Trojan.MulDrop11.20324

Technical Information

Modifies file system

Creates the following files

<Current directory>\d.cab
<Current directory>\$dpx$.tmp\c2a802aab375bd4c9eff90e3996c757a.tmp
<Current directory>\$dpx$.tmp\14c5f3c671e2eb4094c93ce1176f96c0.tmp
<Current directory>\$dpx$.tmp\a5accbcf8c987045897e48640fdbc0a1.tmp
<Current directory>\$dpx$.tmp\f35df79959cd9547ac9f78a7a3e75aa6.tmp
<Current directory>\$dpx$.tmp\92169f6d5627f843a2227e2379e48c55.tmp
<Current directory>\$dpx$.tmp\a9793df900a3fd4da6202265f97657d1.tmp
<Current directory>\$dpx$.tmp\7b812407c8ed8a4e8b05aaa3a015dd0a.tmp
<Current directory>\$dpx$.tmp\dd78df5981e83046bb02bc7872982c45.tmp
<Current directory>\$dpx$.tmp\30cdbdb69aaab7418eed15475223b422.tmp
<Current directory>\$dpx$.tmp\21d62d03137d9142b728f4caf34cc22f.tmp
<Current directory>\$dpx$.tmp\cdf01af2160bda4eb25f7fe7cfd57596.tmp
<Current directory>\$dpx$.tmp\82ea2404ce2be84aad8aeda9475aba84.tmp
<Current directory>\$dpx$.tmp\98b1ea1a71a545439ba82b4ca0f0e9ce.tmp
<Current directory>\$dpx$.tmp\009c19da034ac1419ee6aca420e6166d.tmp
<Current directory>\$dpx$.tmp\a36c5cd13a13644eae96dc36869bc683.tmp
<Current directory>\$dpx$.tmp\8f26bc6ee140cc4a8655cf72b7beebc8.tmp
<Current directory>\$dpx$.tmp\75ef406ac233af488b952ad7518fda92.tmp
<Current directory>\$dpx$.tmp\a38a203db905da4eb2d4f3cb0f0e06e7.tmp
<Current directory>\$dpx$.tmp\ea5ed7a1b998d742861b0b45185476b7.tmp
<Current directory>\$dpx$.tmp\b4808f0c46cc4b43b844895aceee4c64.tmp
<Current directory>\$dpx$.tmp\3201442d0a61e942b9717c65528f568a.tmp
<Current directory>\$dpx$.tmp\71cc0920ba696f4fb7792831682a06e1.tmp
<Current directory>\$dpx$.tmp\864e8956489b414da191e069fbf01476.tmp
<Current directory>\$dpx$.tmp\6127aece9bfaea4eb0d26730ba4128e4.tmp
<Current directory>\$dpx$.tmp\2564f4c342c0c64cb025f2b4729dca5e.tmp
<Current directory>\$dpx$.tmp\242294b6e48d1f47a597b219e2e5134f.tmp
<Current directory>\$dpx$.tmp\ed8ab3f5bf5fd242981687fc3e8e9b12.tmp
<Current directory>\$dpx$.tmp\a49e15dc2a3fa84cb8b1d8d930d7786a.tmp
<Current directory>\$dpx$.tmp\371a4ed8219d2446886fc5c49a4bf3c8.tmp
<Current directory>\$dpx$.tmp\ff4ee5d436a22b47879518ac33e21e66.tmp
<Current directory>\$dpx$.tmp\9f6b0c1b8f40ad4d9009a28d4d9368fe.tmp
<Current directory>\$dpx$.tmp\60ac5b1aab36a440bf3f794796ff6a59.tmp
<Current directory>\$dpx$.tmp\28cdcda47717b34abb5b38473f50e1b7.tmp
<Current directory>\$dpx$.tmp\e2367ee4d5b84f4e97986a1ecaaa943a.tmp
<Current directory>\$dpx$.tmp\f5c773056dd0894bb857d5331394be9e.tmp
<Current directory>\$dpx$.tmp\0bb0d464e6dcc8409d4c91237ef820b3.tmp
<Current directory>\$dpx$.tmp\a6dfed4820d3c54b8e6ed60705992564.tmp
<Current directory>\$dpx$.tmp\20bb42e6a7f67d47958eeee2092996cd.tmp
<Current directory>\$dpx$.tmp\9a1b2def8a7b9445949052411f37bc95.tmp
<Current directory>\$dpx$.tmp\44761b6aa7167144b97b9eef6d53d4e1.tmp
<Current directory>\$dpx$.tmp\a3b1c512e6bc0a479625e367ecc14711.tmp
<Current directory>\$dpx$.tmp\7ba1044dbf42e9478bf945c15c83d915.tmp
<Current directory>\$dpx$.tmp\37c9dbe6ee764447b2f3f06341deab18.tmp
<Current directory>\$dpx$.tmp\44a52a964690ec4b8cd9284d1556c00f.tmp

Sets the 'hidden' attribute to the following files

<Current directory>\api-ms-win-core-console-l1-1-0.dll
<Current directory>\api-ms-win-crt-conio-l1-1-0.dll
<Current directory>\api-ms-win-crt-convert-l1-1-0.dll
<Current directory>\api-ms-win-crt-environment-l1-1-0.dll
<Current directory>\api-ms-win-crt-filesystem-l1-1-0.dll
<Current directory>\api-ms-win-crt-heap-l1-1-0.dll
<Current directory>\api-ms-win-crt-locale-l1-1-0.dll
<Current directory>\api-ms-win-crt-math-l1-1-0.dll
<Current directory>\api-ms-win-core-timezone-l1-1-0.dll
<Current directory>\api-ms-win-core-util-l1-1-0.dll
<Current directory>\api-ms-win-crt-multibyte-l1-1-0.dll
<Current directory>\api-ms-win-crt-runtime-l1-1-0.dll
<Current directory>\api-ms-win-crt-stdio-l1-1-0.dll
<Current directory>\api-ms-win-crt-string-l1-1-0.dll
<Current directory>\api-ms-win-crt-time-l1-1-0.dll
<Current directory>\api-ms-win-crt-utility-l1-1-0.dll
<Current directory>\msvcp140.dll
<Current directory>\opencl.dll
<Current directory>\api-ms-win-crt-private-l1-1-0.dll
<Current directory>\api-ms-win-crt-process-l1-1-0.dll
<Current directory>\api-ms-win-core-sysinfo-l1-1-0.dll
<Current directory>\api-ms-win-core-synch-l1-2-0.dll
<Current directory>\api-ms-win-core-synch-l1-1-0.dll
<Current directory>\api-ms-win-core-debug-l1-1-0.dll
<Current directory>\api-ms-win-core-errorhandling-l1-1-0.dll
<Current directory>\api-ms-win-core-file-l1-1-0.dll
<Current directory>\api-ms-win-core-file-l1-2-0.dll
<Current directory>\api-ms-win-core-file-l2-1-0.dll
<Current directory>\api-ms-win-core-handle-l1-1-0.dll
<Current directory>\api-ms-win-core-heap-l1-1-0.dll
<Current directory>\api-ms-win-core-interlocked-l1-1-0.dll
<Current directory>\api-ms-win-core-datetime-l1-1-0.dll
<Current directory>\api-ms-win-core-libraryloader-l1-1-0.dll
<Current directory>\api-ms-win-core-memory-l1-1-0.dll
<Current directory>\api-ms-win-core-namedpipe-l1-1-0.dll
<Current directory>\api-ms-win-core-processenvironment-l1-1-0.dll
<Current directory>\api-ms-win-core-processthreads-l1-1-0.dll
<Current directory>\api-ms-win-core-processthreads-l1-1-1.dll
<Current directory>\api-ms-win-core-profile-l1-1-0.dll
<Current directory>\api-ms-win-core-rtlsupport-l1-1-0.dll
<Current directory>\api-ms-win-core-string-l1-1-0.dll
<Current directory>\api-ms-win-core-localization-l1-2-0.dll
<Current directory>\ucrtbase.dll
<Current directory>\vcruntime140.dll

Deletes the following files

<Current directory>\d.cab

Moves the following files

from <Current directory>\$dpx$.tmp\6127aece9bfaea4eb0d26730ba4128e4.tmp to <Current directory>\api-ms-win-core-console-l1-1-0.dll
from <Current directory>\$dpx$.tmp\a5accbcf8c987045897e48640fdbc0a1.tmp to <Current directory>\api-ms-win-crt-conio-l1-1-0.dll
from <Current directory>\$dpx$.tmp\f35df79959cd9547ac9f78a7a3e75aa6.tmp to <Current directory>\api-ms-win-crt-convert-l1-1-0.dll
from <Current directory>\$dpx$.tmp\92169f6d5627f843a2227e2379e48c55.tmp to <Current directory>\api-ms-win-crt-environment-l1-1-0.dll
from <Current directory>\$dpx$.tmp\a9793df900a3fd4da6202265f97657d1.tmp to <Current directory>\api-ms-win-crt-filesystem-l1-1-0.dll
from <Current directory>\$dpx$.tmp\7b812407c8ed8a4e8b05aaa3a015dd0a.tmp to <Current directory>\api-ms-win-crt-heap-l1-1-0.dll
from <Current directory>\$dpx$.tmp\dd78df5981e83046bb02bc7872982c45.tmp to <Current directory>\api-ms-win-crt-locale-l1-1-0.dll
from <Current directory>\$dpx$.tmp\30cdbdb69aaab7418eed15475223b422.tmp to <Current directory>\api-ms-win-crt-math-l1-1-0.dll
from <Current directory>\$dpx$.tmp\c2a802aab375bd4c9eff90e3996c757a.tmp to <Current directory>\api-ms-win-core-timezone-l1-1-0.dll
from <Current directory>\$dpx$.tmp\14c5f3c671e2eb4094c93ce1176f96c0.tmp to <Current directory>\api-ms-win-core-util-l1-1-0.dll
from <Current directory>\$dpx$.tmp\21d62d03137d9142b728f4caf34cc22f.tmp to <Current directory>\api-ms-win-crt-multibyte-l1-1-0.dll
from <Current directory>\$dpx$.tmp\98b1ea1a71a545439ba82b4ca0f0e9ce.tmp to <Current directory>\api-ms-win-crt-runtime-l1-1-0.dll
from <Current directory>\$dpx$.tmp\009c19da034ac1419ee6aca420e6166d.tmp to <Current directory>\api-ms-win-crt-stdio-l1-1-0.dll
from <Current directory>\$dpx$.tmp\a36c5cd13a13644eae96dc36869bc683.tmp to <Current directory>\api-ms-win-crt-string-l1-1-0.dll
from <Current directory>\$dpx$.tmp\8f26bc6ee140cc4a8655cf72b7beebc8.tmp to <Current directory>\api-ms-win-crt-time-l1-1-0.dll
from <Current directory>\$dpx$.tmp\75ef406ac233af488b952ad7518fda92.tmp to <Current directory>\api-ms-win-crt-utility-l1-1-0.dll
from <Current directory>\$dpx$.tmp\a38a203db905da4eb2d4f3cb0f0e06e7.tmp to <Current directory>\msvcp140.dll
from <Current directory>\$dpx$.tmp\ea5ed7a1b998d742861b0b45185476b7.tmp to <Current directory>\opencl.dll
from <Current directory>\$dpx$.tmp\cdf01af2160bda4eb25f7fe7cfd57596.tmp to <Current directory>\api-ms-win-crt-private-l1-1-0.dll
from <Current directory>\$dpx$.tmp\82ea2404ce2be84aad8aeda9475aba84.tmp to <Current directory>\api-ms-win-crt-process-l1-1-0.dll
from <Current directory>\$dpx$.tmp\b4808f0c46cc4b43b844895aceee4c64.tmp to <Current directory>\api-ms-win-core-sysinfo-l1-1-0.dll
from <Current directory>\$dpx$.tmp\71cc0920ba696f4fb7792831682a06e1.tmp to <Current directory>\api-ms-win-core-synch-l1-2-0.dll
from <Current directory>\$dpx$.tmp\37c9dbe6ee764447b2f3f06341deab18.tmp to <Current directory>\api-ms-win-core-synch-l1-1-0.dll
from <Current directory>\$dpx$.tmp\242294b6e48d1f47a597b219e2e5134f.tmp to <Current directory>\api-ms-win-core-debug-l1-1-0.dll
from <Current directory>\$dpx$.tmp\ed8ab3f5bf5fd242981687fc3e8e9b12.tmp to <Current directory>\api-ms-win-core-errorhandling-l1-1-0.dll
from <Current directory>\$dpx$.tmp\a49e15dc2a3fa84cb8b1d8d930d7786a.tmp to <Current directory>\api-ms-win-core-file-l1-1-0.dll
from <Current directory>\$dpx$.tmp\371a4ed8219d2446886fc5c49a4bf3c8.tmp to <Current directory>\api-ms-win-core-file-l1-2-0.dll
from <Current directory>\$dpx$.tmp\ff4ee5d436a22b47879518ac33e21e66.tmp to <Current directory>\api-ms-win-core-file-l2-1-0.dll
from <Current directory>\$dpx$.tmp\9f6b0c1b8f40ad4d9009a28d4d9368fe.tmp to <Current directory>\api-ms-win-core-handle-l1-1-0.dll
from <Current directory>\$dpx$.tmp\60ac5b1aab36a440bf3f794796ff6a59.tmp to <Current directory>\api-ms-win-core-heap-l1-1-0.dll
from <Current directory>\$dpx$.tmp\28cdcda47717b34abb5b38473f50e1b7.tmp to <Current directory>\api-ms-win-core-interlocked-l1-1-0.dll
from <Current directory>\$dpx$.tmp\2564f4c342c0c64cb025f2b4729dca5e.tmp to <Current directory>\api-ms-win-core-datetime-l1-1-0.dll
from <Current directory>\$dpx$.tmp\e2367ee4d5b84f4e97986a1ecaaa943a.tmp to <Current directory>\api-ms-win-core-libraryloader-l1-1-0.dll
from <Current directory>\$dpx$.tmp\0bb0d464e6dcc8409d4c91237ef820b3.tmp to <Current directory>\api-ms-win-core-memory-l1-1-0.dll
from <Current directory>\$dpx$.tmp\a6dfed4820d3c54b8e6ed60705992564.tmp to <Current directory>\api-ms-win-core-namedpipe-l1-1-0.dll
from <Current directory>\$dpx$.tmp\20bb42e6a7f67d47958eeee2092996cd.tmp to <Current directory>\api-ms-win-core-processenvironment-l1-1-0.dll
from <Current directory>\$dpx$.tmp\9a1b2def8a7b9445949052411f37bc95.tmp to <Current directory>\api-ms-win-core-processthreads-l1-1-0.dll
from <Current directory>\$dpx$.tmp\44761b6aa7167144b97b9eef6d53d4e1.tmp to <Current directory>\api-ms-win-core-processthreads-l1-1-1.dll
from <Current directory>\$dpx$.tmp\a3b1c512e6bc0a479625e367ecc14711.tmp to <Current directory>\api-ms-win-core-profile-l1-1-0.dll
from <Current directory>\$dpx$.tmp\7ba1044dbf42e9478bf945c15c83d915.tmp to <Current directory>\api-ms-win-core-rtlsupport-l1-1-0.dll
from <Current directory>\$dpx$.tmp\864e8956489b414da191e069fbf01476.tmp to <Current directory>\api-ms-win-core-string-l1-1-0.dll
from <Current directory>\$dpx$.tmp\f5c773056dd0894bb857d5331394be9e.tmp to <Current directory>\api-ms-win-core-localization-l1-2-0.dll
from <Current directory>\$dpx$.tmp\3201442d0a61e942b9717c65528f568a.tmp to <Current directory>\ucrtbase.dll
from <Current directory>\$dpx$.tmp\44a52a964690ec4b8cd9284d1556c00f.tmp to <Current directory>\vcruntime140.dll

Network activity

UDP

DNS ASK lp##.beahh.com
DNS ASK lp##.abbny.com
DNS ASK lp##.haqo.net

Miscellaneous

Creates and executes the following

'<SYSTEM32>\cmd.exe' /c expand d.cab -f:* . & del d.cab /a' (with hidden window)

Executes the following

'<SYSTEM32>\cmd.exe' /c expand d.cab -f:* . & del d.cab /a
'<SYSTEM32>\expand.exe' d.cab -f:* .

Технологии

Термины

Обучение и просвещение

Мифы

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней