Trojan.MulDrop11.20985

Technical Information

Modifies file system

Creates the following files

%TEMP%\gert0.dll
%TEMP%\{19bf29c6-9b70-0b9e-3ab8-094f5327691f}\sete99.tmp
%TEMP%\{19bf29c6-9b70-0b9e-3ab8-094f5327691f}\setfc3.tmp
<SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\oem2.cat
%TEMP%\{084d2e2c-8444-20ca-21b7-3a14b310697d}\set38d8.tmp
%TEMP%\{084d2e2c-8444-20ca-21b7-3a14b310697d}\set39b3.tmp
%TEMP%\{084d2e2c-8444-20ca-21b7-3a14b310697d}\set3a8f.tmp
%TEMP%\{084d2e2c-8444-20ca-21b7-3a14b310697d}\set3b7a.tmp
%TEMP%\{084d2e2c-8444-20ca-21b7-3a14b310697d}\set3c66.tmp
<SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\oem3.cat
%TEMP%\{1abf545c-c9c3-7ac0-c573-d06e30e79411}\set6cbe.tmp
%TEMP%\{1abf545c-c9c3-7ac0-c573-d06e30e79411}\set6d9a.tmp
%TEMP%\{1abf545c-c9c3-7ac0-c573-d06e30e79411}\set6ea4.tmp
%TEMP%\{1abf545c-c9c3-7ac0-c573-d06e30e79411}\set701c.tmp
%TEMP%\{1abf545c-c9c3-7ac0-c573-d06e30e79411}\set7127.tmp
%TEMP%\{1abf545c-c9c3-7ac0-c573-d06e30e79411}\set7212.tmp
%TEMP%\{1abf545c-c9c3-7ac0-c573-d06e30e79411}\set72fe.tmp
<SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\oem4.cat
%TEMP%\{1cbc668e-73c1-01ae-d101-5d72f1f02526}\seta048.tmp
%TEMP%\{1cbc668e-73c1-01ae-d101-5d72f1f02526}\seta143.tmp
%TEMP%\{1cbc668e-73c1-01ae-d101-5d72f1f02526}\seta22f.tmp
%TEMP%\{1cbc668e-73c1-01ae-d101-5d72f1f02526}\seta32a.tmp
%TEMP%\{1cbc668e-73c1-01ae-d101-5d72f1f02526}\seta434.tmp
%TEMP%\{1cbc668e-73c1-01ae-d101-5d72f1f02526}\seta520.tmp
%TEMP%\{1cbc668e-73c1-01ae-d101-5d72f1f02526}\seta705.tmp
%TEMP%\{1cbc668e-73c1-01ae-d101-5d72f1f02526}\seta85e.tmp
%TEMP%\{1cbc668e-73c1-01ae-d101-5d72f1f02526}\seta968.tmp
%TEMP%\{1cbc668e-73c1-01ae-d101-5d72f1f02526}\setaa83.tmp
%TEMP%\{1cbc668e-73c1-01ae-d101-5d72f1f02526}\setab7e.tmp
%TEMP%\{1cbc668e-73c1-01ae-d101-5d72f1f02526}\setac79.tmp
%TEMP%\{19bf29c6-9b70-0b9e-3ab8-094f5327691f}\setdae.tmp
%TEMP%\{1cbc668e-73c1-01ae-d101-5d72f1f02526}\setad83.tmp
%WINDIR%\syswow64\hlvdd.dll
<SYSTEM32>\setup\aladdin\akspccard.cat
%TEMP%\ci0-temp\xwdrivers760.set
%TEMP%\haspdinst760.exe
%TEMP%\haspds_windows.dll
%WINDIR%\aksdrvsetup.log
%TEMP%\hasp_windows.dll
%TEMP%\haspdinst_x64.exe
%TEMP%\hhl01.cab
%TEMP%\haspds_windows_x64.dll
%TEMP%\0pdc.txt
<SYSTEM32>\setup\aladdin\hasphl\aksclass.sys
<SYSTEM32>\setup\aladdin\hasphl\aksdf.sys
<SYSTEM32>\setup\aladdin\hasphl\aksfridge.sys
<SYSTEM32>\setup\aladdin\hasphl\akshasp.cat
<SYSTEM32>\setup\aladdin\hasphl\akshasp.inf
<SYSTEM32>\setup\aladdin\hasphl\akshasp.sys
<SYSTEM32>\setup\aladdin\hasphl\akshhl.cat
<SYSTEM32>\setup\aladdin\hasphl\akshhl.inf
<SYSTEM32>\setup\aladdin\hasphl\akshhl.sys
<SYSTEM32>\setup\aladdin\hasphl\akshhl32.dll
<SYSTEM32>\setup\aladdin\hasphl\akshsp53.dll
<SYSTEM32>\setup\aladdin\akspccard.sys
<SYSTEM32>\setup\aladdin\hasphl\aksusb.cat
<SYSTEM32>\setup\aladdin\hasphl\aksusb.inf
<SYSTEM32>\setup\aladdin\hasphl\aksusb.sys
<SYSTEM32>\setup\aladdin\hasphl\aksusb5.dll
<SYSTEM32>\setup\aladdin\hasphl\hardlock.sys
<SYSTEM32>\setup\aladdin\hasphl\hasplms.exe
<SYSTEM32>\setup\aladdin\hasphl\hasplmv.exe
<SYSTEM32>\setup\aladdin\hasphl\hlvdd.dll
<SYSTEM32>\setup\aladdin\akspccard.inf
%TEMP%\{1cbc668e-73c1-01ae-d101-5d72f1f02526}\setae8e.tmp

Sets the 'hidden' attribute to the following files

<SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\oem2.cat
<SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\oem3.cat
<SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\oem4.cat

Deletes the following files

%TEMP%\{19bf29c6-9b70-0b9e-3ab8-094f5327691f}\akspccard.cat
%TEMP%\{1cbc668e-73c1-01ae-d101-5d72f1f02526}\hardlock.sys
%TEMP%\{1cbc668e-73c1-01ae-d101-5d72f1f02526}\aksusb5.dll
%TEMP%\{1cbc668e-73c1-01ae-d101-5d72f1f02526}\aksusb.sys
%TEMP%\{1cbc668e-73c1-01ae-d101-5d72f1f02526}\aksusb.inf
%TEMP%\{1cbc668e-73c1-01ae-d101-5d72f1f02526}\aksusb.cat
%TEMP%\{1cbc668e-73c1-01ae-d101-5d72f1f02526}\akshsp53.dll
%TEMP%\{1cbc668e-73c1-01ae-d101-5d72f1f02526}\akshhl32.dll
%TEMP%\{1cbc668e-73c1-01ae-d101-5d72f1f02526}\akshhl.sys
%TEMP%\{1cbc668e-73c1-01ae-d101-5d72f1f02526}\akshasp.sys
%TEMP%\{1cbc668e-73c1-01ae-d101-5d72f1f02526}\aksfridge.sys
%TEMP%\{1cbc668e-73c1-01ae-d101-5d72f1f02526}\aksdf.sys
%TEMP%\{1cbc668e-73c1-01ae-d101-5d72f1f02526}\aksclass.sys
%TEMP%\{1cbc668e-73c1-01ae-d101-5d72f1f02526}\hasplms.exe
%TEMP%\{1abf545c-c9c3-7ac0-c573-d06e30e79411}\hasplmv.exe
%TEMP%\{1abf545c-c9c3-7ac0-c573-d06e30e79411}\akshhl32.dll
%TEMP%\{1abf545c-c9c3-7ac0-c573-d06e30e79411}\akshhl.sys
%TEMP%\{1abf545c-c9c3-7ac0-c573-d06e30e79411}\akshhl.inf
%TEMP%\{1abf545c-c9c3-7ac0-c573-d06e30e79411}\akshhl.cat
%TEMP%\{1abf545c-c9c3-7ac0-c573-d06e30e79411}\aksfridge.sys
%TEMP%\{084d2e2c-8444-20ca-21b7-3a14b310697d}\hardlock.sys
%TEMP%\{084d2e2c-8444-20ca-21b7-3a14b310697d}\akshsp53.dll
%TEMP%\{084d2e2c-8444-20ca-21b7-3a14b310697d}\akshasp.sys
%TEMP%\{084d2e2c-8444-20ca-21b7-3a14b310697d}\akshasp.inf
%TEMP%\{084d2e2c-8444-20ca-21b7-3a14b310697d}\akshasp.cat
%TEMP%\{19bf29c6-9b70-0b9e-3ab8-094f5327691f}\akspccard.sys
%TEMP%\{19bf29c6-9b70-0b9e-3ab8-094f5327691f}\akspccard.inf
%TEMP%\{1abf545c-c9c3-7ac0-c573-d06e30e79411}\hasplms.exe
%TEMP%\{1cbc668e-73c1-01ae-d101-5d72f1f02526}\hasplmv.exe

Moves the following system files

from <SYSTEM32>\catroot2\edb00562.log to <SYSTEM32>\catroot2\edbtmp.log
from <SYSTEM32>\catroot2\edb.log to <SYSTEM32>\catroot2\edb00563.log

Moves the following files

from %TEMP%\{19bf29c6-9b70-0b9e-3ab8-094f5327691f}\setdae.tmp to %TEMP%\{19bf29c6-9b70-0b9e-3ab8-094f5327691f}\akspccard.cat
from %TEMP%\{1cbc668e-73c1-01ae-d101-5d72f1f02526}\setac79.tmp to %TEMP%\{1cbc668e-73c1-01ae-d101-5d72f1f02526}\aksdf.sys
from %TEMP%\{1cbc668e-73c1-01ae-d101-5d72f1f02526}\setab7e.tmp to %TEMP%\{1cbc668e-73c1-01ae-d101-5d72f1f02526}\aksfridge.sys
from %TEMP%\{1cbc668e-73c1-01ae-d101-5d72f1f02526}\setaa83.tmp to %TEMP%\{1cbc668e-73c1-01ae-d101-5d72f1f02526}\aksclass.sys
from %TEMP%\{1cbc668e-73c1-01ae-d101-5d72f1f02526}\seta968.tmp to %TEMP%\{1cbc668e-73c1-01ae-d101-5d72f1f02526}\hardlock.sys
from %TEMP%\{1cbc668e-73c1-01ae-d101-5d72f1f02526}\seta85e.tmp to %TEMP%\{1cbc668e-73c1-01ae-d101-5d72f1f02526}\akshasp.sys
from %TEMP%\{1cbc668e-73c1-01ae-d101-5d72f1f02526}\seta705.tmp to %TEMP%\{1cbc668e-73c1-01ae-d101-5d72f1f02526}\hasplmv.exe
from %TEMP%\{1cbc668e-73c1-01ae-d101-5d72f1f02526}\seta520.tmp to %TEMP%\{1cbc668e-73c1-01ae-d101-5d72f1f02526}\hasplms.exe
from %TEMP%\{1cbc668e-73c1-01ae-d101-5d72f1f02526}\seta434.tmp to %TEMP%\{1cbc668e-73c1-01ae-d101-5d72f1f02526}\akshsp53.dll
from %TEMP%\{1cbc668e-73c1-01ae-d101-5d72f1f02526}\seta32a.tmp to %TEMP%\{1cbc668e-73c1-01ae-d101-5d72f1f02526}\akshhl32.dll
from %TEMP%\{1cbc668e-73c1-01ae-d101-5d72f1f02526}\seta22f.tmp to %TEMP%\{1cbc668e-73c1-01ae-d101-5d72f1f02526}\aksusb5.dll
from %TEMP%\{1cbc668e-73c1-01ae-d101-5d72f1f02526}\seta143.tmp to %TEMP%\{1cbc668e-73c1-01ae-d101-5d72f1f02526}\aksusb.sys
from %TEMP%\{1cbc668e-73c1-01ae-d101-5d72f1f02526}\seta048.tmp to %TEMP%\{1cbc668e-73c1-01ae-d101-5d72f1f02526}\akshhl.sys
from %TEMP%\{1cbc668e-73c1-01ae-d101-5d72f1f02526}\setad83.tmp to %TEMP%\{1cbc668e-73c1-01ae-d101-5d72f1f02526}\aksusb.cat
from %TEMP%\{1abf545c-c9c3-7ac0-c573-d06e30e79411}\set72fe.tmp to %TEMP%\{1abf545c-c9c3-7ac0-c573-d06e30e79411}\akshhl.inf
from %TEMP%\{1abf545c-c9c3-7ac0-c573-d06e30e79411}\set7127.tmp to %TEMP%\{1abf545c-c9c3-7ac0-c573-d06e30e79411}\aksfridge.sys
from %TEMP%\{1abf545c-c9c3-7ac0-c573-d06e30e79411}\set701c.tmp to %TEMP%\{1abf545c-c9c3-7ac0-c573-d06e30e79411}\hasplmv.exe
from %TEMP%\{1abf545c-c9c3-7ac0-c573-d06e30e79411}\set6ea4.tmp to %TEMP%\{1abf545c-c9c3-7ac0-c573-d06e30e79411}\hasplms.exe
from %TEMP%\{1abf545c-c9c3-7ac0-c573-d06e30e79411}\set6d9a.tmp to %TEMP%\{1abf545c-c9c3-7ac0-c573-d06e30e79411}\akshhl32.dll
from %TEMP%\{1abf545c-c9c3-7ac0-c573-d06e30e79411}\set6cbe.tmp to %TEMP%\{1abf545c-c9c3-7ac0-c573-d06e30e79411}\akshhl.sys
from %TEMP%\{084d2e2c-8444-20ca-21b7-3a14b310697d}\set3c66.tmp to %TEMP%\{084d2e2c-8444-20ca-21b7-3a14b310697d}\hardlock.sys
from %TEMP%\{084d2e2c-8444-20ca-21b7-3a14b310697d}\set3b7a.tmp to %TEMP%\{084d2e2c-8444-20ca-21b7-3a14b310697d}\akshasp.sys
from %TEMP%\{084d2e2c-8444-20ca-21b7-3a14b310697d}\set3a8f.tmp to %TEMP%\{084d2e2c-8444-20ca-21b7-3a14b310697d}\akshsp53.dll
from %TEMP%\{084d2e2c-8444-20ca-21b7-3a14b310697d}\set39b3.tmp to %TEMP%\{084d2e2c-8444-20ca-21b7-3a14b310697d}\akshasp.inf
from %TEMP%\{084d2e2c-8444-20ca-21b7-3a14b310697d}\set38d8.tmp to %TEMP%\{084d2e2c-8444-20ca-21b7-3a14b310697d}\akshasp.cat
from %TEMP%\{19bf29c6-9b70-0b9e-3ab8-094f5327691f}\setfc3.tmp to %TEMP%\{19bf29c6-9b70-0b9e-3ab8-094f5327691f}\akspccard.sys
from %TEMP%\{19bf29c6-9b70-0b9e-3ab8-094f5327691f}\sete99.tmp to %TEMP%\{19bf29c6-9b70-0b9e-3ab8-094f5327691f}\akspccard.inf
from %TEMP%\{1abf545c-c9c3-7ac0-c573-d06e30e79411}\set7212.tmp to %TEMP%\{1abf545c-c9c3-7ac0-c573-d06e30e79411}\akshhl.cat
from %TEMP%\{1cbc668e-73c1-01ae-d101-5d72f1f02526}\setae8e.tmp to %TEMP%\{1cbc668e-73c1-01ae-d101-5d72f1f02526}\aksusb.inf

Miscellaneous

Creates and executes the following

'%TEMP%\haspdinst760.exe' /i
'%TEMP%\haspdinst_x64.exe' -i -nomsg -32to64

Технології

Терміни

Навчання

Міфи

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней