Trojan.MulDrop21.47187

Техническая информация

Для обеспечения автозапуска и распространения

Модифицирует следующие ключи реестра

[<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run] 'Microsoft Manager' = '%WINDIR% (x86)\explorer.exe�'

Изменения в файловой системе

Создает следующие файлы

%WINDIR% (x86)\bootstr.dll
%WINDIR% (x86)\kbdwol.dll
%WINDIR% (x86)\kbdvntc.dll
%WINDIR% (x86)\kbduzb.dll
%WINDIR% (x86)\kbdusx.dll
%WINDIR% (x86)\kbdusr.dll
%WINDIR% (x86)\kbdusl.dll
%WINDIR% (x86)\kbdyak.dll
%WINDIR% (x86)\kbdusa.dll
%WINDIR% (x86)\kbdur1.dll
%WINDIR% (x86)\kbdur.dll
%WINDIR% (x86)\kbdukx.dll
%WINDIR% (x86)\kbduk.dll
%WINDIR% (x86)\kbdughr1.dll
%WINDIR% (x86)\kbdughr.dll
%WINDIR% (x86)\kbdurdu.dll
%WINDIR% (x86)\kbdyba.dll
%WINDIR% (x86)\kbdycc.dll
%WINDIR% (x86)\kbdycl.dll
%WINDIR% (x86)\msxml3r.dll
%WINDIR% (x86)\msprivs.dll
%WINDIR% (x86)\msimg32.dll
%WINDIR% (x86)\msidntld.dll
%WINDIR% (x86)\msafd.dll
%WINDIR% (x86)\microsoft-windows-storage-tiering-events.dll
%WINDIR% (x86)\microsoft-windows-sleepstudy-events.dll
%WINDIR% (x86)\microsoft-windows-processor-aggregator-events.dll
%WINDIR% (x86)\microsoft-windowsphone-semanagementprovider.dll
%WINDIR% (x86)\microsoft-windows-hal-events.dll
%WINDIR% (x86)\microsoft.uev.syncconditions.dll
%WINDIR% (x86)\microsoft.uev.monitorsyncprovider.dll
%WINDIR% (x86)\lz32.dll
%WINDIR% (x86)\lpk.dll
%WINDIR% (x86)\lltdres.dll
%WINDIR% (x86)\kbdtzm.dll
%WINDIR% (x86)\msxml6r.dll
%WINDIR% (x86)\kbdturme.dll
%WINDIR% (x86)\kbdtuf.dll
%WINDIR% (x86)\kbdsors1.dll
%WINDIR% (x86)\kbdsorex.dll
%WINDIR% (x86)\kbdsora.dll
%WINDIR% (x86)\kbdsn1.dll
%WINDIR% (x86)\kbdsmsno.dll
%WINDIR% (x86)\kbdsmsfi.dll
%WINDIR% (x86)\kbdsorst.dll
%WINDIR% (x86)\kbdsl1.dll
%WINDIR% (x86)\kbdsg.dll
%WINDIR% (x86)\kbdsf.dll
%WINDIR% (x86)\kbdrum.dll
%WINDIR% (x86)\kbdru1.dll
%WINDIR% (x86)\kbdru.dll
%WINDIR% (x86)\kbdro.dll
%WINDIR% (x86)\kbdsl.dll
%WINDIR% (x86)\kbdsp.dll
%WINDIR% (x86)\kbdsw.dll
%WINDIR% (x86)\kbdsw09.dll
%WINDIR% (x86)\kbdtt102.dll
%WINDIR% (x86)\kbdtiprd.dll
%WINDIR% (x86)\kbdtiprc.dll
%WINDIR% (x86)\kbdtifi2.dll
%WINDIR% (x86)\kbdtifi.dll
%WINDIR% (x86)\kbdth3.dll
%WINDIR% (x86)\kbdth2.dll
%WINDIR% (x86)\kbdth1.dll
%WINDIR% (x86)\kbdth0.dll
%WINDIR% (x86)\kbdtat.dll
%WINDIR% (x86)\kbdtam99.dll
%WINDIR% (x86)\kbdtajik.dll
%WINDIR% (x86)\kbdtaile.dll
%WINDIR% (x86)\kbdsyr2.dll
%WINDIR% (x86)\kbdsyr1.dll
%WINDIR% (x86)\kbdtuq.dll
%WINDIR% (x86)\phonesystemtoasticon.contrast-white.png
%WINDIR% (x86)\asferror.dll
%WINDIR% (x86)\normaliz.dll
%WINDIR% (x86)\kanji_2.uce
%WINDIR% (x86)\kanji_1.uce
%WINDIR% (x86)\uevcustomactiontypes.tlb
%WINDIR% (x86)\stdole32.tlb
%WINDIR% (x86)\simpdata.tlb
%WINDIR% (x86)\rendezvoussession.tlb
%WINDIR% (x86)\iglhxs64.vp
%WINDIR% (x86)\msralegacy.tlb
%WINDIR% (x86)\ieuinit.inf
%WINDIR% (x86)\sysprtj.sep
%WINDIR% (x86)\sysprint.sep
%WINDIR% (x86)\web.rs
%WINDIR% (x86)\wpcmon.png
%WINDIR% (x86)\securityandmaintenance_error.png
%WINDIR% (x86)\msdatsrc.tlb
%WINDIR% (x86)\mmc.exe.config
%WINDIR% (x86)\appxprovisioning.xml
%WINDIR% (x86)\detailedreading-default.xml
%WINDIR% (x86)\advapi32res.dll
%WINDIR% (x86)\wuapihost.exe
%WINDIR% (x86)\wscadminui.exe
%WINDIR% (x86)\wowreg32.exe
%WINDIR% (x86)\windows.media.backgroundplayback.exe
%WINDIR% (x86)\webcache.exe
%WINDIR% (x86)\verclsid.exe
%WINDIR% (x86)\userinit.exe
%WINDIR% (x86)\uevtemplateconfigitemgenerator.exe
%WINDIR% (x86)\tracert.exe
%WINDIR% (x86)\explorer.exe
%WINDIR% (x86)\msdxm.ocx
%WINDIR% (x86)\wsmtxt.xsl
%WINDIR% (x86)\xwizard.dtd
%WINDIR% (x86)\wsmanconfig_schema.xml
%WINDIR% (x86)\securityandmaintenance_alert.png
%WINDIR% (x86)\kbdpo.dll
%WINDIR% (x86)\securityandmaintenance.png
%WINDIR% (x86)\bluetoothpairingsystemtoasticon.png
%WINDIR% (x86)\tzsyncres.dll
%WINDIR% (x86)\tzres.dll
%WINDIR% (x86)\tpmcertresources.dll
%WINDIR% (x86)\tier2punctuations.dll
%WINDIR% (x86)\telephonyinteractiveuserres.dll
%WINDIR% (x86)\syncres.dll
%WINDIR% (x86)\userdataaccessres.dll
%WINDIR% (x86)\srevents.dll
%WINDIR% (x86)\sfc.dll
%WINDIR% (x86)\security.dll
%WINDIR% (x86)\rnr20.dll
%WINDIR% (x86)\phoneutilres.dll
%WINDIR% (x86)\phoneserviceres.dll
%WINDIR% (x86)\oleaccrc.dll
%WINDIR% (x86)\shimeng.dll
%WINDIR% (x86)\wclwdi.dll
%WINDIR% (x86)\windows.management.secureassessment.diagnostics.dll
%WINDIR% (x86)\winrsmgr.dll
%WINDIR% (x86)\bluetoothpairingsystemtoasticon.contrast-white.png
%WINDIR% (x86)\bluetoothpairingsystemtoasticon.contrast-high.png
%WINDIR% (x86)\bluetoothpairingsystemtoasticon.contrast-black.png
%WINDIR% (x86)\psmodulediscoveryprovider.mof
%WINDIR% (x86)\respriimagelist
%WINDIR% (x86)\settings.dat
%WINDIR% (x86)\firewall.cpl
%WINDIR% (x86)\wimbootcompress.ini
%WINDIR% (x86)\edgehtmlpluginpolicy.bin
%WINDIR% (x86)\xaudio2_8.dll
%WINDIR% (x86)\ws2help.dll
%WINDIR% (x86)\wmi.dll
%WINDIR% (x86)\wmerror.dll
%WINDIR% (x86)\wmdrmsdk.dll
%WINDIR% (x86)\wlanutil.dll
%WINDIR% (x86)\neth.dll
%WINDIR% (x86)\netmsg.dll
%WINDIR% (x86)\kbdpl1.dll
%WINDIR% (x86)\kbdhau.dll
%WINDIR% (x86)\kbdes.dll
%WINDIR% (x86)\kbddzo.dll
%WINDIR% (x86)\kbddv.dll
%WINDIR% (x86)\kbddiv2.dll
%WINDIR% (x86)\kbddiv1.dll
%WINDIR% (x86)\kbdda.dll
%WINDIR% (x86)\kbdest.dll
%WINDIR% (x86)\kbdcz2.dll
%WINDIR% (x86)\kbdcz.dll
%WINDIR% (x86)\kbdcr.dll
%WINDIR% (x86)\kbdcher.dll
%WINDIR% (x86)\kbdca.dll
%WINDIR% (x86)\kbdbulg.dll
%WINDIR% (x86)\kbdbug.dll
%WINDIR% (x86)\kbdcz1.dll
%WINDIR% (x86)\kbdfa.dll
%WINDIR% (x86)\kbdfar.dll
%WINDIR% (x86)\kbdfc.dll
%WINDIR% (x86)\kbdgr1.dll
%WINDIR% (x86)\kbdgr.dll
%WINDIR% (x86)\kbdgn.dll
%WINDIR% (x86)\kbdgkl.dll
%WINDIR% (x86)\kbdgeoqw.dll
%WINDIR% (x86)\kbdgeooa.dll
%WINDIR% (x86)\kbdgeome.dll
%WINDIR% (x86)\kbdgeoer.dll
%WINDIR% (x86)\kbdgeo.dll
%WINDIR% (x86)\kbdgae.dll
%WINDIR% (x86)\kbdfthrk.dll
%WINDIR% (x86)\kbdfr.dll
%WINDIR% (x86)\kbdfo.dll
%WINDIR% (x86)\kbdfi1.dll
%WINDIR% (x86)\kbdfi.dll
%WINDIR% (x86)\kbdbu.dll
%WINDIR% (x86)\kbdgrlnd.dll
%WINDIR% (x86)\kbdbr.dll
%WINDIR% (x86)\kbdbhc.dll
%WINDIR% (x86)\kbd103.dll
%WINDIR% (x86)\kbd101c.dll
%WINDIR% (x86)\kbd101b.dll
%WINDIR% (x86)\kbd101a.dll
%WINDIR% (x86)\kbd101.dll
%WINDIR% (x86)\iologmsg.dll
%WINDIR% (x86)\kbd106.dll
%WINDIR% (x86)\icmp.dll
%WINDIR% (x86)\f3ahvoas.dll
%WINDIR% (x86)\dxmasf.dll
%WINDIR% (x86)\dmdskres2.dll
%WINDIR% (x86)\dmappsres.dll
%WINDIR% (x86)\defragres.dll
%WINDIR% (x86)\bridgeres.dll
%WINDIR% (x86)\fxsevent.dll
%WINDIR% (x86)\kbd106n.dll
%WINDIR% (x86)\kbda1.dll
%WINDIR% (x86)\kbda2.dll
%WINDIR% (x86)\kbdbgph1.dll
%WINDIR% (x86)\kbdbgph.dll
%WINDIR% (x86)\kbdbene.dll
%WINDIR% (x86)\kbdbe.dll
%WINDIR% (x86)\kbdbash.dll
%WINDIR% (x86)\kbdazst.dll
%WINDIR% (x86)\kbdazel.dll
%WINDIR% (x86)\kbdaze.dll
%WINDIR% (x86)\kbdax2.dll
%WINDIR% (x86)\kbdarmw.dll
%WINDIR% (x86)\kbdarmty.dll
%WINDIR% (x86)\kbdarmph.dll
%WINDIR% (x86)\kbdarme.dll
%WINDIR% (x86)\kbdal.dll
%WINDIR% (x86)\kbda3.dll
%WINDIR% (x86)\kbdblr.dll
%WINDIR% (x86)\kbdkni.dll
%WINDIR% (x86)\kbdphags.dll
%WINDIR% (x86)\kbdhaw.dll
%WINDIR% (x86)\kbdmlt47.dll
%WINDIR% (x86)\kbdmaori.dll
%WINDIR% (x86)\kbdmacst.dll
%WINDIR% (x86)\kbdmac.dll
%WINDIR% (x86)\kbdlv1.dll
%WINDIR% (x86)\kbdlv.dll
%WINDIR% (x86)\kbdmlt48.dll
%WINDIR% (x86)\kbdlt2.dll
%WINDIR% (x86)\kbdlt.dll
%WINDIR% (x86)\kbdlk41a.dll
%WINDIR% (x86)\kbdlisus.dll
%WINDIR% (x86)\kbdlisub.dll
%WINDIR% (x86)\kbdlao.dll
%WINDIR% (x86)\kbdla.dll
%WINDIR% (x86)\kbdlt1.dll
%WINDIR% (x86)\kbdmon.dll
%WINDIR% (x86)\kbdmonmo.dll
%WINDIR% (x86)\kbdmonst.dll
%WINDIR% (x86)\kbdpash.dll
%WINDIR% (x86)\kbdosm.dll
%WINDIR% (x86)\kbdoldit.dll
%WINDIR% (x86)\kbdolch.dll
%WINDIR% (x86)\kbdogham.dll
%WINDIR% (x86)\kbdntl.dll
%WINDIR% (x86)\kbdnso.dll
%WINDIR% (x86)\kbdno1.dll
%WINDIR% (x86)\kbdno.dll
%WINDIR% (x86)\kbdnko.dll
%WINDIR% (x86)\kbdnepr.dll
%WINDIR% (x86)\kbdnec95.dll
%WINDIR% (x86)\kbdnec.dll
%WINDIR% (x86)\kbdne.dll
%WINDIR% (x86)\kbdmyan.dll
%WINDIR% (x86)\kbdkyr.dll
%WINDIR% (x86)\kbdpl.dll
%WINDIR% (x86)\kbdkurd.dll
%WINDIR% (x86)\kbdkhmr.dll
%WINDIR% (x86)\kbdinbe1.dll
%WINDIR% (x86)\kbdinasa.dll
%WINDIR% (x86)\kbdic.dll
%WINDIR% (x86)\kbdibo.dll
%WINDIR% (x86)\kbdibm02.dll
%WINDIR% (x86)\kbdhu1.dll
%WINDIR% (x86)\kbdinbe2.dll
%WINDIR% (x86)\kbdhu.dll
%WINDIR% (x86)\kbdhela2.dll
%WINDIR% (x86)\kbdhebl3.dll
%WINDIR% (x86)\kbdheb.dll
%WINDIR% (x86)\kbdhe319.dll
%WINDIR% (x86)\kbdhe220.dll
%WINDIR% (x86)\kbdhe.dll
%WINDIR% (x86)\kbdhela3.dll
%WINDIR% (x86)\kbdinben.dll
%WINDIR% (x86)\kbdindev.dll
%WINDIR% (x86)\kbdinguj.dll
%WINDIR% (x86)\kbdkaz.dll
%WINDIR% (x86)\kbdjav.dll
%WINDIR% (x86)\kbdiulat.dll
%WINDIR% (x86)\kbdit142.dll
%WINDIR% (x86)\kbdit.dll
%WINDIR% (x86)\kbdir.dll
%WINDIR% (x86)\kbdinuk2.dll
%WINDIR% (x86)\kbdintel.dll
%WINDIR% (x86)\kbdintam.dll
%WINDIR% (x86)\kbdinpun.dll
%WINDIR% (x86)\kbdinori.dll
%WINDIR% (x86)\kbdinmar.dll
%WINDIR% (x86)\kbdinmal.dll
%WINDIR% (x86)\kbdinkan.dll
%WINDIR% (x86)\kbdinhin.dll
%WINDIR% (x86)\kbdgthc.dll
%WINDIR% (x86)\blbres.dll

Сетевая активность

UDP

DNS ASK si########1.monero.hashvault.pro

Другое

Ищет следующие окна

ClassName: 'EDIT' WindowName: ''

Создает и запускает на исполнение

'%WINDIR% (x86)\explorer.exe'

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней