Trojan.MulDrop20.63632

Technical Information

Modifies file system

Creates the following files

<Current directory>\d.cab
<Current directory>\$dpx$.tmp\1551aee76493df4d8f7e9cfbe70afcd9.tmp
<Current directory>\$dpx$.tmp\c2acfac2a259e8459860e1c4818624bb.tmp
<Current directory>\$dpx$.tmp\aedeb2ec66c7b440b92c55ffe055f837.tmp
<Current directory>\$dpx$.tmp\aca35d5fcaa8c54393edcd70da699d0b.tmp
<Current directory>\$dpx$.tmp\b339b7f0c1b01f43ab518940b5526a76.tmp
<Current directory>\$dpx$.tmp\fc42ebd6edb2c5479a2bfc5e3850c4ac.tmp
<Current directory>\$dpx$.tmp\d3f426e605521048a35919c493a95086.tmp
<Current directory>\$dpx$.tmp\f58e95f92f698545abcbc2cdc6dad377.tmp
<Current directory>\$dpx$.tmp\51cb8845b5cf1b4c953ae423fe2a3311.tmp
<Current directory>\$dpx$.tmp\62ef655cb88ef34aa1803aa3ccdd0c49.tmp
<Current directory>\$dpx$.tmp\22b5657000cd45478d4464978720f662.tmp
<Current directory>\$dpx$.tmp\98562b7159c15341b967df242abee6db.tmp
<Current directory>\$dpx$.tmp\93ecb85d4b4eb7488b8cacc9f655cb8f.tmp
<Current directory>\$dpx$.tmp\a3904f418efb034db9a38a2ee7f7c73a.tmp
<Current directory>\$dpx$.tmp\6b205db5417c9344a0750cd2c348ca94.tmp
<Current directory>\$dpx$.tmp\40b7fd05e9b1b547aa24d58a587e2acb.tmp
<Current directory>\$dpx$.tmp\d695c30b984b8440b134eebdbb6b9c89.tmp
<Current directory>\$dpx$.tmp\f59fc17059142148af4454fb222dbd7f.tmp
<Current directory>\$dpx$.tmp\5527e281af9d144ea74167d4a1006656.tmp
<Current directory>\$dpx$.tmp\b9aba834b6884d4280c472d5deac79c7.tmp
<Current directory>\$dpx$.tmp\9b325f816ff1fe4e865c3b4bccab8948.tmp
<Current directory>\$dpx$.tmp\0bb104b4c85db0429e584d964a740b87.tmp
<Current directory>\$dpx$.tmp\ba90b077c5fa5c469e59fc160d51c476.tmp
<Current directory>\$dpx$.tmp\56d49b4846b83b49b87b379289e4cbe6.tmp
<Current directory>\$dpx$.tmp\a841880e524d4945b72d9a3da3a4c5dd.tmp
<Current directory>\$dpx$.tmp\45c6b8380ac94b4d90141a66edf9c490.tmp
<Current directory>\$dpx$.tmp\5a3493fa32845f4fa26b89163bea87e1.tmp
<Current directory>\$dpx$.tmp\a8a11254bbc570498a2d71cf4b6c8ccc.tmp
<Current directory>\$dpx$.tmp\6f6666d04f374c47b98f2538f2c5e7a1.tmp
<Current directory>\$dpx$.tmp\c8586296c0d7f04696f8332c51fa2353.tmp
<Current directory>\$dpx$.tmp\905c69e3838e9d41a061c7fc02e21b4c.tmp
<Current directory>\$dpx$.tmp\1409d5afa54e904e93a2106dee4b9bf2.tmp
<Current directory>\$dpx$.tmp\864986baf139564ab4e02a4607e50dc8.tmp
<Current directory>\$dpx$.tmp\cbf52a24054c2e44ace46511ca00b57a.tmp
<Current directory>\$dpx$.tmp\5f88cbc7ba325042b55ee8e077675206.tmp
<Current directory>\$dpx$.tmp\072fb3baff190d40adffd8c7e603bb33.tmp
<Current directory>\$dpx$.tmp\5d8b03fbd1d23741b7067b9a501a09cc.tmp
<Current directory>\$dpx$.tmp\dad151ef7874e949bd800f8f38f17e03.tmp
<Current directory>\$dpx$.tmp\7ba9e01a1aa8be46a1de68b5d59316ff.tmp
<Current directory>\$dpx$.tmp\4ed94262d88aa149a4f1d522c476020b.tmp
<Current directory>\$dpx$.tmp\015269c5e347c04ba142eced84e054cc.tmp
<Current directory>\$dpx$.tmp\a1ddbeb4f39e9a428e09f822ece9889f.tmp
<Current directory>\$dpx$.tmp\3a4d75507fc8cb479c42ca397d161a63.tmp
<Current directory>\$dpx$.tmp\f350a11b09a89a4e98734fbb1436fec5.tmp

Sets the 'hidden' attribute to the following files

<Current directory>\api-ms-win-core-console-l1-1-0.dll
<Current directory>\api-ms-win-crt-conio-l1-1-0.dll
<Current directory>\api-ms-win-crt-convert-l1-1-0.dll
<Current directory>\api-ms-win-crt-environment-l1-1-0.dll
<Current directory>\api-ms-win-crt-filesystem-l1-1-0.dll
<Current directory>\api-ms-win-crt-heap-l1-1-0.dll
<Current directory>\api-ms-win-crt-locale-l1-1-0.dll
<Current directory>\api-ms-win-crt-math-l1-1-0.dll
<Current directory>\api-ms-win-core-timezone-l1-1-0.dll
<Current directory>\api-ms-win-core-util-l1-1-0.dll
<Current directory>\api-ms-win-crt-multibyte-l1-1-0.dll
<Current directory>\api-ms-win-crt-runtime-l1-1-0.dll
<Current directory>\api-ms-win-crt-stdio-l1-1-0.dll
<Current directory>\api-ms-win-crt-string-l1-1-0.dll
<Current directory>\api-ms-win-crt-time-l1-1-0.dll
<Current directory>\api-ms-win-crt-utility-l1-1-0.dll
<Current directory>\msvcp140.dll
<Current directory>\opencl.dll
<Current directory>\api-ms-win-crt-private-l1-1-0.dll
<Current directory>\api-ms-win-crt-process-l1-1-0.dll
<Current directory>\api-ms-win-core-sysinfo-l1-1-0.dll
<Current directory>\api-ms-win-core-synch-l1-2-0.dll
<Current directory>\api-ms-win-core-synch-l1-1-0.dll
<Current directory>\api-ms-win-core-debug-l1-1-0.dll
<Current directory>\api-ms-win-core-errorhandling-l1-1-0.dll
<Current directory>\api-ms-win-core-file-l1-1-0.dll
<Current directory>\api-ms-win-core-file-l1-2-0.dll
<Current directory>\api-ms-win-core-file-l2-1-0.dll
<Current directory>\api-ms-win-core-handle-l1-1-0.dll
<Current directory>\api-ms-win-core-heap-l1-1-0.dll
<Current directory>\api-ms-win-core-interlocked-l1-1-0.dll
<Current directory>\api-ms-win-core-datetime-l1-1-0.dll
<Current directory>\api-ms-win-core-libraryloader-l1-1-0.dll
<Current directory>\api-ms-win-core-memory-l1-1-0.dll
<Current directory>\api-ms-win-core-namedpipe-l1-1-0.dll
<Current directory>\api-ms-win-core-processenvironment-l1-1-0.dll
<Current directory>\api-ms-win-core-processthreads-l1-1-0.dll
<Current directory>\api-ms-win-core-processthreads-l1-1-1.dll
<Current directory>\api-ms-win-core-profile-l1-1-0.dll
<Current directory>\api-ms-win-core-rtlsupport-l1-1-0.dll
<Current directory>\api-ms-win-core-string-l1-1-0.dll
<Current directory>\api-ms-win-core-localization-l1-2-0.dll
<Current directory>\ucrtbase.dll
<Current directory>\vcruntime140.dll

Deletes the following files

<Current directory>\d.cab

Moves the following files

from <Current directory>\$dpx$.tmp\56d49b4846b83b49b87b379289e4cbe6.tmp to <Current directory>\api-ms-win-core-console-l1-1-0.dll
from <Current directory>\$dpx$.tmp\aedeb2ec66c7b440b92c55ffe055f837.tmp to <Current directory>\api-ms-win-crt-conio-l1-1-0.dll
from <Current directory>\$dpx$.tmp\aca35d5fcaa8c54393edcd70da699d0b.tmp to <Current directory>\api-ms-win-crt-convert-l1-1-0.dll
from <Current directory>\$dpx$.tmp\b339b7f0c1b01f43ab518940b5526a76.tmp to <Current directory>\api-ms-win-crt-environment-l1-1-0.dll
from <Current directory>\$dpx$.tmp\fc42ebd6edb2c5479a2bfc5e3850c4ac.tmp to <Current directory>\api-ms-win-crt-filesystem-l1-1-0.dll
from <Current directory>\$dpx$.tmp\d3f426e605521048a35919c493a95086.tmp to <Current directory>\api-ms-win-crt-heap-l1-1-0.dll
from <Current directory>\$dpx$.tmp\f58e95f92f698545abcbc2cdc6dad377.tmp to <Current directory>\api-ms-win-crt-locale-l1-1-0.dll
from <Current directory>\$dpx$.tmp\51cb8845b5cf1b4c953ae423fe2a3311.tmp to <Current directory>\api-ms-win-crt-math-l1-1-0.dll
from <Current directory>\$dpx$.tmp\1551aee76493df4d8f7e9cfbe70afcd9.tmp to <Current directory>\api-ms-win-core-timezone-l1-1-0.dll
from <Current directory>\$dpx$.tmp\c2acfac2a259e8459860e1c4818624bb.tmp to <Current directory>\api-ms-win-core-util-l1-1-0.dll
from <Current directory>\$dpx$.tmp\62ef655cb88ef34aa1803aa3ccdd0c49.tmp to <Current directory>\api-ms-win-crt-multibyte-l1-1-0.dll
from <Current directory>\$dpx$.tmp\93ecb85d4b4eb7488b8cacc9f655cb8f.tmp to <Current directory>\api-ms-win-crt-runtime-l1-1-0.dll
from <Current directory>\$dpx$.tmp\a3904f418efb034db9a38a2ee7f7c73a.tmp to <Current directory>\api-ms-win-crt-stdio-l1-1-0.dll
from <Current directory>\$dpx$.tmp\6b205db5417c9344a0750cd2c348ca94.tmp to <Current directory>\api-ms-win-crt-string-l1-1-0.dll
from <Current directory>\$dpx$.tmp\40b7fd05e9b1b547aa24d58a587e2acb.tmp to <Current directory>\api-ms-win-crt-time-l1-1-0.dll
from <Current directory>\$dpx$.tmp\d695c30b984b8440b134eebdbb6b9c89.tmp to <Current directory>\api-ms-win-crt-utility-l1-1-0.dll
from <Current directory>\$dpx$.tmp\f59fc17059142148af4454fb222dbd7f.tmp to <Current directory>\msvcp140.dll
from <Current directory>\$dpx$.tmp\5527e281af9d144ea74167d4a1006656.tmp to <Current directory>\opencl.dll
from <Current directory>\$dpx$.tmp\22b5657000cd45478d4464978720f662.tmp to <Current directory>\api-ms-win-crt-private-l1-1-0.dll
from <Current directory>\$dpx$.tmp\98562b7159c15341b967df242abee6db.tmp to <Current directory>\api-ms-win-crt-process-l1-1-0.dll
from <Current directory>\$dpx$.tmp\b9aba834b6884d4280c472d5deac79c7.tmp to <Current directory>\api-ms-win-core-sysinfo-l1-1-0.dll
from <Current directory>\$dpx$.tmp\0bb104b4c85db0429e584d964a740b87.tmp to <Current directory>\api-ms-win-core-synch-l1-2-0.dll
from <Current directory>\$dpx$.tmp\3a4d75507fc8cb479c42ca397d161a63.tmp to <Current directory>\api-ms-win-core-synch-l1-1-0.dll
from <Current directory>\$dpx$.tmp\45c6b8380ac94b4d90141a66edf9c490.tmp to <Current directory>\api-ms-win-core-debug-l1-1-0.dll
from <Current directory>\$dpx$.tmp\5a3493fa32845f4fa26b89163bea87e1.tmp to <Current directory>\api-ms-win-core-errorhandling-l1-1-0.dll
from <Current directory>\$dpx$.tmp\a8a11254bbc570498a2d71cf4b6c8ccc.tmp to <Current directory>\api-ms-win-core-file-l1-1-0.dll
from <Current directory>\$dpx$.tmp\6f6666d04f374c47b98f2538f2c5e7a1.tmp to <Current directory>\api-ms-win-core-file-l1-2-0.dll
from <Current directory>\$dpx$.tmp\c8586296c0d7f04696f8332c51fa2353.tmp to <Current directory>\api-ms-win-core-file-l2-1-0.dll
from <Current directory>\$dpx$.tmp\905c69e3838e9d41a061c7fc02e21b4c.tmp to <Current directory>\api-ms-win-core-handle-l1-1-0.dll
from <Current directory>\$dpx$.tmp\1409d5afa54e904e93a2106dee4b9bf2.tmp to <Current directory>\api-ms-win-core-heap-l1-1-0.dll
from <Current directory>\$dpx$.tmp\864986baf139564ab4e02a4607e50dc8.tmp to <Current directory>\api-ms-win-core-interlocked-l1-1-0.dll
from <Current directory>\$dpx$.tmp\a841880e524d4945b72d9a3da3a4c5dd.tmp to <Current directory>\api-ms-win-core-datetime-l1-1-0.dll
from <Current directory>\$dpx$.tmp\cbf52a24054c2e44ace46511ca00b57a.tmp to <Current directory>\api-ms-win-core-libraryloader-l1-1-0.dll
from <Current directory>\$dpx$.tmp\072fb3baff190d40adffd8c7e603bb33.tmp to <Current directory>\api-ms-win-core-memory-l1-1-0.dll
from <Current directory>\$dpx$.tmp\5d8b03fbd1d23741b7067b9a501a09cc.tmp to <Current directory>\api-ms-win-core-namedpipe-l1-1-0.dll
from <Current directory>\$dpx$.tmp\dad151ef7874e949bd800f8f38f17e03.tmp to <Current directory>\api-ms-win-core-processenvironment-l1-1-0.dll
from <Current directory>\$dpx$.tmp\7ba9e01a1aa8be46a1de68b5d59316ff.tmp to <Current directory>\api-ms-win-core-processthreads-l1-1-0.dll
from <Current directory>\$dpx$.tmp\4ed94262d88aa149a4f1d522c476020b.tmp to <Current directory>\api-ms-win-core-processthreads-l1-1-1.dll
from <Current directory>\$dpx$.tmp\015269c5e347c04ba142eced84e054cc.tmp to <Current directory>\api-ms-win-core-profile-l1-1-0.dll
from <Current directory>\$dpx$.tmp\a1ddbeb4f39e9a428e09f822ece9889f.tmp to <Current directory>\api-ms-win-core-rtlsupport-l1-1-0.dll
from <Current directory>\$dpx$.tmp\ba90b077c5fa5c469e59fc160d51c476.tmp to <Current directory>\api-ms-win-core-string-l1-1-0.dll
from <Current directory>\$dpx$.tmp\5f88cbc7ba325042b55ee8e077675206.tmp to <Current directory>\api-ms-win-core-localization-l1-2-0.dll
from <Current directory>\$dpx$.tmp\9b325f816ff1fe4e865c3b4bccab8948.tmp to <Current directory>\ucrtbase.dll
from <Current directory>\$dpx$.tmp\f350a11b09a89a4e98734fbb1436fec5.tmp to <Current directory>\vcruntime140.dll

Network activity

Connects to

'lp##.abbny.com':443
'lp##.haqo.net':443

TCP

Other

'lp##.abbny.com':443
'lp##.haqo.net':443

UDP

DNS ASK lp##.beahh.com
DNS ASK lp##.abbny.com
DNS ASK lp##.haqo.net

Miscellaneous

Creates and executes the following

'<SYSTEM32>\cmd.exe' /c expand d.cab -f:* . & del d.cab /a' (with hidden window)

Executes the following

'<SYSTEM32>\cmd.exe' /c expand d.cab -f:* . & del d.cab /a
'<SYSTEM32>\expand.exe' d.cab -f:* .

Technologies

Terminology

Training and education

Myths

Technical Information

Curing recommendations

Free trial