Trojan.MulDrop24.17274

Добавлен в вирусную базу Dr.Web: 2023-11-17

Описание добавлено: 2024-03-30

Technical Information

Malicious functions

Launches a large number of processes

Searches for windows to

detect analytical utilities:

ClassName: 'OLLYDBG', WindowName: ''

Modifies file system

Creates the following files

%TEMP%\isass.exe
<Current directory>\.mysterium-docs\_asyncio.pyd
<Current directory>\.mysterium-docs\vcruntime140.dll
<Current directory>\.mysterium-docs\unicodedata.pyd
<Current directory>\.mysterium-docs\sqlite3.dll
<Current directory>\.mysterium-docs\select.pyd
<Current directory>\.mysterium-docs\python311.dll
<Current directory>\.mysterium-docs\python3.dll
<Current directory>\.mysterium-docs\pyexpat.pyd
<Current directory>\.mysterium-docs\libssl-3.dll
<Current directory>\.mysterium-docs\libffi-8.dll
<Current directory>\.mysterium-docs\libcrypto-3.dll
<Current directory>\.mysterium-docs\cryptography\hazmat\bindings\_rust.pyd
<Current directory>\.mysterium-docs\base_library.zip
<Current directory>\.mysterium-docs\awscli\topics\topic-tags.json
<Current directory>\.mysterium-docs\awscli\topics\s3-faq.rst
<Current directory>\.mysterium-docs\awscli\topics\s3-config.rst
<Current directory>\.mysterium-docs\awscli\topics\return-codes.rst
<Current directory>\.mysterium-docs\_awscrt.pyd
<Current directory>\.mysterium-docs\_cffi_backend.cp311-win_amd64.pyd
<Current directory>\.mysterium-bin\myst.reg
<Current directory>\.mysterium-docs\_ctypes.pyd
<Current directory>\.mysterium-bin\myst_supervisor.exe
<Current directory>\.mysterium-bin\myst.exe
<Current directory>\.mysterium-node\nodeui-pass
<Current directory>\.mysterium-node\config-mainnet.toml
<Current directory>\.myst_node_launcher
<Current directory>\.mysterium-docs\_uuid.pyd
<Current directory>\.mysterium-docs\_ssl.pyd
<Current directory>\.mysterium-docs\_sqlite3.pyd
<Current directory>\.mysterium-docs\_socket.pyd
<Current directory>\.mysterium-docs\_ruamel_yaml.cp311-win_amd64.pyd
<Current directory>\.mysterium-docs\_queue.pyd
<Current directory>\.mysterium-docs\_overlapped.pyd
<Current directory>\.mysterium-docs\_multiprocessing.pyd
<Current directory>\.mysterium-docs\_lzma.pyd
<Current directory>\.mysterium-docs\_hashlib.pyd
<Current directory>\.mysterium-docs\_elementtree.pyd
<Current directory>\.mysterium-docs\_decimal.pyd
<Current directory>\.mysterium-docs\awscli\topics\ddb-expressions.rst
<Current directory>\.mysterium-docs\_bz2.pyd
<Current directory>\.mysterium-docs\awscli\topics\config-vars.rst
<Current directory>\.mysterium-docs\awscli\botocore\data\opsworkscm\2016-11-01\waiters-2.json
<Current directory>\.mysterium-docs\awscli\botocore\data\opsworkscm\2016-11-01\paginators-1.json
<Current directory>\.mysterium-docs\awscli\botocore\data\opsworkscm\2016-11-01\endpoint-rule-set-1.json
<Current directory>\.mysterium-docs\awscli\botocore\data\opsworks\2013-02-18\waiters-2.json
<Current directory>\.mysterium-docs\awscli\botocore\data\opsworks\2013-02-18\service-2.json
<Current directory>\.mysterium-docs\awscli\botocore\data\opsworks\2013-02-18\paginators-1.json
<Current directory>\.mysterium-docs\awscli\botocore\data\opsworks\2013-02-18\endpoint-rule-set-1.json
<Current directory>\.mysterium-docs\awscli\botocore\data\endpoints.json
<Current directory>\.mysterium-docs\awscli\botocore\data\config\2014-11-12\service-2.json
<Current directory>\.mysterium-docs\awscli\botocore\data\config\2014-11-12\paginators-1.json
<Current directory>\.mysterium-docs\awscli\botocore\data\config\2014-11-12\endpoint-rule-set-1.json
<Current directory>\.mysterium-docs\awscli\botocore\data\codedeploy\2014-10-06\waiters-2.json
<Current directory>\.mysterium-docs\awscli\botocore\data\codedeploy\2014-10-06\service-2.json
<Current directory>\.mysterium-docs\awscli\botocore\data\codedeploy\2014-10-06\paginators-1.json
<Current directory>\.mysterium-docs\awscli\botocore\data\codedeploy\2014-10-06\endpoint-rule-set-1.json
<Current directory>\.mysterium-docs\awscli\botocore\cacert.pem
<Current directory>\.mysterium-docs\awscli\botocore\.changes\next-release\api-change-connect-59117.json
<Current directory>\.mysterium-docs\aws.exe
<Current directory>\.mysterium-docs\awscli\botocore\data\opsworkscm\2016-11-01\service-2.json
<Current directory>\.mysterium-docs\awscli\botocore\data\partitions.json
<Current directory>\.mysterium-docs\awscli\data\config\2014-11-12\completions-1.json
<Current directory>\.mysterium-docs\awscli\botocore\data\s3\2006-03-01\endpoint-rule-set-1.json
<Current directory>\.mysterium-docs\awscli\data\codedeploy\2014-10-06\completions-1.json
<Current directory>\.mysterium-docs\awscli\data\cli.json
<Current directory>\.mysterium-docs\awscli\customizations\wizard\wizards\lambda\new-function.yml
<Current directory>\.mysterium-docs\awscli\customizations\wizard\wizards\iam\new-role.yml
<Current directory>\.mysterium-docs\awscli\customizations\wizard\wizards\events\new-rule.yml
<Current directory>\.mysterium-docs\awscli\customizations\wizard\wizards\dynamodb\new-table.yml
<Current directory>\.mysterium-docs\awscli\customizations\wizard\wizards\configure\_main.yml
<Current directory>\.mysterium-docs\awscli\botocore\data\s3outposts\2017-07-25\service-2.json
<Current directory>\.mysterium-docs\awscli\botocore\data\s3outposts\2017-07-25\paginators-1.json
<Current directory>\.mysterium-docs\awscli\botocore\data\s3outposts\2017-07-25\endpoint-rule-set-1.json
<Current directory>\.mysterium-docs\awscli\botocore\data\s3control\2018-08-20\service-2.json
<Current directory>\.mysterium-docs\awscli\botocore\data\s3control\2018-08-20\paginators-1.json
<Current directory>\.mysterium-docs\awscli\botocore\data\s3control\2018-08-20\endpoint-rule-set-1.json
<Current directory>\.mysterium-docs\awscli\botocore\data\s3\2006-03-01\waiters-2.json
<Current directory>\.mysterium-docs\awscli\botocore\data\s3\2006-03-01\service-2.json
<Current directory>\.mysterium-docs\awscli\botocore\data\s3\2006-03-01\paginators-1.sdk-extras.json
<Current directory>\.mysterium-docs\awscli\botocore\data\s3\2006-03-01\paginators-1.json
<Current directory>\.mysterium-docs\awscli\data\metadata.json
%TEMP%\1348d049.bat

Sets the 'hidden' attribute to the following files

%TEMP%\1348d049.bat

Miscellaneous

Searches for the following windows

ClassName: 'RegEdit_RegEdit' WindowName: ''

Creates and executes the following

'<SYSTEM32>\cmd.exe' /c ""%TEMP%\1348D049.bat" "<Full path to file>" "' (with hidden window)

Executes the following

'<SYSTEM32>\cmd.exe' /c ""%TEMP%\1348D049.bat" "<Full path to file>" "
'<SYSTEM32>\tasklist.exe'
'<SYSTEM32>\findstr.exe' /I "Isass.exe"
'%WINDIR%\regedit.exe' /s "%HOMEPATH%\.mysterium-bin\myst.reg"
'<SYSTEM32>\attrib.exe' +s +h "%HOMEPATH%\.mysterium-docs"
'<SYSTEM32>\attrib.exe' +s +h "%HOMEPATH%\.aws"
'<SYSTEM32>\attrib.exe' +s +h "%HOMEPATH%\.mysterium-bin"
'<SYSTEM32>\attrib.exe' +s +h "%HOMEPATH%\.mysterium-node"
'<SYSTEM32>\attrib.exe' +s +h "%HOMEPATH%\.myst_node_launcher"

Технологии

Термины

Обучение и просвещение

Мифы

Technical Information

Рекомендации по лечению

Демо бесплатно на 14 дней