Trojan.MulDrop11.21046

Technical Information

Modifies file system

Creates the following files

<Current directory>\d.cab
<Current directory>\$dpx$.tmp\01fbc93336805843b93703c5838f71a0.tmp
<Current directory>\$dpx$.tmp\02a97af079575648b8cb818b8fa43141.tmp
<Current directory>\$dpx$.tmp\bcd39c38dce6f24da6c70fa1bf24d8f0.tmp
<Current directory>\$dpx$.tmp\0f2cd4ef71d48148839460ff092358a8.tmp
<Current directory>\$dpx$.tmp\e7d6de46666a514ab7f1fb595390ad03.tmp
<Current directory>\$dpx$.tmp\c32237ff7776394a835c47cbdeeac675.tmp
<Current directory>\$dpx$.tmp\f4a812513262044ea7e438791ad0dcd7.tmp
<Current directory>\$dpx$.tmp\4c1034c8d8348a4883fd67af708e10bb.tmp
<Current directory>\$dpx$.tmp\b6ad9f5d05667645a4246f3cefb8e3f2.tmp
<Current directory>\$dpx$.tmp\5d759be2b0c115458caffe29e68f5275.tmp
<Current directory>\$dpx$.tmp\8bca34ec6ffd6a4e8c8f91461cb9398d.tmp
<Current directory>\$dpx$.tmp\756e187ca2058c49bad8178124f7183d.tmp
<Current directory>\$dpx$.tmp\76b9d0abfb4d4247b58a7c856074f58d.tmp
<Current directory>\$dpx$.tmp\66116038cb53794ba84fe6a1880e7f3b.tmp
<Current directory>\$dpx$.tmp\53656dde94273c438083395497e8fff2.tmp
<Current directory>\$dpx$.tmp\c0d282a9a30222428c8c55f86d2036ff.tmp
<Current directory>\$dpx$.tmp\08e2081f92654843bb091bd20cbd8a5b.tmp
<Current directory>\$dpx$.tmp\8ebef83cc8625a4ea770ee94ed3adef1.tmp
<Current directory>\$dpx$.tmp\f8728ed687913f4b98dcc425ced21aee.tmp
<Current directory>\$dpx$.tmp\5c6639449cfea64db86a05a7ecc0f472.tmp
<Current directory>\$dpx$.tmp\7eb223b15c6440449e2bc4b842ead7b5.tmp
<Current directory>\$dpx$.tmp\0b2036eece07f748bd055b13f91fff02.tmp
<Current directory>\$dpx$.tmp\7616fe15d00a5d4f83acedc110bdece3.tmp
<Current directory>\$dpx$.tmp\b5fe763685618240ba2f482eb484883e.tmp
<Current directory>\$dpx$.tmp\00f8441551980942a629594f3389711d.tmp
<Current directory>\$dpx$.tmp\7d311300a36d1646911c92b83e1f1986.tmp
<Current directory>\$dpx$.tmp\623ddcb56213c2428518a6ffeeda84c0.tmp
<Current directory>\$dpx$.tmp\a161e5629a8b794291f70d4075414364.tmp
<Current directory>\$dpx$.tmp\f994704068bc4841bc61b7a3047c8bd8.tmp
<Current directory>\$dpx$.tmp\59b286802853c64bb46563e90dccd960.tmp
<Current directory>\$dpx$.tmp\fa1eb78801b13440bad40c6de9822100.tmp
<Current directory>\$dpx$.tmp\628c71c8322c834bbae77a147700b2c8.tmp
<Current directory>\$dpx$.tmp\5f43dc4e93a0dd42bbb8f23a42f71254.tmp
<Current directory>\$dpx$.tmp\89292456e36e5f45977272c69a3f7891.tmp
<Current directory>\$dpx$.tmp\119cc7080be81845bd6e083fa595c196.tmp
<Current directory>\$dpx$.tmp\2147843be0bc8e4e92a5513e7ca7d281.tmp
<Current directory>\$dpx$.tmp\3070f1a3501e734e9e7d1d5d9f5697e3.tmp
<Current directory>\$dpx$.tmp\3c5d95736f10b14aaa43c02fea956c5d.tmp
<Current directory>\$dpx$.tmp\40fc2f0e7e36b645937ca1de0f924741.tmp
<Current directory>\$dpx$.tmp\33a5a22224190245b601243dab08d101.tmp
<Current directory>\$dpx$.tmp\2c9d7ba3dcca6241bd0b94ee32449b93.tmp
<Current directory>\$dpx$.tmp\6f1a2ec24a000a4998eb6ce4d617f891.tmp
<Current directory>\$dpx$.tmp\7fb7a7526213ce489028a698e9ff369c.tmp
<Current directory>\$dpx$.tmp\da20123e348d62488942a0e9dc9758e4.tmp

Sets the 'hidden' attribute to the following files

<Current directory>\api-ms-win-core-console-l1-1-0.dll
<Current directory>\api-ms-win-crt-conio-l1-1-0.dll
<Current directory>\api-ms-win-crt-convert-l1-1-0.dll
<Current directory>\api-ms-win-crt-environment-l1-1-0.dll
<Current directory>\api-ms-win-crt-filesystem-l1-1-0.dll
<Current directory>\api-ms-win-crt-heap-l1-1-0.dll
<Current directory>\api-ms-win-crt-locale-l1-1-0.dll
<Current directory>\api-ms-win-crt-math-l1-1-0.dll
<Current directory>\api-ms-win-core-timezone-l1-1-0.dll
<Current directory>\api-ms-win-core-util-l1-1-0.dll
<Current directory>\api-ms-win-crt-multibyte-l1-1-0.dll
<Current directory>\api-ms-win-crt-runtime-l1-1-0.dll
<Current directory>\api-ms-win-crt-stdio-l1-1-0.dll
<Current directory>\api-ms-win-crt-string-l1-1-0.dll
<Current directory>\api-ms-win-crt-time-l1-1-0.dll
<Current directory>\api-ms-win-crt-utility-l1-1-0.dll
<Current directory>\msvcp140.dll
<Current directory>\opencl.dll
<Current directory>\api-ms-win-crt-private-l1-1-0.dll
<Current directory>\api-ms-win-crt-process-l1-1-0.dll
<Current directory>\api-ms-win-core-sysinfo-l1-1-0.dll
<Current directory>\api-ms-win-core-synch-l1-2-0.dll
<Current directory>\api-ms-win-core-synch-l1-1-0.dll
<Current directory>\api-ms-win-core-debug-l1-1-0.dll
<Current directory>\api-ms-win-core-errorhandling-l1-1-0.dll
<Current directory>\api-ms-win-core-file-l1-1-0.dll
<Current directory>\api-ms-win-core-file-l1-2-0.dll
<Current directory>\api-ms-win-core-file-l2-1-0.dll
<Current directory>\api-ms-win-core-handle-l1-1-0.dll
<Current directory>\api-ms-win-core-heap-l1-1-0.dll
<Current directory>\api-ms-win-core-interlocked-l1-1-0.dll
<Current directory>\api-ms-win-core-datetime-l1-1-0.dll
<Current directory>\api-ms-win-core-libraryloader-l1-1-0.dll
<Current directory>\api-ms-win-core-memory-l1-1-0.dll
<Current directory>\api-ms-win-core-namedpipe-l1-1-0.dll
<Current directory>\api-ms-win-core-processenvironment-l1-1-0.dll
<Current directory>\api-ms-win-core-processthreads-l1-1-0.dll
<Current directory>\api-ms-win-core-processthreads-l1-1-1.dll
<Current directory>\api-ms-win-core-profile-l1-1-0.dll
<Current directory>\api-ms-win-core-rtlsupport-l1-1-0.dll
<Current directory>\api-ms-win-core-string-l1-1-0.dll
<Current directory>\api-ms-win-core-localization-l1-2-0.dll
<Current directory>\ucrtbase.dll
<Current directory>\vcruntime140.dll

Deletes the following files

<Current directory>\d.cab

Moves the following files

from <Current directory>\$dpx$.tmp\b5fe763685618240ba2f482eb484883e.tmp to <Current directory>\api-ms-win-core-console-l1-1-0.dll
from <Current directory>\$dpx$.tmp\bcd39c38dce6f24da6c70fa1bf24d8f0.tmp to <Current directory>\api-ms-win-crt-conio-l1-1-0.dll
from <Current directory>\$dpx$.tmp\0f2cd4ef71d48148839460ff092358a8.tmp to <Current directory>\api-ms-win-crt-convert-l1-1-0.dll
from <Current directory>\$dpx$.tmp\e7d6de46666a514ab7f1fb595390ad03.tmp to <Current directory>\api-ms-win-crt-environment-l1-1-0.dll
from <Current directory>\$dpx$.tmp\c32237ff7776394a835c47cbdeeac675.tmp to <Current directory>\api-ms-win-crt-filesystem-l1-1-0.dll
from <Current directory>\$dpx$.tmp\f4a812513262044ea7e438791ad0dcd7.tmp to <Current directory>\api-ms-win-crt-heap-l1-1-0.dll
from <Current directory>\$dpx$.tmp\4c1034c8d8348a4883fd67af708e10bb.tmp to <Current directory>\api-ms-win-crt-locale-l1-1-0.dll
from <Current directory>\$dpx$.tmp\b6ad9f5d05667645a4246f3cefb8e3f2.tmp to <Current directory>\api-ms-win-crt-math-l1-1-0.dll
from <Current directory>\$dpx$.tmp\01fbc93336805843b93703c5838f71a0.tmp to <Current directory>\api-ms-win-core-timezone-l1-1-0.dll
from <Current directory>\$dpx$.tmp\02a97af079575648b8cb818b8fa43141.tmp to <Current directory>\api-ms-win-core-util-l1-1-0.dll
from <Current directory>\$dpx$.tmp\5d759be2b0c115458caffe29e68f5275.tmp to <Current directory>\api-ms-win-crt-multibyte-l1-1-0.dll
from <Current directory>\$dpx$.tmp\76b9d0abfb4d4247b58a7c856074f58d.tmp to <Current directory>\api-ms-win-crt-runtime-l1-1-0.dll
from <Current directory>\$dpx$.tmp\66116038cb53794ba84fe6a1880e7f3b.tmp to <Current directory>\api-ms-win-crt-stdio-l1-1-0.dll
from <Current directory>\$dpx$.tmp\53656dde94273c438083395497e8fff2.tmp to <Current directory>\api-ms-win-crt-string-l1-1-0.dll
from <Current directory>\$dpx$.tmp\c0d282a9a30222428c8c55f86d2036ff.tmp to <Current directory>\api-ms-win-crt-time-l1-1-0.dll
from <Current directory>\$dpx$.tmp\08e2081f92654843bb091bd20cbd8a5b.tmp to <Current directory>\api-ms-win-crt-utility-l1-1-0.dll
from <Current directory>\$dpx$.tmp\8ebef83cc8625a4ea770ee94ed3adef1.tmp to <Current directory>\msvcp140.dll
from <Current directory>\$dpx$.tmp\f8728ed687913f4b98dcc425ced21aee.tmp to <Current directory>\opencl.dll
from <Current directory>\$dpx$.tmp\8bca34ec6ffd6a4e8c8f91461cb9398d.tmp to <Current directory>\api-ms-win-crt-private-l1-1-0.dll
from <Current directory>\$dpx$.tmp\756e187ca2058c49bad8178124f7183d.tmp to <Current directory>\api-ms-win-crt-process-l1-1-0.dll
from <Current directory>\$dpx$.tmp\5c6639449cfea64db86a05a7ecc0f472.tmp to <Current directory>\api-ms-win-core-sysinfo-l1-1-0.dll
from <Current directory>\$dpx$.tmp\0b2036eece07f748bd055b13f91fff02.tmp to <Current directory>\api-ms-win-core-synch-l1-2-0.dll
from <Current directory>\$dpx$.tmp\7fb7a7526213ce489028a698e9ff369c.tmp to <Current directory>\api-ms-win-core-synch-l1-1-0.dll
from <Current directory>\$dpx$.tmp\7d311300a36d1646911c92b83e1f1986.tmp to <Current directory>\api-ms-win-core-debug-l1-1-0.dll
from <Current directory>\$dpx$.tmp\623ddcb56213c2428518a6ffeeda84c0.tmp to <Current directory>\api-ms-win-core-errorhandling-l1-1-0.dll
from <Current directory>\$dpx$.tmp\a161e5629a8b794291f70d4075414364.tmp to <Current directory>\api-ms-win-core-file-l1-1-0.dll
from <Current directory>\$dpx$.tmp\f994704068bc4841bc61b7a3047c8bd8.tmp to <Current directory>\api-ms-win-core-file-l1-2-0.dll
from <Current directory>\$dpx$.tmp\59b286802853c64bb46563e90dccd960.tmp to <Current directory>\api-ms-win-core-file-l2-1-0.dll
from <Current directory>\$dpx$.tmp\fa1eb78801b13440bad40c6de9822100.tmp to <Current directory>\api-ms-win-core-handle-l1-1-0.dll
from <Current directory>\$dpx$.tmp\628c71c8322c834bbae77a147700b2c8.tmp to <Current directory>\api-ms-win-core-heap-l1-1-0.dll
from <Current directory>\$dpx$.tmp\5f43dc4e93a0dd42bbb8f23a42f71254.tmp to <Current directory>\api-ms-win-core-interlocked-l1-1-0.dll
from <Current directory>\$dpx$.tmp\00f8441551980942a629594f3389711d.tmp to <Current directory>\api-ms-win-core-datetime-l1-1-0.dll
from <Current directory>\$dpx$.tmp\89292456e36e5f45977272c69a3f7891.tmp to <Current directory>\api-ms-win-core-libraryloader-l1-1-0.dll
from <Current directory>\$dpx$.tmp\2147843be0bc8e4e92a5513e7ca7d281.tmp to <Current directory>\api-ms-win-core-memory-l1-1-0.dll
from <Current directory>\$dpx$.tmp\3070f1a3501e734e9e7d1d5d9f5697e3.tmp to <Current directory>\api-ms-win-core-namedpipe-l1-1-0.dll
from <Current directory>\$dpx$.tmp\3c5d95736f10b14aaa43c02fea956c5d.tmp to <Current directory>\api-ms-win-core-processenvironment-l1-1-0.dll
from <Current directory>\$dpx$.tmp\40fc2f0e7e36b645937ca1de0f924741.tmp to <Current directory>\api-ms-win-core-processthreads-l1-1-0.dll
from <Current directory>\$dpx$.tmp\33a5a22224190245b601243dab08d101.tmp to <Current directory>\api-ms-win-core-processthreads-l1-1-1.dll
from <Current directory>\$dpx$.tmp\2c9d7ba3dcca6241bd0b94ee32449b93.tmp to <Current directory>\api-ms-win-core-profile-l1-1-0.dll
from <Current directory>\$dpx$.tmp\6f1a2ec24a000a4998eb6ce4d617f891.tmp to <Current directory>\api-ms-win-core-rtlsupport-l1-1-0.dll
from <Current directory>\$dpx$.tmp\7616fe15d00a5d4f83acedc110bdece3.tmp to <Current directory>\api-ms-win-core-string-l1-1-0.dll
from <Current directory>\$dpx$.tmp\119cc7080be81845bd6e083fa595c196.tmp to <Current directory>\api-ms-win-core-localization-l1-2-0.dll
from <Current directory>\$dpx$.tmp\7eb223b15c6440449e2bc4b842ead7b5.tmp to <Current directory>\ucrtbase.dll
from <Current directory>\$dpx$.tmp\da20123e348d62488942a0e9dc9758e4.tmp to <Current directory>\vcruntime140.dll

Network activity

UDP

DNS ASK lp##.beahh.com
DNS ASK lp##.abbny.com
DNS ASK lp##.haqo.net

Miscellaneous

Creates and executes the following

'<SYSTEM32>\cmd.exe' /c expand d.cab -f:* . & del d.cab /a' (with hidden window)

Executes the following

'<SYSTEM32>\cmd.exe' /c expand d.cab -f:* . & del d.cab /a
'<SYSTEM32>\expand.exe' d.cab -f:* .

Технології

Терміни

Навчання

Міфи

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней