Trojan.MulDrop11.22311

Technical Information

Modifies file system

Creates the following files

<Current directory>\d.cab
<Current directory>\$dpx$.tmp\89ac1f97f5cdf141b111018d82804c03.tmp
<Current directory>\$dpx$.tmp\b94d34579a2bde47aa1cd8606cc44e53.tmp
<Current directory>\$dpx$.tmp\8c810ae1f8175742a458646a589798e3.tmp
<Current directory>\$dpx$.tmp\5eac42530c810c4785814297bfbee214.tmp
<Current directory>\$dpx$.tmp\16bbc4e005b96440af0d9d8e146d3e7d.tmp
<Current directory>\$dpx$.tmp\d5d920b861b6bd4992135842e5013f90.tmp
<Current directory>\$dpx$.tmp\4c80b95b53da2f4abf1d5d1eabad31c8.tmp
<Current directory>\$dpx$.tmp\9ebd39448d2ed9449bf17001f5df175f.tmp
<Current directory>\$dpx$.tmp\f8269afbe591764aa278905646a5726c.tmp
<Current directory>\$dpx$.tmp\172cf975a3ff164789007d7bef6155fa.tmp
<Current directory>\$dpx$.tmp\5c8d2aa08f02b84796ac71fb36dbe5d0.tmp
<Current directory>\$dpx$.tmp\c0296df7cf07ee41bde5d50463965dd0.tmp
<Current directory>\$dpx$.tmp\5357a60332ecba4088f8a539f52de363.tmp
<Current directory>\$dpx$.tmp\18d116f8a3434946a49233ea78efbd88.tmp
<Current directory>\$dpx$.tmp\12f7e1bfce43954dbb3e09866a9c7c55.tmp
<Current directory>\$dpx$.tmp\eddc5d50d764214ea2f2248056f56321.tmp
<Current directory>\$dpx$.tmp\5166dfc38f50d740a2eb3c31c9cd7ac6.tmp
<Current directory>\$dpx$.tmp\131425f6f0c51e46a9606890897c589e.tmp
<Current directory>\$dpx$.tmp\dff1a976fe76aa4a9233406da57bc0da.tmp
<Current directory>\$dpx$.tmp\c74e89584b54474b901033cbd1a704ce.tmp
<Current directory>\$dpx$.tmp\09f0c3bf815eb242b1e94982472aa6ba.tmp
<Current directory>\$dpx$.tmp\bd3490f308ebea4285906aa4cda3db79.tmp
<Current directory>\$dpx$.tmp\9f7c2540ecaa944aa5f75f95d17da1c9.tmp
<Current directory>\$dpx$.tmp\d534238ffb5cb6408a4233484f699893.tmp
<Current directory>\$dpx$.tmp\83f7dc140ae85c4192115bafd9597f54.tmp
<Current directory>\$dpx$.tmp\27570cf69a02e148a4b4a0aa40c4e8d4.tmp
<Current directory>\$dpx$.tmp\d885c69497db174ebe44f8e66ff26195.tmp
<Current directory>\$dpx$.tmp\cc0bc21ea7c7c342bfd3a509cf53d622.tmp
<Current directory>\$dpx$.tmp\c991fecb55eeec44b84880705d007940.tmp
<Current directory>\$dpx$.tmp\4eb70d6e350b9f4a826d27ffeeb7114a.tmp
<Current directory>\$dpx$.tmp\f12a8611f03d4f47a6db80c361db62b2.tmp
<Current directory>\$dpx$.tmp\5c0cb4ec29a14749acacc235bf6991c9.tmp
<Current directory>\$dpx$.tmp\4c44a6cfb0677b4da6f53cb86b35e64b.tmp
<Current directory>\$dpx$.tmp\5bb041cafdd48d48a9fb783f8d640262.tmp
<Current directory>\$dpx$.tmp\09d7dc2d0fd3644181adef680447fc70.tmp
<Current directory>\$dpx$.tmp\631bc5b22ed5e848975d679942e9c1f9.tmp
<Current directory>\$dpx$.tmp\5b41f95aee3f6b418a1182c2fda7737d.tmp
<Current directory>\$dpx$.tmp\8457349695c31242b1c2213d741297f6.tmp
<Current directory>\$dpx$.tmp\0d3a3b2269df29488ed0f3c72fe5c371.tmp
<Current directory>\$dpx$.tmp\db92c1d61d1614438d5a0d1d71552f6f.tmp
<Current directory>\$dpx$.tmp\964f05e2854f5545ba77197d828115b3.tmp
<Current directory>\$dpx$.tmp\5b5d25e447a04044b018d44764cc292a.tmp
<Current directory>\$dpx$.tmp\1bdda98546c5b445b50c7a7bdaaf084f.tmp
<Current directory>\$dpx$.tmp\157d0dce0d0ab444a63811f35c136ef3.tmp

Sets the 'hidden' attribute to the following files

<Current directory>\api-ms-win-core-console-l1-1-0.dll
<Current directory>\api-ms-win-crt-conio-l1-1-0.dll
<Current directory>\api-ms-win-crt-convert-l1-1-0.dll
<Current directory>\api-ms-win-crt-environment-l1-1-0.dll
<Current directory>\api-ms-win-crt-filesystem-l1-1-0.dll
<Current directory>\api-ms-win-crt-heap-l1-1-0.dll
<Current directory>\api-ms-win-crt-locale-l1-1-0.dll
<Current directory>\api-ms-win-crt-math-l1-1-0.dll
<Current directory>\api-ms-win-core-timezone-l1-1-0.dll
<Current directory>\api-ms-win-core-util-l1-1-0.dll
<Current directory>\api-ms-win-crt-multibyte-l1-1-0.dll
<Current directory>\api-ms-win-crt-runtime-l1-1-0.dll
<Current directory>\api-ms-win-crt-stdio-l1-1-0.dll
<Current directory>\api-ms-win-crt-string-l1-1-0.dll
<Current directory>\api-ms-win-crt-time-l1-1-0.dll
<Current directory>\api-ms-win-crt-utility-l1-1-0.dll
<Current directory>\msvcp140.dll
<Current directory>\opencl.dll
<Current directory>\api-ms-win-crt-private-l1-1-0.dll
<Current directory>\api-ms-win-crt-process-l1-1-0.dll
<Current directory>\api-ms-win-core-sysinfo-l1-1-0.dll
<Current directory>\api-ms-win-core-synch-l1-2-0.dll
<Current directory>\api-ms-win-core-synch-l1-1-0.dll
<Current directory>\api-ms-win-core-debug-l1-1-0.dll
<Current directory>\api-ms-win-core-errorhandling-l1-1-0.dll
<Current directory>\api-ms-win-core-file-l1-1-0.dll
<Current directory>\api-ms-win-core-file-l1-2-0.dll
<Current directory>\api-ms-win-core-file-l2-1-0.dll
<Current directory>\api-ms-win-core-handle-l1-1-0.dll
<Current directory>\api-ms-win-core-heap-l1-1-0.dll
<Current directory>\api-ms-win-core-interlocked-l1-1-0.dll
<Current directory>\api-ms-win-core-datetime-l1-1-0.dll
<Current directory>\api-ms-win-core-libraryloader-l1-1-0.dll
<Current directory>\api-ms-win-core-memory-l1-1-0.dll
<Current directory>\api-ms-win-core-namedpipe-l1-1-0.dll
<Current directory>\api-ms-win-core-processenvironment-l1-1-0.dll
<Current directory>\api-ms-win-core-processthreads-l1-1-0.dll
<Current directory>\api-ms-win-core-processthreads-l1-1-1.dll
<Current directory>\api-ms-win-core-profile-l1-1-0.dll
<Current directory>\api-ms-win-core-rtlsupport-l1-1-0.dll
<Current directory>\api-ms-win-core-string-l1-1-0.dll
<Current directory>\api-ms-win-core-localization-l1-2-0.dll
<Current directory>\ucrtbase.dll
<Current directory>\vcruntime140.dll

Deletes the following files

<Current directory>\d.cab

Moves the following files

from <Current directory>\$dpx$.tmp\d534238ffb5cb6408a4233484f699893.tmp to <Current directory>\api-ms-win-core-console-l1-1-0.dll
from <Current directory>\$dpx$.tmp\8c810ae1f8175742a458646a589798e3.tmp to <Current directory>\api-ms-win-crt-conio-l1-1-0.dll
from <Current directory>\$dpx$.tmp\5eac42530c810c4785814297bfbee214.tmp to <Current directory>\api-ms-win-crt-convert-l1-1-0.dll
from <Current directory>\$dpx$.tmp\16bbc4e005b96440af0d9d8e146d3e7d.tmp to <Current directory>\api-ms-win-crt-environment-l1-1-0.dll
from <Current directory>\$dpx$.tmp\d5d920b861b6bd4992135842e5013f90.tmp to <Current directory>\api-ms-win-crt-filesystem-l1-1-0.dll
from <Current directory>\$dpx$.tmp\4c80b95b53da2f4abf1d5d1eabad31c8.tmp to <Current directory>\api-ms-win-crt-heap-l1-1-0.dll
from <Current directory>\$dpx$.tmp\9ebd39448d2ed9449bf17001f5df175f.tmp to <Current directory>\api-ms-win-crt-locale-l1-1-0.dll
from <Current directory>\$dpx$.tmp\f8269afbe591764aa278905646a5726c.tmp to <Current directory>\api-ms-win-crt-math-l1-1-0.dll
from <Current directory>\$dpx$.tmp\89ac1f97f5cdf141b111018d82804c03.tmp to <Current directory>\api-ms-win-core-timezone-l1-1-0.dll
from <Current directory>\$dpx$.tmp\b94d34579a2bde47aa1cd8606cc44e53.tmp to <Current directory>\api-ms-win-core-util-l1-1-0.dll
from <Current directory>\$dpx$.tmp\172cf975a3ff164789007d7bef6155fa.tmp to <Current directory>\api-ms-win-crt-multibyte-l1-1-0.dll
from <Current directory>\$dpx$.tmp\5357a60332ecba4088f8a539f52de363.tmp to <Current directory>\api-ms-win-crt-runtime-l1-1-0.dll
from <Current directory>\$dpx$.tmp\18d116f8a3434946a49233ea78efbd88.tmp to <Current directory>\api-ms-win-crt-stdio-l1-1-0.dll
from <Current directory>\$dpx$.tmp\12f7e1bfce43954dbb3e09866a9c7c55.tmp to <Current directory>\api-ms-win-crt-string-l1-1-0.dll
from <Current directory>\$dpx$.tmp\eddc5d50d764214ea2f2248056f56321.tmp to <Current directory>\api-ms-win-crt-time-l1-1-0.dll
from <Current directory>\$dpx$.tmp\5166dfc38f50d740a2eb3c31c9cd7ac6.tmp to <Current directory>\api-ms-win-crt-utility-l1-1-0.dll
from <Current directory>\$dpx$.tmp\131425f6f0c51e46a9606890897c589e.tmp to <Current directory>\msvcp140.dll
from <Current directory>\$dpx$.tmp\dff1a976fe76aa4a9233406da57bc0da.tmp to <Current directory>\opencl.dll
from <Current directory>\$dpx$.tmp\5c8d2aa08f02b84796ac71fb36dbe5d0.tmp to <Current directory>\api-ms-win-crt-private-l1-1-0.dll
from <Current directory>\$dpx$.tmp\c0296df7cf07ee41bde5d50463965dd0.tmp to <Current directory>\api-ms-win-crt-process-l1-1-0.dll
from <Current directory>\$dpx$.tmp\c74e89584b54474b901033cbd1a704ce.tmp to <Current directory>\api-ms-win-core-sysinfo-l1-1-0.dll
from <Current directory>\$dpx$.tmp\bd3490f308ebea4285906aa4cda3db79.tmp to <Current directory>\api-ms-win-core-synch-l1-2-0.dll
from <Current directory>\$dpx$.tmp\1bdda98546c5b445b50c7a7bdaaf084f.tmp to <Current directory>\api-ms-win-core-synch-l1-1-0.dll
from <Current directory>\$dpx$.tmp\27570cf69a02e148a4b4a0aa40c4e8d4.tmp to <Current directory>\api-ms-win-core-debug-l1-1-0.dll
from <Current directory>\$dpx$.tmp\d885c69497db174ebe44f8e66ff26195.tmp to <Current directory>\api-ms-win-core-errorhandling-l1-1-0.dll
from <Current directory>\$dpx$.tmp\cc0bc21ea7c7c342bfd3a509cf53d622.tmp to <Current directory>\api-ms-win-core-file-l1-1-0.dll
from <Current directory>\$dpx$.tmp\c991fecb55eeec44b84880705d007940.tmp to <Current directory>\api-ms-win-core-file-l1-2-0.dll
from <Current directory>\$dpx$.tmp\4eb70d6e350b9f4a826d27ffeeb7114a.tmp to <Current directory>\api-ms-win-core-file-l2-1-0.dll
from <Current directory>\$dpx$.tmp\f12a8611f03d4f47a6db80c361db62b2.tmp to <Current directory>\api-ms-win-core-handle-l1-1-0.dll
from <Current directory>\$dpx$.tmp\5c0cb4ec29a14749acacc235bf6991c9.tmp to <Current directory>\api-ms-win-core-heap-l1-1-0.dll
from <Current directory>\$dpx$.tmp\4c44a6cfb0677b4da6f53cb86b35e64b.tmp to <Current directory>\api-ms-win-core-interlocked-l1-1-0.dll
from <Current directory>\$dpx$.tmp\83f7dc140ae85c4192115bafd9597f54.tmp to <Current directory>\api-ms-win-core-datetime-l1-1-0.dll
from <Current directory>\$dpx$.tmp\5bb041cafdd48d48a9fb783f8d640262.tmp to <Current directory>\api-ms-win-core-libraryloader-l1-1-0.dll
from <Current directory>\$dpx$.tmp\631bc5b22ed5e848975d679942e9c1f9.tmp to <Current directory>\api-ms-win-core-memory-l1-1-0.dll
from <Current directory>\$dpx$.tmp\5b41f95aee3f6b418a1182c2fda7737d.tmp to <Current directory>\api-ms-win-core-namedpipe-l1-1-0.dll
from <Current directory>\$dpx$.tmp\8457349695c31242b1c2213d741297f6.tmp to <Current directory>\api-ms-win-core-processenvironment-l1-1-0.dll
from <Current directory>\$dpx$.tmp\0d3a3b2269df29488ed0f3c72fe5c371.tmp to <Current directory>\api-ms-win-core-processthreads-l1-1-0.dll
from <Current directory>\$dpx$.tmp\db92c1d61d1614438d5a0d1d71552f6f.tmp to <Current directory>\api-ms-win-core-processthreads-l1-1-1.dll
from <Current directory>\$dpx$.tmp\964f05e2854f5545ba77197d828115b3.tmp to <Current directory>\api-ms-win-core-profile-l1-1-0.dll
from <Current directory>\$dpx$.tmp\5b5d25e447a04044b018d44764cc292a.tmp to <Current directory>\api-ms-win-core-rtlsupport-l1-1-0.dll
from <Current directory>\$dpx$.tmp\9f7c2540ecaa944aa5f75f95d17da1c9.tmp to <Current directory>\api-ms-win-core-string-l1-1-0.dll
from <Current directory>\$dpx$.tmp\09d7dc2d0fd3644181adef680447fc70.tmp to <Current directory>\api-ms-win-core-localization-l1-2-0.dll
from <Current directory>\$dpx$.tmp\09f0c3bf815eb242b1e94982472aa6ba.tmp to <Current directory>\ucrtbase.dll
from <Current directory>\$dpx$.tmp\157d0dce0d0ab444a63811f35c136ef3.tmp to <Current directory>\vcruntime140.dll

Network activity

UDP

DNS ASK lp##.beahh.com
DNS ASK lp##.abbny.com
DNS ASK lp##.haqo.net

Miscellaneous

Creates and executes the following

'<SYSTEM32>\cmd.exe' /c expand d.cab -f:* . & del d.cab /a' (with hidden window)

Executes the following

'<SYSTEM32>\cmd.exe' /c expand d.cab -f:* . & del d.cab /a
'<SYSTEM32>\expand.exe' d.cab -f:* .

Технології

Терміни

Навчання

Міфи

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней