Trojan.MulDrop33.36308

Technical Information

Modifies file system

Creates the following files

<Current directory>\1762094428452.exe
<Current directory>\1762094429023.exe
<Current directory>\1762094429556.exe
<Current directory>\1762094430094.exe
<Current directory>\1762094430625.exe
<Current directory>\1762094431161.exe
<Current directory>\1762094431691.exe
<Current directory>\1762094432376.exe
<Current directory>\1762094432957.exe
<Current directory>\1762094433560.exe
<Current directory>\1762094434160.exe
<Current directory>\1762094434734.exe
<Current directory>\1762094435300.exe
<Current directory>\1762094435843.exe
<Current directory>\1762094436389.exe
<Current directory>\1762094436963.exe
<Current directory>\1762094437553.exe
<Current directory>\1762094438160.exe
<Current directory>\1762094438741.exe
<Current directory>\1762094439362.exe
<Current directory>\1762094439961.exe
<Current directory>\1762094440542.exe
<Current directory>\1762094441158.exe
<Current directory>\1762094441735.exe
<Current directory>\1762094442307.exe
<Current directory>\1762094442862.exe
<Current directory>\1762094443432.exe
<Current directory>\1762094444010.exe
<Current directory>\1762094444566.exe
<Current directory>\1762094445140.exe
<Current directory>\1762094445686.exe
<Current directory>\1762094446250.exe
<Current directory>\1762094446807.exe
<Current directory>\1762094447363.exe
<Current directory>\1762094447921.exe
<Current directory>\1762094448450.exe
<Current directory>\1762126018820.exe
<Current directory>\1762126019391.exe
<Current directory>\1762126019953.exe
<Current directory>\1762126020557.exe
<Current directory>\1762126021128.exe
<Current directory>\1762126021661.exe
<Current directory>\1762126022225.exe
<Current directory>\1762126022769.exe

Deletes following files that it created itself

<Current directory>\1762094428452.exe
<Current directory>\1762094429023.exe
<Current directory>\1762094429556.exe
<Current directory>\1762094430094.exe
<Current directory>\1762094430625.exe
<Current directory>\1762094431161.exe
<Current directory>\1762094431691.exe
<Current directory>\1762094432376.exe
<Current directory>\1762094432957.exe
<Current directory>\1762094433560.exe
<Current directory>\1762094434160.exe
<Current directory>\1762094434734.exe
<Current directory>\1762094435300.exe
<Current directory>\1762094435843.exe
<Current directory>\1762094436389.exe
<Current directory>\1762094436963.exe
<Current directory>\1762094437553.exe
<Current directory>\1762094438160.exe
<Current directory>\1762094438741.exe
<Current directory>\1762094439362.exe
<Current directory>\1762094439961.exe
<Current directory>\1762094440542.exe
<Current directory>\1762094441158.exe
<Current directory>\1762094441735.exe
<Current directory>\1762094442307.exe
<Current directory>\1762094442862.exe
<Current directory>\1762094443432.exe
<Current directory>\1762094444010.exe
<Current directory>\1762094444566.exe
<Current directory>\1762094445140.exe
<Current directory>\1762094445686.exe
<Current directory>\1762094446250.exe
<Current directory>\1762094446807.exe
<Current directory>\1762094447363.exe
<Current directory>\1762094447921.exe
<Current directory>\1762094448450.exe
<Current directory>\1762126018820.exe
<Current directory>\1762126019391.exe
<Current directory>\1762126019953.exe
<Current directory>\1762126020557.exe
<Current directory>\1762126021128.exe
<Current directory>\1762126021661.exe

Modifies the following files

%LOCALAPPDATA%\microsoft\penworkspace\discovercachedata.dat

Deletes itself.

Network activity

Connects to

'mo#####.map.fastly.net':443
'co##############e-chains.prod.autograph.services.mozaws.net':443

UDP

DNS ASK mo#####.map.fastly.net
DNS ASK co##############e-chains.prod.autograph.services.mozaws.net

Miscellaneous

Creates and executes the following

'<Current directory>\1762094428452.exe'
'<Current directory>\1762094429023.exe'
'<Current directory>\1762094429556.exe'
'<Current directory>\1762094430094.exe'
'<Current directory>\1762094430625.exe'
'<Current directory>\1762094431161.exe'
'<Current directory>\1762094431691.exe'
'<Current directory>\1762094432376.exe'
'<Current directory>\1762094432957.exe'
'<Current directory>\1762094433560.exe'
'<Current directory>\1762094434160.exe'
'<Current directory>\1762094434734.exe'
'<Current directory>\1762094435300.exe'
'<Current directory>\1762094435843.exe'
'<Current directory>\1762094436389.exe'
'<Current directory>\1762094436963.exe'
'<Current directory>\1762094437553.exe'
'<Current directory>\1762094438160.exe'
'<Current directory>\1762094438741.exe'
'<Current directory>\1762094439362.exe'
'<Current directory>\1762094439961.exe'
'<Current directory>\1762094440542.exe'
'<Current directory>\1762094441158.exe'
'<Current directory>\1762094441735.exe'
'<Current directory>\1762094442307.exe'
'<Current directory>\1762094442862.exe'
'<Current directory>\1762094443432.exe'
'<Current directory>\1762094444010.exe'
'<Current directory>\1762094444566.exe'
'<Current directory>\1762094445140.exe'
'<Current directory>\1762094445686.exe'
'<Current directory>\1762094446250.exe'
'<Current directory>\1762094446807.exe'
'<Current directory>\1762094447363.exe'
'<Current directory>\1762094447921.exe'
'<Current directory>\1762094448450.exe'
'<Current directory>\1762126018820.exe'
'<Current directory>\1762126019391.exe'
'<Current directory>\1762126019953.exe'
'<Current directory>\1762126020557.exe'
'<Current directory>\1762126021128.exe'
'<Current directory>\1762126021661.exe'
'<Current directory>\1762126022225.exe'

Technologies

Terminology

Training and education

Myths

Technical Information

Curing recommendations

Free trial