Trojan.MulDrop11.20301

Technical Information

Modifies file system

Creates the following files

<Current directory>\d.cab
<Current directory>\$dpx$.tmp\89014d9460fa6040ac6f89093bc5b6c8.tmp
<Current directory>\$dpx$.tmp\fca18cad685ec146a5ce849922465a1d.tmp
<Current directory>\$dpx$.tmp\173283879154e9448eb3ba065a27425c.tmp
<Current directory>\$dpx$.tmp\9f0ba2cbbc7f184eba42741122acb485.tmp
<Current directory>\$dpx$.tmp\c5e7edf9a01ba4449dd1ebd51e3e5d10.tmp
<Current directory>\$dpx$.tmp\0218a2a413d46e4dbcb71b148bc38cf8.tmp
<Current directory>\$dpx$.tmp\be9e6b4271e7db469d7c3b52db868f7f.tmp
<Current directory>\$dpx$.tmp\7916f173f188ce428a83464943f62971.tmp
<Current directory>\$dpx$.tmp\81e98c4452ee7f47a4641b2f18edd6f7.tmp
<Current directory>\$dpx$.tmp\0afa4c82b1497744b2e70ecf19602729.tmp
<Current directory>\$dpx$.tmp\186bf98949b01a4abdd9bce95d1ff1c6.tmp
<Current directory>\$dpx$.tmp\d32c90976ce86b429f5023d22a2da698.tmp
<Current directory>\$dpx$.tmp\1c20389103fcb84d83a3df02cc88b3a0.tmp
<Current directory>\$dpx$.tmp\213eef8245f8184194b16fd80cdb0d64.tmp
<Current directory>\$dpx$.tmp\17134fa32ca46b48a37fbe37c672783c.tmp
<Current directory>\$dpx$.tmp\84dbf7f05fe6b84daf5179db255940e1.tmp
<Current directory>\$dpx$.tmp\649e5b5b3731bb4fa5af102a21a91e16.tmp
<Current directory>\$dpx$.tmp\071e027b68372c49b155eed296ddbbeb.tmp
<Current directory>\$dpx$.tmp\d36534f9838f454cab60269a81a9f511.tmp
<Current directory>\$dpx$.tmp\fa0d92949052db41a3d1e220a793b3ef.tmp
<Current directory>\$dpx$.tmp\367313ca7aea7647bcc6e378a67e9269.tmp
<Current directory>\$dpx$.tmp\9c899bd779c8884f91040f6c95413d75.tmp
<Current directory>\$dpx$.tmp\4b87a821963a9e4280a4dd7037468473.tmp
<Current directory>\$dpx$.tmp\d4142b3f98c53642838d920748123222.tmp
<Current directory>\$dpx$.tmp\bededc20ea66414989312566aca7c2f9.tmp
<Current directory>\$dpx$.tmp\ed54f0701fecb245acb3d4a79e999333.tmp
<Current directory>\$dpx$.tmp\3d5b63c07a8d2a4581d0338c2f15e7d8.tmp
<Current directory>\$dpx$.tmp\32b89ecbdaf6e6418f3dc74c309d027e.tmp
<Current directory>\$dpx$.tmp\9d171bc5fb2f7d47ab485c0f27637030.tmp
<Current directory>\$dpx$.tmp\cf0024babdadba488bc74455322cae74.tmp
<Current directory>\$dpx$.tmp\797b87942a17db418b87fe24e43a4a71.tmp
<Current directory>\$dpx$.tmp\205c388864e49d46ad40e376a557338d.tmp
<Current directory>\$dpx$.tmp\0354307f8066424793b422f6a4c1e1e5.tmp
<Current directory>\$dpx$.tmp\7e247d24d255864e84b61673fe1c7058.tmp
<Current directory>\$dpx$.tmp\c16e115b00ae374099a42ceb454f35de.tmp
<Current directory>\$dpx$.tmp\854f85efa23a1340829935c5337d041f.tmp
<Current directory>\$dpx$.tmp\91da3384cde7da4fa11e457c20b90b96.tmp
<Current directory>\$dpx$.tmp\6f5f641b9ef98a4692c6e5450ab47169.tmp
<Current directory>\$dpx$.tmp\1683408eb9116344b804ddbc557c9b9c.tmp
<Current directory>\$dpx$.tmp\aea57d69d281f043a8331b4d430d2d4e.tmp
<Current directory>\$dpx$.tmp\aa7f4725d847314bafc851e8d5539661.tmp
<Current directory>\$dpx$.tmp\0f9168d52d14f546aef418e640f6774b.tmp
<Current directory>\$dpx$.tmp\9261367bcafb1e478c6190bb4bfcf63c.tmp
<Current directory>\$dpx$.tmp\ef6f4c447c35644cb0e6875c7fabc79a.tmp

Sets the 'hidden' attribute to the following files

<Current directory>\api-ms-win-core-console-l1-1-0.dll
<Current directory>\api-ms-win-crt-conio-l1-1-0.dll
<Current directory>\api-ms-win-crt-convert-l1-1-0.dll
<Current directory>\api-ms-win-crt-environment-l1-1-0.dll
<Current directory>\api-ms-win-crt-filesystem-l1-1-0.dll
<Current directory>\api-ms-win-crt-heap-l1-1-0.dll
<Current directory>\api-ms-win-crt-locale-l1-1-0.dll
<Current directory>\api-ms-win-crt-math-l1-1-0.dll
<Current directory>\api-ms-win-core-timezone-l1-1-0.dll
<Current directory>\api-ms-win-core-util-l1-1-0.dll
<Current directory>\api-ms-win-crt-multibyte-l1-1-0.dll
<Current directory>\api-ms-win-crt-runtime-l1-1-0.dll
<Current directory>\api-ms-win-crt-stdio-l1-1-0.dll
<Current directory>\api-ms-win-crt-string-l1-1-0.dll
<Current directory>\api-ms-win-crt-time-l1-1-0.dll
<Current directory>\api-ms-win-crt-utility-l1-1-0.dll
<Current directory>\msvcp140.dll
<Current directory>\opencl.dll
<Current directory>\api-ms-win-crt-private-l1-1-0.dll
<Current directory>\api-ms-win-crt-process-l1-1-0.dll
<Current directory>\api-ms-win-core-sysinfo-l1-1-0.dll
<Current directory>\api-ms-win-core-synch-l1-2-0.dll
<Current directory>\api-ms-win-core-synch-l1-1-0.dll
<Current directory>\api-ms-win-core-debug-l1-1-0.dll
<Current directory>\api-ms-win-core-errorhandling-l1-1-0.dll
<Current directory>\api-ms-win-core-file-l1-1-0.dll
<Current directory>\api-ms-win-core-file-l1-2-0.dll
<Current directory>\api-ms-win-core-file-l2-1-0.dll
<Current directory>\api-ms-win-core-handle-l1-1-0.dll
<Current directory>\api-ms-win-core-heap-l1-1-0.dll
<Current directory>\api-ms-win-core-interlocked-l1-1-0.dll
<Current directory>\api-ms-win-core-datetime-l1-1-0.dll
<Current directory>\api-ms-win-core-libraryloader-l1-1-0.dll
<Current directory>\api-ms-win-core-memory-l1-1-0.dll
<Current directory>\api-ms-win-core-namedpipe-l1-1-0.dll
<Current directory>\api-ms-win-core-processenvironment-l1-1-0.dll
<Current directory>\api-ms-win-core-processthreads-l1-1-0.dll
<Current directory>\api-ms-win-core-processthreads-l1-1-1.dll
<Current directory>\api-ms-win-core-profile-l1-1-0.dll
<Current directory>\api-ms-win-core-rtlsupport-l1-1-0.dll
<Current directory>\api-ms-win-core-string-l1-1-0.dll
<Current directory>\api-ms-win-core-localization-l1-2-0.dll
<Current directory>\ucrtbase.dll
<Current directory>\vcruntime140.dll

Deletes the following files

<Current directory>\d.cab

Moves the following files

from <Current directory>\$dpx$.tmp\d4142b3f98c53642838d920748123222.tmp to <Current directory>\api-ms-win-core-console-l1-1-0.dll
from <Current directory>\$dpx$.tmp\173283879154e9448eb3ba065a27425c.tmp to <Current directory>\api-ms-win-crt-conio-l1-1-0.dll
from <Current directory>\$dpx$.tmp\9f0ba2cbbc7f184eba42741122acb485.tmp to <Current directory>\api-ms-win-crt-convert-l1-1-0.dll
from <Current directory>\$dpx$.tmp\c5e7edf9a01ba4449dd1ebd51e3e5d10.tmp to <Current directory>\api-ms-win-crt-environment-l1-1-0.dll
from <Current directory>\$dpx$.tmp\0218a2a413d46e4dbcb71b148bc38cf8.tmp to <Current directory>\api-ms-win-crt-filesystem-l1-1-0.dll
from <Current directory>\$dpx$.tmp\be9e6b4271e7db469d7c3b52db868f7f.tmp to <Current directory>\api-ms-win-crt-heap-l1-1-0.dll
from <Current directory>\$dpx$.tmp\7916f173f188ce428a83464943f62971.tmp to <Current directory>\api-ms-win-crt-locale-l1-1-0.dll
from <Current directory>\$dpx$.tmp\81e98c4452ee7f47a4641b2f18edd6f7.tmp to <Current directory>\api-ms-win-crt-math-l1-1-0.dll
from <Current directory>\$dpx$.tmp\89014d9460fa6040ac6f89093bc5b6c8.tmp to <Current directory>\api-ms-win-core-timezone-l1-1-0.dll
from <Current directory>\$dpx$.tmp\fca18cad685ec146a5ce849922465a1d.tmp to <Current directory>\api-ms-win-core-util-l1-1-0.dll
from <Current directory>\$dpx$.tmp\0afa4c82b1497744b2e70ecf19602729.tmp to <Current directory>\api-ms-win-crt-multibyte-l1-1-0.dll
from <Current directory>\$dpx$.tmp\1c20389103fcb84d83a3df02cc88b3a0.tmp to <Current directory>\api-ms-win-crt-runtime-l1-1-0.dll
from <Current directory>\$dpx$.tmp\213eef8245f8184194b16fd80cdb0d64.tmp to <Current directory>\api-ms-win-crt-stdio-l1-1-0.dll
from <Current directory>\$dpx$.tmp\17134fa32ca46b48a37fbe37c672783c.tmp to <Current directory>\api-ms-win-crt-string-l1-1-0.dll
from <Current directory>\$dpx$.tmp\84dbf7f05fe6b84daf5179db255940e1.tmp to <Current directory>\api-ms-win-crt-time-l1-1-0.dll
from <Current directory>\$dpx$.tmp\649e5b5b3731bb4fa5af102a21a91e16.tmp to <Current directory>\api-ms-win-crt-utility-l1-1-0.dll
from <Current directory>\$dpx$.tmp\071e027b68372c49b155eed296ddbbeb.tmp to <Current directory>\msvcp140.dll
from <Current directory>\$dpx$.tmp\d36534f9838f454cab60269a81a9f511.tmp to <Current directory>\opencl.dll
from <Current directory>\$dpx$.tmp\186bf98949b01a4abdd9bce95d1ff1c6.tmp to <Current directory>\api-ms-win-crt-private-l1-1-0.dll
from <Current directory>\$dpx$.tmp\d32c90976ce86b429f5023d22a2da698.tmp to <Current directory>\api-ms-win-crt-process-l1-1-0.dll
from <Current directory>\$dpx$.tmp\fa0d92949052db41a3d1e220a793b3ef.tmp to <Current directory>\api-ms-win-core-sysinfo-l1-1-0.dll
from <Current directory>\$dpx$.tmp\9c899bd779c8884f91040f6c95413d75.tmp to <Current directory>\api-ms-win-core-synch-l1-2-0.dll
from <Current directory>\$dpx$.tmp\9261367bcafb1e478c6190bb4bfcf63c.tmp to <Current directory>\api-ms-win-core-synch-l1-1-0.dll
from <Current directory>\$dpx$.tmp\ed54f0701fecb245acb3d4a79e999333.tmp to <Current directory>\api-ms-win-core-debug-l1-1-0.dll
from <Current directory>\$dpx$.tmp\3d5b63c07a8d2a4581d0338c2f15e7d8.tmp to <Current directory>\api-ms-win-core-errorhandling-l1-1-0.dll
from <Current directory>\$dpx$.tmp\32b89ecbdaf6e6418f3dc74c309d027e.tmp to <Current directory>\api-ms-win-core-file-l1-1-0.dll
from <Current directory>\$dpx$.tmp\9d171bc5fb2f7d47ab485c0f27637030.tmp to <Current directory>\api-ms-win-core-file-l1-2-0.dll
from <Current directory>\$dpx$.tmp\cf0024babdadba488bc74455322cae74.tmp to <Current directory>\api-ms-win-core-file-l2-1-0.dll
from <Current directory>\$dpx$.tmp\797b87942a17db418b87fe24e43a4a71.tmp to <Current directory>\api-ms-win-core-handle-l1-1-0.dll
from <Current directory>\$dpx$.tmp\205c388864e49d46ad40e376a557338d.tmp to <Current directory>\api-ms-win-core-heap-l1-1-0.dll
from <Current directory>\$dpx$.tmp\0354307f8066424793b422f6a4c1e1e5.tmp to <Current directory>\api-ms-win-core-interlocked-l1-1-0.dll
from <Current directory>\$dpx$.tmp\bededc20ea66414989312566aca7c2f9.tmp to <Current directory>\api-ms-win-core-datetime-l1-1-0.dll
from <Current directory>\$dpx$.tmp\7e247d24d255864e84b61673fe1c7058.tmp to <Current directory>\api-ms-win-core-libraryloader-l1-1-0.dll
from <Current directory>\$dpx$.tmp\854f85efa23a1340829935c5337d041f.tmp to <Current directory>\api-ms-win-core-memory-l1-1-0.dll
from <Current directory>\$dpx$.tmp\91da3384cde7da4fa11e457c20b90b96.tmp to <Current directory>\api-ms-win-core-namedpipe-l1-1-0.dll
from <Current directory>\$dpx$.tmp\6f5f641b9ef98a4692c6e5450ab47169.tmp to <Current directory>\api-ms-win-core-processenvironment-l1-1-0.dll
from <Current directory>\$dpx$.tmp\1683408eb9116344b804ddbc557c9b9c.tmp to <Current directory>\api-ms-win-core-processthreads-l1-1-0.dll
from <Current directory>\$dpx$.tmp\aea57d69d281f043a8331b4d430d2d4e.tmp to <Current directory>\api-ms-win-core-processthreads-l1-1-1.dll
from <Current directory>\$dpx$.tmp\aa7f4725d847314bafc851e8d5539661.tmp to <Current directory>\api-ms-win-core-profile-l1-1-0.dll
from <Current directory>\$dpx$.tmp\0f9168d52d14f546aef418e640f6774b.tmp to <Current directory>\api-ms-win-core-rtlsupport-l1-1-0.dll
from <Current directory>\$dpx$.tmp\4b87a821963a9e4280a4dd7037468473.tmp to <Current directory>\api-ms-win-core-string-l1-1-0.dll
from <Current directory>\$dpx$.tmp\c16e115b00ae374099a42ceb454f35de.tmp to <Current directory>\api-ms-win-core-localization-l1-2-0.dll
from <Current directory>\$dpx$.tmp\367313ca7aea7647bcc6e378a67e9269.tmp to <Current directory>\ucrtbase.dll
from <Current directory>\$dpx$.tmp\ef6f4c447c35644cb0e6875c7fabc79a.tmp to <Current directory>\vcruntime140.dll

Network activity

UDP

DNS ASK lp##.beahh.com
DNS ASK lp##.abbny.com
DNS ASK lp##.haqo.net

Miscellaneous

Creates and executes the following

'<SYSTEM32>\cmd.exe' /c expand d.cab -f:* . & del d.cab /a' (with hidden window)

Executes the following

'<SYSTEM32>\cmd.exe' /c expand d.cab -f:* . & del d.cab /a
'<SYSTEM32>\expand.exe' d.cab -f:* .

Технологии

Термины

Обучение и просвещение

Мифы

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней