Trojan.MulDrop11.20320

Technical Information

Modifies file system

Creates the following files

<Current directory>\d.cab
<Current directory>\$dpx$.tmp\5ca95889fb9abd4b8f140d3bf74d9f4a.tmp
<Current directory>\$dpx$.tmp\5da7ead0fa0a23478040000ddb8a2853.tmp
<Current directory>\$dpx$.tmp\7476de96ae2580439fc727255ec80c33.tmp
<Current directory>\$dpx$.tmp\e5153e1048375846a3be98b8332bc39f.tmp
<Current directory>\$dpx$.tmp\881f3a820d007143980fbcf03e309bbc.tmp
<Current directory>\$dpx$.tmp\ddbc5fb1e0e0a74191f374aaf2e4c18c.tmp
<Current directory>\$dpx$.tmp\e7aff62d70f2b3478afa13acaabb42cb.tmp
<Current directory>\$dpx$.tmp\36a5230b0d3e03428211e9f2d34eee2e.tmp
<Current directory>\$dpx$.tmp\e4d4dabf0ab71643a80ee5fa0fe3816f.tmp
<Current directory>\$dpx$.tmp\3cfc715cd7ff6c4187a67def7344f60f.tmp
<Current directory>\$dpx$.tmp\9fee37d17c170d4eb24942341db641b5.tmp
<Current directory>\$dpx$.tmp\3ef3be2e6d40bc45b00841b2629b6bd4.tmp
<Current directory>\$dpx$.tmp\a68d2c9d2c474545818bbd3a12959429.tmp
<Current directory>\$dpx$.tmp\026ad835f6265f42af97f0babd26ccba.tmp
<Current directory>\$dpx$.tmp\e2312a39d7d29f439bd21771073567a6.tmp
<Current directory>\$dpx$.tmp\d009b4471d387146b507d151a9c15f22.tmp
<Current directory>\$dpx$.tmp\5452eb1f7d65d241a302f347a7c68d3b.tmp
<Current directory>\$dpx$.tmp\f9e304d15d9ec542808e3eceff68fa45.tmp
<Current directory>\$dpx$.tmp\9b163ab78fdaad49a706c57900911ce2.tmp
<Current directory>\$dpx$.tmp\0e3cdc48b969324280cea6dd7d44a975.tmp
<Current directory>\$dpx$.tmp\b4be5b1001882f49b978409472cdf2d4.tmp
<Current directory>\$dpx$.tmp\b8923bf454778144b5a33fef059289cc.tmp
<Current directory>\$dpx$.tmp\5232b3523652e5429e1d927f8f9c1280.tmp
<Current directory>\$dpx$.tmp\186bc416e33ee7409fa629312b3ce681.tmp
<Current directory>\$dpx$.tmp\40b06b8afe7150419fd3d0b89c84b970.tmp
<Current directory>\$dpx$.tmp\1d62ef3e5a298f458698d8a77bc23673.tmp
<Current directory>\$dpx$.tmp\38f44cc537088f4bb494c0e014802fbe.tmp
<Current directory>\$dpx$.tmp\1ab8e8d8c8bf444c8e84243e9a622191.tmp
<Current directory>\$dpx$.tmp\d3aefbbbbe454547b7a8bfa9f61682ed.tmp
<Current directory>\$dpx$.tmp\14d43d96d9028246b670c8a082d3714e.tmp
<Current directory>\$dpx$.tmp\d01aa80f715c5a41af4aa905bc712cad.tmp
<Current directory>\$dpx$.tmp\7cd193e13b8ed04e90ec2ceada98fa52.tmp
<Current directory>\$dpx$.tmp\9ab35e05051b114ea86351fb80d75e35.tmp
<Current directory>\$dpx$.tmp\821073a655c355468d4c9e4947d5cd24.tmp
<Current directory>\$dpx$.tmp\c737f33f5e966d41a96714090071a50b.tmp
<Current directory>\$dpx$.tmp\77959de3b8028343a80fa476dcb143ab.tmp
<Current directory>\$dpx$.tmp\7cec923abac1ef44893209d36e6415eb.tmp
<Current directory>\$dpx$.tmp\92b5c8875ccdb342b721b77ca0c82e41.tmp
<Current directory>\$dpx$.tmp\b8d7663f0125e94eb9671b45a1d37185.tmp
<Current directory>\$dpx$.tmp\9e2b9f447c91b64d9ff09bd3aa1cfcd3.tmp
<Current directory>\$dpx$.tmp\fdc04fc28b877047890ebce04e367b06.tmp
<Current directory>\$dpx$.tmp\789ab5dff951e444b88ce86e521fe5d2.tmp
<Current directory>\$dpx$.tmp\95e6df5f02a50d418d9685a6af09447c.tmp
<Current directory>\$dpx$.tmp\4e7829c2333ec341944e02b87663e30c.tmp

Sets the 'hidden' attribute to the following files

<Current directory>\api-ms-win-core-console-l1-1-0.dll
<Current directory>\api-ms-win-crt-conio-l1-1-0.dll
<Current directory>\api-ms-win-crt-convert-l1-1-0.dll
<Current directory>\api-ms-win-crt-environment-l1-1-0.dll
<Current directory>\api-ms-win-crt-filesystem-l1-1-0.dll
<Current directory>\api-ms-win-crt-heap-l1-1-0.dll
<Current directory>\api-ms-win-crt-locale-l1-1-0.dll
<Current directory>\api-ms-win-crt-math-l1-1-0.dll
<Current directory>\api-ms-win-core-timezone-l1-1-0.dll
<Current directory>\api-ms-win-core-util-l1-1-0.dll
<Current directory>\api-ms-win-crt-multibyte-l1-1-0.dll
<Current directory>\api-ms-win-crt-runtime-l1-1-0.dll
<Current directory>\api-ms-win-crt-stdio-l1-1-0.dll
<Current directory>\api-ms-win-crt-string-l1-1-0.dll
<Current directory>\api-ms-win-crt-time-l1-1-0.dll
<Current directory>\api-ms-win-crt-utility-l1-1-0.dll
<Current directory>\msvcp140.dll
<Current directory>\opencl.dll
<Current directory>\api-ms-win-crt-private-l1-1-0.dll
<Current directory>\api-ms-win-crt-process-l1-1-0.dll
<Current directory>\api-ms-win-core-sysinfo-l1-1-0.dll
<Current directory>\api-ms-win-core-synch-l1-2-0.dll
<Current directory>\api-ms-win-core-synch-l1-1-0.dll
<Current directory>\api-ms-win-core-debug-l1-1-0.dll
<Current directory>\api-ms-win-core-errorhandling-l1-1-0.dll
<Current directory>\api-ms-win-core-file-l1-1-0.dll
<Current directory>\api-ms-win-core-file-l1-2-0.dll
<Current directory>\api-ms-win-core-file-l2-1-0.dll
<Current directory>\api-ms-win-core-handle-l1-1-0.dll
<Current directory>\api-ms-win-core-heap-l1-1-0.dll
<Current directory>\api-ms-win-core-interlocked-l1-1-0.dll
<Current directory>\api-ms-win-core-datetime-l1-1-0.dll
<Current directory>\api-ms-win-core-libraryloader-l1-1-0.dll
<Current directory>\api-ms-win-core-memory-l1-1-0.dll
<Current directory>\api-ms-win-core-namedpipe-l1-1-0.dll
<Current directory>\api-ms-win-core-processenvironment-l1-1-0.dll
<Current directory>\api-ms-win-core-processthreads-l1-1-0.dll
<Current directory>\api-ms-win-core-processthreads-l1-1-1.dll
<Current directory>\api-ms-win-core-profile-l1-1-0.dll
<Current directory>\api-ms-win-core-rtlsupport-l1-1-0.dll
<Current directory>\api-ms-win-core-string-l1-1-0.dll
<Current directory>\api-ms-win-core-localization-l1-2-0.dll
<Current directory>\ucrtbase.dll
<Current directory>\vcruntime140.dll

Deletes the following files

<Current directory>\d.cab

Moves the following files

from <Current directory>\$dpx$.tmp\186bc416e33ee7409fa629312b3ce681.tmp to <Current directory>\api-ms-win-core-console-l1-1-0.dll
from <Current directory>\$dpx$.tmp\7476de96ae2580439fc727255ec80c33.tmp to <Current directory>\api-ms-win-crt-conio-l1-1-0.dll
from <Current directory>\$dpx$.tmp\e5153e1048375846a3be98b8332bc39f.tmp to <Current directory>\api-ms-win-crt-convert-l1-1-0.dll
from <Current directory>\$dpx$.tmp\881f3a820d007143980fbcf03e309bbc.tmp to <Current directory>\api-ms-win-crt-environment-l1-1-0.dll
from <Current directory>\$dpx$.tmp\ddbc5fb1e0e0a74191f374aaf2e4c18c.tmp to <Current directory>\api-ms-win-crt-filesystem-l1-1-0.dll
from <Current directory>\$dpx$.tmp\e7aff62d70f2b3478afa13acaabb42cb.tmp to <Current directory>\api-ms-win-crt-heap-l1-1-0.dll
from <Current directory>\$dpx$.tmp\36a5230b0d3e03428211e9f2d34eee2e.tmp to <Current directory>\api-ms-win-crt-locale-l1-1-0.dll
from <Current directory>\$dpx$.tmp\e4d4dabf0ab71643a80ee5fa0fe3816f.tmp to <Current directory>\api-ms-win-crt-math-l1-1-0.dll
from <Current directory>\$dpx$.tmp\5ca95889fb9abd4b8f140d3bf74d9f4a.tmp to <Current directory>\api-ms-win-core-timezone-l1-1-0.dll
from <Current directory>\$dpx$.tmp\5da7ead0fa0a23478040000ddb8a2853.tmp to <Current directory>\api-ms-win-core-util-l1-1-0.dll
from <Current directory>\$dpx$.tmp\3cfc715cd7ff6c4187a67def7344f60f.tmp to <Current directory>\api-ms-win-crt-multibyte-l1-1-0.dll
from <Current directory>\$dpx$.tmp\a68d2c9d2c474545818bbd3a12959429.tmp to <Current directory>\api-ms-win-crt-runtime-l1-1-0.dll
from <Current directory>\$dpx$.tmp\026ad835f6265f42af97f0babd26ccba.tmp to <Current directory>\api-ms-win-crt-stdio-l1-1-0.dll
from <Current directory>\$dpx$.tmp\e2312a39d7d29f439bd21771073567a6.tmp to <Current directory>\api-ms-win-crt-string-l1-1-0.dll
from <Current directory>\$dpx$.tmp\d009b4471d387146b507d151a9c15f22.tmp to <Current directory>\api-ms-win-crt-time-l1-1-0.dll
from <Current directory>\$dpx$.tmp\5452eb1f7d65d241a302f347a7c68d3b.tmp to <Current directory>\api-ms-win-crt-utility-l1-1-0.dll
from <Current directory>\$dpx$.tmp\f9e304d15d9ec542808e3eceff68fa45.tmp to <Current directory>\msvcp140.dll
from <Current directory>\$dpx$.tmp\9b163ab78fdaad49a706c57900911ce2.tmp to <Current directory>\opencl.dll
from <Current directory>\$dpx$.tmp\9fee37d17c170d4eb24942341db641b5.tmp to <Current directory>\api-ms-win-crt-private-l1-1-0.dll
from <Current directory>\$dpx$.tmp\3ef3be2e6d40bc45b00841b2629b6bd4.tmp to <Current directory>\api-ms-win-crt-process-l1-1-0.dll
from <Current directory>\$dpx$.tmp\0e3cdc48b969324280cea6dd7d44a975.tmp to <Current directory>\api-ms-win-core-sysinfo-l1-1-0.dll
from <Current directory>\$dpx$.tmp\b8923bf454778144b5a33fef059289cc.tmp to <Current directory>\api-ms-win-core-synch-l1-2-0.dll
from <Current directory>\$dpx$.tmp\95e6df5f02a50d418d9685a6af09447c.tmp to <Current directory>\api-ms-win-core-synch-l1-1-0.dll
from <Current directory>\$dpx$.tmp\1d62ef3e5a298f458698d8a77bc23673.tmp to <Current directory>\api-ms-win-core-debug-l1-1-0.dll
from <Current directory>\$dpx$.tmp\38f44cc537088f4bb494c0e014802fbe.tmp to <Current directory>\api-ms-win-core-errorhandling-l1-1-0.dll
from <Current directory>\$dpx$.tmp\1ab8e8d8c8bf444c8e84243e9a622191.tmp to <Current directory>\api-ms-win-core-file-l1-1-0.dll
from <Current directory>\$dpx$.tmp\d3aefbbbbe454547b7a8bfa9f61682ed.tmp to <Current directory>\api-ms-win-core-file-l1-2-0.dll
from <Current directory>\$dpx$.tmp\14d43d96d9028246b670c8a082d3714e.tmp to <Current directory>\api-ms-win-core-file-l2-1-0.dll
from <Current directory>\$dpx$.tmp\d01aa80f715c5a41af4aa905bc712cad.tmp to <Current directory>\api-ms-win-core-handle-l1-1-0.dll
from <Current directory>\$dpx$.tmp\7cd193e13b8ed04e90ec2ceada98fa52.tmp to <Current directory>\api-ms-win-core-heap-l1-1-0.dll
from <Current directory>\$dpx$.tmp\9ab35e05051b114ea86351fb80d75e35.tmp to <Current directory>\api-ms-win-core-interlocked-l1-1-0.dll
from <Current directory>\$dpx$.tmp\40b06b8afe7150419fd3d0b89c84b970.tmp to <Current directory>\api-ms-win-core-datetime-l1-1-0.dll
from <Current directory>\$dpx$.tmp\821073a655c355468d4c9e4947d5cd24.tmp to <Current directory>\api-ms-win-core-libraryloader-l1-1-0.dll
from <Current directory>\$dpx$.tmp\77959de3b8028343a80fa476dcb143ab.tmp to <Current directory>\api-ms-win-core-memory-l1-1-0.dll
from <Current directory>\$dpx$.tmp\7cec923abac1ef44893209d36e6415eb.tmp to <Current directory>\api-ms-win-core-namedpipe-l1-1-0.dll
from <Current directory>\$dpx$.tmp\92b5c8875ccdb342b721b77ca0c82e41.tmp to <Current directory>\api-ms-win-core-processenvironment-l1-1-0.dll
from <Current directory>\$dpx$.tmp\b8d7663f0125e94eb9671b45a1d37185.tmp to <Current directory>\api-ms-win-core-processthreads-l1-1-0.dll
from <Current directory>\$dpx$.tmp\9e2b9f447c91b64d9ff09bd3aa1cfcd3.tmp to <Current directory>\api-ms-win-core-processthreads-l1-1-1.dll
from <Current directory>\$dpx$.tmp\fdc04fc28b877047890ebce04e367b06.tmp to <Current directory>\api-ms-win-core-profile-l1-1-0.dll
from <Current directory>\$dpx$.tmp\789ab5dff951e444b88ce86e521fe5d2.tmp to <Current directory>\api-ms-win-core-rtlsupport-l1-1-0.dll
from <Current directory>\$dpx$.tmp\5232b3523652e5429e1d927f8f9c1280.tmp to <Current directory>\api-ms-win-core-string-l1-1-0.dll
from <Current directory>\$dpx$.tmp\c737f33f5e966d41a96714090071a50b.tmp to <Current directory>\api-ms-win-core-localization-l1-2-0.dll
from <Current directory>\$dpx$.tmp\b4be5b1001882f49b978409472cdf2d4.tmp to <Current directory>\ucrtbase.dll
from <Current directory>\$dpx$.tmp\4e7829c2333ec341944e02b87663e30c.tmp to <Current directory>\vcruntime140.dll

Network activity

UDP

DNS ASK lp##.beahh.com
DNS ASK lp##.abbny.com
DNS ASK lp##.haqo.net

Miscellaneous

Creates and executes the following

'<SYSTEM32>\cmd.exe' /c expand d.cab -f:* . & del d.cab /a' (with hidden window)

Executes the following

'<SYSTEM32>\cmd.exe' /c expand d.cab -f:* . & del d.cab /a
'<SYSTEM32>\expand.exe' d.cab -f:* .

Технологии

Термины

Обучение и просвещение

Мифы

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней