp\e1270d8140f4654aab5d7b887d7eda8c.tmp to <Current directory>\api-ms-win-core-string-l1-1-0.dll
from <Current directory>\$dpx$.tmp\a2f8f4cbb854a14482e75f0ff763d51c.tmp to <Current directory>\api-ms-win-core-localization-l1-2-0.dll
from <Current directory>\$dpx$.tmp\baf407d470daff4590b2f2d30fbc122c.tmp to <Current directory>\ucrtbase.dll
from <Current directory>\$dpx$.tmp\b3f4fda0d76c3c4d895573f1b4149cca.tmp to <Current directory>\vcruntime140.dll

Network activity

UDP

DNS ASK lp##.beahh.com
DNS ASK lp##.abbny.com
DNS ASK lp##.haqo.net

Miscellaneous

Creates and executes the following

'<SYSTEM32>\cmd.exe' /c expand d.cab -f:* . & del d.cab /a' (with hidden window)

Executes the following

'<SYSTEM32>\cmd.exe' /c expand d.cab -f:* . & del d.cab /a
'<SYSTEM32>\expand.exe' d.cab -f:* .

Технології

Терміни

Навчання

Міфи

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней