Trojan.MulDrop13.17303

Technical Information

Modifies file system

Creates the following files

<Current directory>\ekbvyxmbgc.exe
<Current directory>\inhdvknppd.exe
<Current directory>\osshdgoddp.exe
<Current directory>\vyclmkhjzc.exe
<Current directory>\iqkiypusjq.exe
<Current directory>\owdugknfyc.exe
<Current directory>\bwkrspzghz.exe
<Current directory>\lexbtmlfpz.exe
<Current directory>\uucsmqfvfz.exe
<Current directory>\lxmurobpjc.exe
<Current directory>\yptrktfysq.exe
<Current directory>\lqaowqszcm.exe
<Current directory>\bskqawotno.exe
<Current directory>\kaxhtsarvp.exe
<Current directory>\bdzjyyfdgz.exe
<Current directory>\oeggrvjmqn.exe
<Current directory>\egpiotfgtp.exe
nul
<Current directory>\erebtvwqma.exe
<Current directory>\rjtyfaizwo.exe
<Current directory>\ickkyiefva.exe
<Current directory>\fztlafwkic.exe

Deletes the following files

<Current directory>\ekbvyxmbgc.exe
<Current directory>\inhdvknppd.exe
<Current directory>\osshdgoddp.exe
<Current directory>\vyclmkhjzc.exe
<Current directory>\iqkiypusjq.exe
<Current directory>\owdugknfyc.exe
<Current directory>\bwkrspzghz.exe
<Current directory>\lexbtmlfpz.exe
<Current directory>\uucsmqfvfz.exe
<Current directory>\ickkyiefva.exe
<Current directory>\lxmurobpjc.exe
<Current directory>\lqaowqszcm.exe
<Current directory>\kaxhtsarvp.exe
<Current directory>\bskqawotno.exe
<Current directory>\bdzjyyfdgz.exe
<Current directory>\oeggrvjmqn.exe
<Current directory>\egpiotfgtp.exe
<Current directory>\erebtvwqma.exe
<Current directory>\rjtyfaizwo.exe
<Current directory>\yptrktfysq.exe
<Current directory>\fztlafwkic.exe

Deletes itself.

Miscellaneous

Creates and executes the following

'<Current directory>\ekbvyxmbgc.exe'
'<Current directory>\inhdvknppd.exe'
'<Current directory>\osshdgoddp.exe'
'<Current directory>\vyclmkhjzc.exe'
'<Current directory>\iqkiypusjq.exe'
'<Current directory>\owdugknfyc.exe'
'<Current directory>\bwkrspzghz.exe'
'<Current directory>\lexbtmlfpz.exe'
'<Current directory>\uucsmqfvfz.exe'
'<Current directory>\ickkyiefva.exe'
'<Current directory>\lxmurobpjc.exe'
'<Current directory>\lqaowqszcm.exe'
'<Current directory>\bskqawotno.exe'
'<Current directory>\kaxhtsarvp.exe'
'<Current directory>\bdzjyyfdgz.exe'
'<Current directory>\oeggrvjmqn.exe'
'<Current directory>\egpiotfgtp.exe'
'<Current directory>\erebtvwqma.exe'
'<Current directory>\rjtyfaizwo.exe'
'<Current directory>\yptrktfysq.exe'
'<Current directory>\fztlafwkic.exe'

Executes the following

'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Full path to file>"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\CEKMKCNHOL.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\FZTLAFWKIC.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\ICKKYIEFVA.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\INHDVKNPPD.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\OSSHDGODDP.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\VYCLMKHJZC.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\IQKIYPUSJQ.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\OWDUGKNFYC.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\BWKRSPZGHZ.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\LEXBTMLFPZ.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\UUCSMQFVFZ.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\LXMUROBPJC.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\YPTRKTFYSQ.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\LQAOWQSZCM.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\BSKQAWOTNO.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\KAXHTSARVP.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\BDZJYYFDGZ.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\OEGGRVJMQN.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\EGPIOTFGTP.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\EREBTVWQMA.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\RJTYFAIZWO.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\EKBVYXMBGC.exe"
'<SYSTEM32>\ping.exe' 1.1.1.1 -n 1 -w 6000
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\CLOTMAWXUB.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\ZQXUOXVCHC.exe"