Trojan.MulDrop11.22310

Technical Information

Modifies file system

Creates the following files

<Current directory>\d.cab
<Current directory>\$dpx$.tmp\09128f4512172f4880253afb6a4a3331.tmp
<Current directory>\$dpx$.tmp\5c524b98b0106e40b2b53249c321980c.tmp
<Current directory>\$dpx$.tmp\1501642bcd61054499c4c27566aa51eb.tmp
<Current directory>\$dpx$.tmp\804646be3be31441a429248c44514e8a.tmp
<Current directory>\$dpx$.tmp\490e306a035bc24c93a0fae97dad101a.tmp
<Current directory>\$dpx$.tmp\7a77ca22bc5c454eb6abdcfd34adaf12.tmp
<Current directory>\$dpx$.tmp\7026ff49e01c9b4dabc9c537f836a4ca.tmp
<Current directory>\$dpx$.tmp\4975b36be587f94ca58e1727e3ceabee.tmp
<Current directory>\$dpx$.tmp\d5b93cc4f2ee6d41be3fbd59fbac519a.tmp
<Current directory>\$dpx$.tmp\cc074e7b79c4504396a287e3b8e43a3b.tmp
<Current directory>\$dpx$.tmp\0533628f3db199428eecb01ff5b6d2d4.tmp
<Current directory>\$dpx$.tmp\c0d63f0ddc8b224a8cb5a4ad0bf8c9cf.tmp
<Current directory>\$dpx$.tmp\5022256bf0dfb04893e7045e88aa5a47.tmp
<Current directory>\$dpx$.tmp\dd101d737786bc4f971e1280856da2bf.tmp
<Current directory>\$dpx$.tmp\97b81b796c536f4687ece994b9472f8f.tmp
<Current directory>\$dpx$.tmp\af0d4dad373af84895ed979e630bf6ff.tmp
<Current directory>\$dpx$.tmp\0b51a33a5850e747982a8e49938f1462.tmp
<Current directory>\$dpx$.tmp\153b1e09c0422f4ab406b29909e64c7e.tmp
<Current directory>\$dpx$.tmp\e035cd7d93e220438878c9c0e43a9cfa.tmp
<Current directory>\$dpx$.tmp\54702753db504c4a9e070608bc1dc229.tmp
<Current directory>\$dpx$.tmp\928b66dbe1e47d4fafbe39ff46e8ea43.tmp
<Current directory>\$dpx$.tmp\7e88c7f6bf06034a88e753b1b846fab6.tmp
<Current directory>\$dpx$.tmp\6959c696a7f13045806eebdebf4e00d0.tmp
<Current directory>\$dpx$.tmp\8fbbb5ee28be99469b5ebbf390a4b1dd.tmp
<Current directory>\$dpx$.tmp\231dca348f59694191ca6563e0b8cbf0.tmp
<Current directory>\$dpx$.tmp\f100b7860a126743a5e512c06564ba05.tmp
<Current directory>\$dpx$.tmp\b7371b0ab6383945b96936a282649b3b.tmp
<Current directory>\$dpx$.tmp\688a02688a22d94c81c25391bb23c926.tmp
<Current directory>\$dpx$.tmp\ea17972f402bdd40810aad72c96db3aa.tmp
<Current directory>\$dpx$.tmp\c40025f2defecb4f9deb85256416ea16.tmp
<Current directory>\$dpx$.tmp\97250098bb229c459712579a9e6581ee.tmp
<Current directory>\$dpx$.tmp\77d6571c979a61469050ad6f9b5a0b37.tmp
<Current directory>\$dpx$.tmp\dafd5212fb2e784abcdce600b75d34b1.tmp
<Current directory>\$dpx$.tmp\532eb2bee9a2b146b2d2f1b82b179719.tmp
<Current directory>\$dpx$.tmp\c87514fdc8cdcc45bb6e96a42add1806.tmp
<Current directory>\$dpx$.tmp\58e4e98acf49474280e2177bf6a461e6.tmp
<Current directory>\$dpx$.tmp\a46e5cd468d32449b680fdc0391b101a.tmp
<Current directory>\$dpx$.tmp\03516631ac73d343b11a2c8adb7253b9.tmp
<Current directory>\$dpx$.tmp\bc91fc8c25aeb44b92fca2d1f602b85e.tmp
<Current directory>\$dpx$.tmp\36119467bc56914dbf7d250fefcfa4bd.tmp
<Current directory>\$dpx$.tmp\42ec9e731a126e4cad4fbd2f2c7a506f.tmp
<Current directory>\$dpx$.tmp\4821ca225817d74a925b217f4fff8a78.tmp
<Current directory>\$dpx$.tmp\e2cb6f84ad5e7f418bee45a203a3b00a.tmp
<Current directory>\$dpx$.tmp\64105c7e66df89478736d88b98b89833.tmp

Sets the 'hidden' attribute to the following files

<Current directory>\api-ms-win-core-console-l1-1-0.dll
<Current directory>\api-ms-win-crt-conio-l1-1-0.dll
<Current directory>\api-ms-win-crt-convert-l1-1-0.dll
<Current directory>\api-ms-win-crt-environment-l1-1-0.dll
<Current directory>\api-ms-win-crt-filesystem-l1-1-0.dll
<Current directory>\api-ms-win-crt-heap-l1-1-0.dll
<Current directory>\api-ms-win-crt-locale-l1-1-0.dll
<Current directory>\api-ms-win-crt-math-l1-1-0.dll
<Current directory>\api-ms-win-core-timezone-l1-1-0.dll
<Current directory>\api-ms-win-core-util-l1-1-0.dll
<Current directory>\api-ms-win-crt-multibyte-l1-1-0.dll
<Current directory>\api-ms-win-crt-runtime-l1-1-0.dll
<Current directory>\api-ms-win-crt-stdio-l1-1-0.dll
<Current directory>\api-ms-win-crt-string-l1-1-0.dll
<Current directory>\api-ms-win-crt-time-l1-1-0.dll
<Current directory>\api-ms-win-crt-utility-l1-1-0.dll
<Current directory>\msvcp140.dll
<Current directory>\opencl.dll
<Current directory>\api-ms-win-crt-private-l1-1-0.dll
<Current directory>\api-ms-win-crt-process-l1-1-0.dll
<Current directory>\api-ms-win-core-sysinfo-l1-1-0.dll
<Current directory>\api-ms-win-core-synch-l1-2-0.dll
<Current directory>\api-ms-win-core-synch-l1-1-0.dll
<Current directory>\api-ms-win-core-debug-l1-1-0.dll
<Current directory>\api-ms-win-core-errorhandling-l1-1-0.dll
<Current directory>\api-ms-win-core-file-l1-1-0.dll
<Current directory>\api-ms-win-core-file-l1-2-0.dll
<Current directory>\api-ms-win-core-file-l2-1-0.dll
<Current directory>\api-ms-win-core-handle-l1-1-0.dll
<Current directory>\api-ms-win-core-heap-l1-1-0.dll
<Current directory>\api-ms-win-core-interlocked-l1-1-0.dll
<Current directory>\api-ms-win-core-datetime-l1-1-0.dll
<Current directory>\api-ms-win-core-libraryloader-l1-1-0.dll
<Current directory>\api-ms-win-core-memory-l1-1-0.dll
<Current directory>\api-ms-win-core-namedpipe-l1-1-0.dll
<Current directory>\api-ms-win-core-processenvironment-l1-1-0.dll
<Current directory>\api-ms-win-core-processthreads-l1-1-0.dll
<Current directory>\api-ms-win-core-processthreads-l1-1-1.dll
<Current directory>\api-ms-win-core-profile-l1-1-0.dll
<Current directory>\api-ms-win-core-rtlsupport-l1-1-0.dll
<Current directory>\api-ms-win-core-string-l1-1-0.dll
<Current directory>\api-ms-win-core-localization-l1-2-0.dll
<Current directory>\ucrtbase.dll
<Current directory>\vcruntime140.dll

Deletes the following files

<Current directory>\d.cab

Moves the following files

from <Current directory>\$dpx$.tmp\8fbbb5ee28be99469b5ebbf390a4b1dd.tmp to <Current directory>\api-ms-win-core-console-l1-1-0.dll
from <Current directory>\$dpx$.tmp\1501642bcd61054499c4c27566aa51eb.tmp to <Current directory>\api-ms-win-crt-conio-l1-1-0.dll
from <Current directory>\$dpx$.tmp\804646be3be31441a429248c44514e8a.tmp to <Current directory>\api-ms-win-crt-convert-l1-1-0.dll
from <Current directory>\$dpx$.tmp\490e306a035bc24c93a0fae97dad101a.tmp to <Current directory>\api-ms-win-crt-environment-l1-1-0.dll
from <Current directory>\$dpx$.tmp\7a77ca22bc5c454eb6abdcfd34adaf12.tmp to <Current directory>\api-ms-win-crt-filesystem-l1-1-0.dll
from <Current directory>\$dpx$.tmp\7026ff49e01c9b4dabc9c537f836a4ca.tmp to <Current directory>\api-ms-win-crt-heap-l1-1-0.dll
from <Current directory>\$dpx$.tmp\4975b36be587f94ca58e1727e3ceabee.tmp to <Current directory>\api-ms-win-crt-locale-l1-1-0.dll
from <Current directory>\$dpx$.tmp\d5b93cc4f2ee6d41be3fbd59fbac519a.tmp to <Current directory>\api-ms-win-crt-math-l1-1-0.dll
from <Current directory>\$dpx$.tmp\09128f4512172f4880253afb6a4a3331.tmp to <Current directory>\api-ms-win-core-timezone-l1-1-0.dll
from <Current directory>\$dpx$.tmp\5c524b98b0106e40b2b53249c321980c.tmp to <Current directory>\api-ms-win-core-util-l1-1-0.dll
from <Current directory>\$dpx$.tmp\cc074e7b79c4504396a287e3b8e43a3b.tmp to <Current directory>\api-ms-win-crt-multibyte-l1-1-0.dll
from <Current directory>\$dpx$.tmp\5022256bf0dfb04893e7045e88aa5a47.tmp to <Current directory>\api-ms-win-crt-runtime-l1-1-0.dll
from <Current directory>\$dpx$.tmp\dd101d737786bc4f971e1280856da2bf.tmp to <Current directory>\api-ms-win-crt-stdio-l1-1-0.dll
from <Current directory>\$dpx$.tmp\97b81b796c536f4687ece994b9472f8f.tmp to <Current directory>\api-ms-win-crt-string-l1-1-0.dll
from <Current directory>\$dpx$.tmp\af0d4dad373af84895ed979e630bf6ff.tmp to <Current directory>\api-ms-win-crt-time-l1-1-0.dll
from <Current directory>\$dpx$.tmp\0b51a33a5850e747982a8e49938f1462.tmp to <Current directory>\api-ms-win-crt-utility-l1-1-0.dll
from <Current directory>\$dpx$.tmp\153b1e09c0422f4ab406b29909e64c7e.tmp to <Current directory>\msvcp140.dll
from <Current directory>\$dpx$.tmp\e035cd7d93e220438878c9c0e43a9cfa.tmp to <Current directory>\opencl.dll
from <Current directory>\$dpx$.tmp\0533628f3db199428eecb01ff5b6d2d4.tmp to <Current directory>\api-ms-win-crt-private-l1-1-0.dll
from <Current directory>\$dpx$.tmp\c0d63f0ddc8b224a8cb5a4ad0bf8c9cf.tmp to <Current directory>\api-ms-win-crt-process-l1-1-0.dll
from <Current directory>\$dpx$.tmp\54702753db504c4a9e070608bc1dc229.tmp to <Current directory>\api-ms-win-core-sysinfo-l1-1-0.dll
from <Current directory>\$dpx$.tmp\7e88c7f6bf06034a88e753b1b846fab6.tmp to <Current directory>\api-ms-win-core-synch-l1-2-0.dll
from <Current directory>\$dpx$.tmp\e2cb6f84ad5e7f418bee45a203a3b00a.tmp to <Current directory>\api-ms-win-core-synch-l1-1-0.dll
from <Current directory>\$dpx$.tmp\f100b7860a126743a5e512c06564ba05.tmp to <Current directory>\api-ms-win-core-debug-l1-1-0.dll
from <Current directory>\$dpx$.tmp\b7371b0ab6383945b96936a282649b3b.tmp to <Current directory>\api-ms-win-core-errorhandling-l1-1-0.dll
from <Current directory>\$dpx$.tmp\688a02688a22d94c81c25391bb23c926.tmp to <Current directory>\api-ms-win-core-file-l1-1-0.dll
from <Current directory>\$dpx$.tmp\ea17972f402bdd40810aad72c96db3aa.tmp to <Current directory>\api-ms-win-core-file-l1-2-0.dll
from <Current directory>\$dpx$.tmp\c40025f2defecb4f9deb85256416ea16.tmp to <Current directory>\api-ms-win-core-file-l2-1-0.dll
from <Current directory>\$dpx$.tmp\97250098bb229c459712579a9e6581ee.tmp to <Current directory>\api-ms-win-core-handle-l1-1-0.dll
from <Current directory>\$dpx$.tmp\77d6571c979a61469050ad6f9b5a0b37.tmp to <Current directory>\api-ms-win-core-heap-l1-1-0.dll
from <Current directory>\$dpx$.tmp\dafd5212fb2e784abcdce600b75d34b1.tmp to <Current directory>\api-ms-win-core-interlocked-l1-1-0.dll
from <Current directory>\$dpx$.tmp\231dca348f59694191ca6563e0b8cbf0.tmp to <Current directory>\api-ms-win-core-datetime-l1-1-0.dll
from <Current directory>\$dpx$.tmp\532eb2bee9a2b146b2d2f1b82b179719.tmp to <Current directory>\api-ms-win-core-libraryloader-l1-1-0.dll
from <Current directory>\$dpx$.tmp\58e4e98acf49474280e2177bf6a461e6.tmp to <Current directory>\api-ms-win-core-memory-l1-1-0.dll
from <Current directory>\$dpx$.tmp\a46e5cd468d32449b680fdc0391b101a.tmp to <Current directory>\api-ms-win-core-namedpipe-l1-1-0.dll
from <Current directory>\$dpx$.tmp\03516631ac73d343b11a2c8adb7253b9.tmp to <Current directory>\api-ms-win-core-processenvironment-l1-1-0.dll
from <Current directory>\$dpx$.tmp\bc91fc8c25aeb44b92fca2d1f602b85e.tmp to <Current directory>\api-ms-win-core-processthreads-l1-1-0.dll
from <Current directory>\$dpx$.tmp\36119467bc56914dbf7d250fefcfa4bd.tmp to <Current directory>\api-ms-win-core-processthreads-l1-1-1.dll
from <Current directory>\$dpx$.tmp\42ec9e731a126e4cad4fbd2f2c7a506f.tmp to <Current directory>\api-ms-win-core-profile-l1-1-0.dll
from <Current directory>\$dpx$.tmp\4821ca225817d74a925b217f4fff8a78.tmp to <Current directory>\api-ms-win-core-rtlsupport-l1-1-0.dll
from <Current directory>\$dpx$.tmp\6959c696a7f13045806eebdebf4e00d0.tmp to <Current directory>\api-ms-win-core-string-l1-1-0.dll
from <Current directory>\$dpx$.tmp\c87514fdc8cdcc45bb6e96a42add1806.tmp to <Current directory>\api-ms-win-core-localization-l1-2-0.dll
from <Current directory>\$dpx$.tmp\928b66dbe1e47d4fafbe39ff46e8ea43.tmp to <Current directory>\ucrtbase.dll
from <Current directory>\$dpx$.tmp\64105c7e66df89478736d88b98b89833.tmp to <Current directory>\vcruntime140.dll

Network activity

UDP

DNS ASK lp##.beahh.com
DNS ASK lp##.abbny.com
DNS ASK lp##.haqo.net

Miscellaneous

Creates and executes the following

'<SYSTEM32>\cmd.exe' /c expand d.cab -f:* . & del d.cab /a' (with hidden window)

Executes the following

'<SYSTEM32>\cmd.exe' /c expand d.cab -f:* . & del d.cab /a
'<SYSTEM32>\expand.exe' d.cab -f:* .

Технології

Терміни

Навчання

Міфи

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней