Trojan.MulDrop37.29470

Техническая информация

Для обеспечения автозапуска и распространения

Модифицирует следующие ключи реестра

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'kawauchi' = '%APPDATA%\kawauchi\run.bat'

Изменения в файловой системе

Создает следующие файлы

%TEMP%\services.exe
%TEMP%\_mei53762\crypto\cipher\_arc4.pyd
%TEMP%\_mei53762\crypto\cipher\_salsa20.pyd
%TEMP%\_mei53762\crypto\cipher\_chacha20.pyd
%TEMP%\_mei53762\crypto\cipher\_pkcs1_decode.pyd
%TEMP%\_mei53762\crypto\cipher\_raw_aes.pyd
%TEMP%\_mei53762\crypto\cipher\_raw_aesni.pyd
%TEMP%\_mei53762\crypto\cipher\_raw_arc2.pyd
%TEMP%\_mei53762\crypto\cipher\_raw_blowfish.pyd
%TEMP%\_mei53762\crypto\cipher\_raw_cast.pyd
%TEMP%\_mei53762\crypto\cipher\_raw_cbc.pyd
%TEMP%\_mei53762\crypto\cipher\_raw_cfb.pyd
%TEMP%\_mei53762\crypto\cipher\_raw_ctr.pyd
%TEMP%\_mei53762\crypto\cipher\_raw_des.pyd
%TEMP%\_mei53762\crypto\cipher\_raw_des3.pyd
%TEMP%\_mei53762\crypto\cipher\_raw_ecb.pyd
%TEMP%\_mei53762\crypto\cipher\_raw_eksblowfish.pyd
%TEMP%\_mei53762\crypto\cipher\_raw_ocb.pyd
%TEMP%\_mei53762\crypto\cipher\_raw_ofb.pyd
%TEMP%\_mei53762\crypto\hash\_blake2b.pyd
%TEMP%\_mei53762\crypto\hash\_blake2s.pyd
%TEMP%\_mei53762\crypto\hash\_md2.pyd
%TEMP%\_mei53762\crypto\hash\_md4.pyd
%TEMP%\_mei53762\crypto\hash\_md5.pyd
%TEMP%\_mei53762\crypto\hash\_ripemd160.pyd
%TEMP%\_mei53762\crypto\hash\_sha1.pyd
%TEMP%\_mei53762\crypto\hash\_sha224.pyd
%TEMP%\_mei53762\crypto\hash\_sha256.pyd
%TEMP%\_mei53762\crypto\hash\_sha384.pyd
%TEMP%\_mei53762\crypto\hash\_sha512.pyd
%TEMP%\_mei53762\crypto\hash\_ghash_clmul.pyd
%TEMP%\_mei53762\crypto\hash\_ghash_portable.pyd
%TEMP%\_mei53762\crypto\hash\_keccak.pyd
%TEMP%\_mei53762\crypto\hash\_poly1305.pyd
%TEMP%\_mei53762\crypto\math\_modexp.pyd
%TEMP%\_mei53762\crypto\protocol\_scrypt.pyd
%TEMP%\_mei53762\crypto\publickey\_ec_ws.pyd
%TEMP%\_mei53762\crypto\publickey\_ed25519.pyd
%TEMP%\_mei53762\crypto\publickey\_ed448.pyd
%TEMP%\_mei53762\crypto\publickey\_x25519.pyd
%TEMP%\_mei53762\crypto\util\_cpuid_c.pyd
%TEMP%\_mei53762\crypto\util\_strxor.pyd
%TEMP%\_mei53762\pil\_imaging.cp310-win_amd64.pyd
%TEMP%\_mei53762\pil\_imagingcms.cp310-win_amd64.pyd
%TEMP%\_mei53762\pil\_imagingft.cp310-win_amd64.pyd
%TEMP%\_mei53762\pil\_imagingtk.cp310-win_amd64.pyd
%TEMP%\_mei53762\pil\_webp.cp310-win_amd64.pyd
%TEMP%\_mei53762\vcruntime140.dll
%TEMP%\_mei53762\vcruntime140_1.dll
%TEMP%\_mei53762\_asyncio.pyd
%TEMP%\_mei53762\_bz2.pyd
%TEMP%\_mei53762\_cffi_backend.cp310-win_amd64.pyd
%TEMP%\_mei53762\_ctypes.pyd
%TEMP%\_mei53762\_decimal.pyd
%TEMP%\_mei53762\_hashlib.pyd
%TEMP%\_mei53762\_lzma.pyd
%TEMP%\_mei53762\_multiprocessing.pyd
%TEMP%\_mei53762\_overlapped.pyd
%TEMP%\_mei53762\_queue.pyd
%TEMP%\_mei53762\_socket.pyd
%TEMP%\_mei53762\_sqlite3.pyd
%TEMP%\_mei53762\_ssl.pyd
%TEMP%\_mei53762\_uuid.pyd
%TEMP%\_mei53762\_win32sysloader.pyd
%TEMP%\_mei53762\aiohttp\_http_parser.cp310-win_amd64.pyd
%TEMP%\_mei53762\aiohttp\_http_writer.cp310-win_amd64.pyd
%TEMP%\_mei53762\aiohttp\_websocket\mask.cp310-win_amd64.pyd
%TEMP%\_mei53762\aiohttp\_websocket\reader_c.cp310-win_amd64.pyd
%TEMP%\_mei53762\cryptography\hazmat\bindings\_rust.pyd
%TEMP%\_mei53762\frozenlist\_frozenlist.cp310-win_amd64.pyd
%TEMP%\_mei53762\libcrypto-1_1.dll
%TEMP%\_mei53762\libffi-7.dll
%TEMP%\_mei53762\libssl-1_1.dll
%TEMP%\_mei53762\mfc140u.dll
%TEMP%\_mei53762\multidict\_multidict.cp310-win_amd64.pyd
%TEMP%\_mei53762\propcache\_helpers_c.cp310-win_amd64.pyd
%TEMP%\_mei53762\psutil\_psutil_windows.pyd
%TEMP%\_mei53762\pyexpat.pyd
%TEMP%\_mei53762\python3.dll
%TEMP%\_mei53762\python310.dll
%TEMP%\_mei53762\pythoncom310.dll
%TEMP%\_mei53762\pywintypes310.dll
%TEMP%\_mei53762\select.pyd
%TEMP%\_mei53762\sqlite3.dll
%TEMP%\_mei53762\unicodedata.pyd
%TEMP%\_mei53762\win32api.pyd
%TEMP%\_mei53762\win32com\shell\shell.pyd
%TEMP%\_mei53762\win32crypt.pyd
%TEMP%\_mei53762\win32trace.pyd
%TEMP%\_mei53762\win32ui.pyd
%TEMP%\_mei53762\yarl\_quoting_c.cp310-win_amd64.pyd
%TEMP%\_mei53762\attrs-23.1.0.dist-info\installer
%TEMP%\_mei53762\attrs-23.1.0.dist-info\metadata
%TEMP%\_mei53762\attrs-23.1.0.dist-info\record
%TEMP%\_mei53762\attrs-23.1.0.dist-info\wheel
%TEMP%\_mei53762\attrs-23.1.0.dist-info\licenses\license
%TEMP%\_mei53762\base_library.zip
%TEMP%\_mei53762\certifi\cacert.pem
%TEMP%\_mei53762\cryptography-46.0.3.dist-info\installer
%TEMP%\_mei53762\cryptography-46.0.3.dist-info\metadata
%TEMP%\_mei53762\cryptography-46.0.3.dist-info\record
%TEMP%\_mei53762\cryptography-46.0.3.dist-info\wheel
%TEMP%\_mei53762\cryptography-46.0.3.dist-info\licenses\license
%TEMP%\_mei53762\cryptography-46.0.3.dist-info\licenses\license.apache
%TEMP%\_mei53762\cryptography-46.0.3.dist-info\licenses\license.bsd
%TEMP%\_mei53762\importlib_metadata-8.7.0.dist-info\installer
%TEMP%\_mei53762\importlib_metadata-8.7.0.dist-info\metadata
%TEMP%\_mei53762\importlib_metadata-8.7.0.dist-info\record
%TEMP%\_mei53762\importlib_metadata-8.7.0.dist-info\wheel
%TEMP%\_mei53762\importlib_metadata-8.7.0.dist-info\licenses\license
%TEMP%\_mei53762\importlib_metadata-8.7.0.dist-info\top_level.txt
%TEMP%\_mei53762\pyinstaller-5.1.dist-info\installer
%TEMP%\_mei53762\pyinstaller-5.1.dist-info\metadata
%TEMP%\_mei53762\pyinstaller-5.1.dist-info\record
%TEMP%\_mei53762\pyinstaller-5.1.dist-info\wheel
%TEMP%\_mei53762\pyinstaller-5.1.dist-info\direct_url.json
%TEMP%\_mei53762\pyinstaller-5.1.dist-info\entry_points.txt
%TEMP%\_mei53762\pyinstaller-5.1.dist-info\licenses\copying.txt
%TEMP%\_mei53762\pyinstaller-5.1.dist-info\top_level.txt
%TEMP%\_mei53762\setuptools-65.5.0.dist-info\installer
%TEMP%\_mei53762\setuptools-65.5.0.dist-info\license
%TEMP%\_mei53762\setuptools-65.5.0.dist-info\metadata
%TEMP%\_mei53762\setuptools-65.5.0.dist-info\record
%TEMP%\_mei53762\setuptools-65.5.0.dist-info\wheel
%TEMP%\_mei53762\setuptools-65.5.0.dist-info\entry_points.txt
%TEMP%\_mei53762\setuptools-65.5.0.dist-info\top_level.txt
%TEMP%\gm5q8kme
%TEMP%\tmpzrrdlrfe\gen_py\__init__.py
%TEMP%\tmpzrrdlrfe\gen_py\dicts.dat
<Текущая директория>\login_db
<Текущая директория>\web_history_db
<Текущая директория>\downloads_db
<Текущая директория>\cards_db
<Текущая директория>\vault.zip
%APPDATA%\kawauchi\dat.txt
%APPDATA%\kawauchi\run.bat
nul

Удаляет файлы, которые сам же создал

%TEMP%\gm5q8kme
<Текущая директория>\login_db
<Текущая директория>\web_history_db
<Текущая директория>\downloads_db
<Текущая директория>\cards_db
%TEMP%\tmpzrrdlrfe\gen_py\dicts.dat
%TEMP%\tmpzrrdlrfe\gen_py\__init__.py
%TEMP%\_mei53762\aiohttp\_http_parser.cp310-win_amd64.pyd
%TEMP%\_mei53762\aiohttp\_http_writer.cp310-win_amd64.pyd
%TEMP%\_mei53762\aiohttp\_websocket\mask.cp310-win_amd64.pyd
%TEMP%\_mei53762\aiohttp\_websocket\reader_c.cp310-win_amd64.pyd
%TEMP%\_mei53762\attrs-23.1.0.dist-info\installer
%TEMP%\_mei53762\attrs-23.1.0.dist-info\licenses\license
%TEMP%\_mei53762\attrs-23.1.0.dist-info\metadata
%TEMP%\_mei53762\attrs-23.1.0.dist-info\record
%TEMP%\_mei53762\attrs-23.1.0.dist-info\wheel
%TEMP%\_mei53762\base_library.zip
%TEMP%\_mei53762\certifi\cacert.pem
%TEMP%\_mei53762\crypto\cipher\_arc4.pyd
%TEMP%\_mei53762\crypto\cipher\_chacha20.pyd
%TEMP%\_mei53762\crypto\cipher\_pkcs1_decode.pyd
%TEMP%\_mei53762\crypto\cipher\_raw_aes.pyd
%TEMP%\_mei53762\crypto\cipher\_raw_aesni.pyd
%TEMP%\_mei53762\crypto\cipher\_raw_arc2.pyd
%TEMP%\_mei53762\crypto\cipher\_raw_blowfish.pyd
%TEMP%\_mei53762\crypto\cipher\_raw_cast.pyd
%TEMP%\_mei53762\crypto\cipher\_raw_cbc.pyd
%TEMP%\_mei53762\crypto\cipher\_raw_cfb.pyd
%TEMP%\_mei53762\crypto\cipher\_raw_ctr.pyd
%TEMP%\_mei53762\crypto\cipher\_raw_des.pyd
%TEMP%\_mei53762\crypto\cipher\_raw_des3.pyd
%TEMP%\_mei53762\crypto\cipher\_raw_ecb.pyd
%TEMP%\_mei53762\crypto\cipher\_raw_eksblowfish.pyd
%TEMP%\_mei53762\crypto\cipher\_raw_ocb.pyd
%TEMP%\_mei53762\crypto\cipher\_raw_ofb.pyd
%TEMP%\_mei53762\crypto\cipher\_salsa20.pyd
%TEMP%\_mei53762\crypto\hash\_blake2b.pyd
%TEMP%\_mei53762\crypto\hash\_blake2s.pyd
%TEMP%\_mei53762\crypto\hash\_ghash_clmul.pyd
%TEMP%\_mei53762\crypto\hash\_ghash_portable.pyd
%TEMP%\_mei53762\crypto\hash\_keccak.pyd
%TEMP%\_mei53762\crypto\hash\_md2.pyd
%TEMP%\_mei53762\crypto\hash\_md4.pyd
%TEMP%\_mei53762\crypto\hash\_md5.pyd
%TEMP%\_mei53762\crypto\hash\_poly1305.pyd
%TEMP%\_mei53762\crypto\hash\_ripemd160.pyd
%TEMP%\_mei53762\crypto\hash\_sha1.pyd
%TEMP%\_mei53762\crypto\hash\_sha224.pyd
%TEMP%\_mei53762\crypto\hash\_sha256.pyd
%TEMP%\_mei53762\crypto\hash\_sha384.pyd
%TEMP%\_mei53762\crypto\hash\_sha512.pyd
%TEMP%\_mei53762\crypto\math\_modexp.pyd
%TEMP%\_mei53762\crypto\protocol\_scrypt.pyd
%TEMP%\_mei53762\crypto\publickey\_ec_ws.pyd
%TEMP%\_mei53762\crypto\publickey\_ed25519.pyd
%TEMP%\_mei53762\crypto\publickey\_ed448.pyd
%TEMP%\_mei53762\crypto\publickey\_x25519.pyd
%TEMP%\_mei53762\crypto\util\_cpuid_c.pyd
%TEMP%\_mei53762\crypto\util\_strxor.pyd
%TEMP%\_mei53762\cryptography\hazmat\bindings\_rust.pyd
%TEMP%\_mei53762\cryptography-46.0.3.dist-info\installer
%TEMP%\_mei53762\cryptography-46.0.3.dist-info\licenses\license
%TEMP%\_mei53762\cryptography-46.0.3.dist-info\licenses\license.apache
%TEMP%\_mei53762\cryptography-46.0.3.dist-info\licenses\license.bsd
%TEMP%\_mei53762\cryptography-46.0.3.dist-info\metadata
%TEMP%\_mei53762\cryptography-46.0.3.dist-info\record
%TEMP%\_mei53762\cryptography-46.0.3.dist-info\wheel
%TEMP%\_mei53762\frozenlist\_frozenlist.cp310-win_amd64.pyd
%TEMP%\_mei53762\importlib_metadata-8.7.0.dist-info\installer
%TEMP%\_mei53762\importlib_metadata-8.7.0.dist-info\licenses\license
%TEMP%\_mei53762\importlib_metadata-8.7.0.dist-info\metadata
%TEMP%\_mei53762\importlib_metadata-8.7.0.dist-info\record
%TEMP%\_mei53762\importlib_metadata-8.7.0.dist-info\top_level.txt
%TEMP%\_mei53762\importlib_metadata-8.7.0.dist-info\wheel
%TEMP%\_mei53762\libcrypto-1_1.dll
%TEMP%\_mei53762\libffi-7.dll
%TEMP%\_mei53762\libssl-1_1.dll
%TEMP%\_mei53762\mfc140u.dll
%TEMP%\_mei53762\multidict\_multidict.cp310-win_amd64.pyd
%TEMP%\_mei53762\pil\_imaging.cp310-win_amd64.pyd
%TEMP%\_mei53762\pil\_imagingcms.cp310-win_amd64.pyd
%TEMP%\_mei53762\pil\_imagingft.cp310-win_amd64.pyd
%TEMP%\_mei53762\pil\_imagingtk.cp310-win_amd64.pyd
%TEMP%\_mei53762\pil\_webp.cp310-win_amd64.pyd
%TEMP%\_mei53762\propcache\_helpers_c.cp310-win_amd64.pyd
%TEMP%\_mei53762\psutil\_psutil_windows.pyd
%TEMP%\_mei53762\pyexpat.pyd
%TEMP%\_mei53762\pyinstaller-5.1.dist-info\direct_url.json
%TEMP%\_mei53762\pyinstaller-5.1.dist-info\entry_points.txt
%TEMP%\_mei53762\pyinstaller-5.1.dist-info\installer
%TEMP%\_mei53762\pyinstaller-5.1.dist-info\licenses\copying.txt
%TEMP%\_mei53762\pyinstaller-5.1.dist-info\metadata
%TEMP%\_mei53762\pyinstaller-5.1.dist-info\record
%TEMP%\_mei53762\pyinstaller-5.1.dist-info\top_level.txt
%TEMP%\_mei53762\pyinstaller-5.1.dist-info\wheel
%TEMP%\_mei53762\python3.dll
%TEMP%\_mei53762\python310.dll
%TEMP%\_mei53762\pythoncom310.dll
%TEMP%\_mei53762\pywintypes310.dll
%TEMP%\_mei53762\select.pyd
%TEMP%\_mei53762\setuptools-65.5.0.dist-info\entry_points.txt
%TEMP%\_mei53762\setuptools-65.5.0.dist-info\installer
%TEMP%\_mei53762\setuptools-65.5.0.dist-info\license
%TEMP%\_mei53762\setuptools-65.5.0.dist-info\metadata
%TEMP%\_mei53762\setuptools-65.5.0.dist-info\record
%TEMP%\_mei53762\setuptools-65.5.0.dist-info\top_level.txt
%TEMP%\_mei53762\setuptools-65.5.0.dist-info\wheel
%TEMP%\_mei53762\sqlite3.dll
%TEMP%\_mei53762\unicodedata.pyd
%TEMP%\_mei53762\vcruntime140.dll
%TEMP%\_mei53762\vcruntime140_1.dll
%TEMP%\_mei53762\win32api.pyd
%TEMP%\_mei53762\win32com\shell\shell.pyd
%TEMP%\_mei53762\win32crypt.pyd
%TEMP%\_mei53762\win32trace.pyd
%TEMP%\_mei53762\win32ui.pyd
%TEMP%\_mei53762\yarl\_quoting_c.cp310-win_amd64.pyd
%TEMP%\_mei53762\_asyncio.pyd
%TEMP%\_mei53762\_bz2.pyd
%TEMP%\_mei53762\_cffi_backend.cp310-win_amd64.pyd
%TEMP%\_mei53762\_ctypes.pyd
%TEMP%\_mei53762\_decimal.pyd
%TEMP%\_mei53762\_hashlib.pyd
%TEMP%\_mei53762\_lzma.pyd
%TEMP%\_mei53762\_multiprocessing.pyd
%TEMP%\_mei53762\_overlapped.pyd
%TEMP%\_mei53762\_queue.pyd
%TEMP%\_mei53762\_socket.pyd
%TEMP%\_mei53762\_sqlite3.pyd
%TEMP%\_mei53762\_ssl.pyd
%TEMP%\_mei53762\_uuid.pyd
%TEMP%\_mei53762\_win32sysloader.pyd

Сетевая активность

Подключается к

'ip##i.co':443
'di##ord.com':443
'ra#.####ubusercontent.com':443
'cl###flare.com':443

TCP

Другие

'ip##i.co':443
'di##ord.com':443
'ra#.####ubusercontent.com':443
'cl###flare.com':443

UDP

DNS ASK ip##i.co
DNS ASK di##ord.com
DNS ASK ra#.####ubusercontent.com
DNS ASK cl###flare.com

Другое

Создает и запускает на исполнение

'%TEMP%\services.exe'

Запускает на исполнение

'<SYSTEM32>\cmd.exe' /c "ver" (со скрытым окном)
'<SYSTEM32>\cmd.exe' /c "<SYSTEM32>\wbem\WMIC.exe csproduct get uuid" (со скрытым окном)
'<SYSTEM32>\wbem\wmic.exe' csproduct get uuid
'<SYSTEM32>\cmd.exe' /c "reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v kawauchi /f" (со скрытым окном)
'<SYSTEM32>\reg.exe' delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v kawauchi /f
'<SYSTEM32>\cmd.exe' /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v kawauchi /t REG_SZ /d %APPDATA%\kawauchi\run.bat /f" (со скрытым окном)
'<SYSTEM32>\reg.exe' add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v kawauchi /t REG_SZ /d %APPDATA%\kawauchi\run.bat /f

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней