Trojan.MulDrop13.17286

Technical Information

Modifies file system

Creates the following files

<Current directory>\rcmvixqvuy.exe
<Current directory>\skbfoahoqi.exe
<Current directory>\zpujxdjceu.exe
<Current directory>\mqbfjandoi.exe
<Current directory>\yiicugzmxx.exe
<Current directory>\laqzoddvht.exe
<Current directory>\cdzbsiahkv.exe
<Current directory>\pehyefmquj.exe
<Current directory>\cwouqlqzdg.exe
<Current directory>\oovrbicbnu.exe
<Current directory>\frftgnzuyw.exe
<Current directory>\meqsgeojbv.exe
<Current directory>\ohslhkltgw.exe
<Current directory>\lpmzuljsgt.exe
<Current directory>\vxrinqcjot.exe
<Current directory>\labkrnzczw.exe
<Current directory>\uqocsslbhw.exe
<Current directory>\ltqexqpntg.exe
<Current directory>\ylfbivuwcu.exe
<Current directory>\boozyqdrxt.exe
nul
<Current directory>\ohdwkvhahh.exe
<Current directory>\bzktestjqv.exe
<Current directory>\ypxcaoejwx.exe
<Current directory>\cwdjnauklv.exe

Deletes the following files

<Current directory>\rcmvixqvuy.exe
<Current directory>\skbfoahoqi.exe
<Current directory>\zpujxdjceu.exe
<Current directory>\mqbfjandoi.exe
<Current directory>\yiicugzmxx.exe
<Current directory>\laqzoddvht.exe
<Current directory>\cdzbsiahkv.exe
<Current directory>\pehyefmquj.exe
<Current directory>\cwouqlqzdg.exe
<Current directory>\oovrbicbnu.exe
<Current directory>\frftgnzuyw.exe
<Current directory>\ohslhkltgw.exe
<Current directory>\ypxcaoejwx.exe
<Current directory>\lpmzuljsgt.exe
<Current directory>\vxrinqcjot.exe
<Current directory>\labkrnzczw.exe
<Current directory>\uqocsslbhw.exe
<Current directory>\ltqexqpntg.exe
<Current directory>\ylfbivuwcu.exe
<Current directory>\boozyqdrxt.exe
<Current directory>\ohdwkvhahh.exe
<Current directory>\bzktestjqv.exe
<Current directory>\cwdjnauklv.exe
<Current directory>\meqsgeojbv.exe

Deletes itself.

Miscellaneous

Creates and executes the following

'<Current directory>\rcmvixqvuy.exe'
'<Current directory>\skbfoahoqi.exe'
'<Current directory>\zpujxdjceu.exe'
'<Current directory>\mqbfjandoi.exe'
'<Current directory>\yiicugzmxx.exe'
'<Current directory>\laqzoddvht.exe'
'<Current directory>\cdzbsiahkv.exe'
'<Current directory>\pehyefmquj.exe'
'<Current directory>\cwouqlqzdg.exe'
'<Current directory>\oovrbicbnu.exe'
'<Current directory>\frftgnzuyw.exe'
'<Current directory>\ohslhkltgw.exe'
'<Current directory>\ypxcaoejwx.exe'
'<Current directory>\lpmzuljsgt.exe'
'<Current directory>\vxrinqcjot.exe'
'<Current directory>\labkrnzczw.exe'
'<Current directory>\uqocsslbhw.exe'
'<Current directory>\ltqexqpntg.exe'
'<Current directory>\ylfbivuwcu.exe'
'<Current directory>\boozyqdrxt.exe'
'<Current directory>\ohdwkvhahh.exe'
'<Current directory>\bzktestjqv.exe'
'<Current directory>\meqsgeojbv.exe'
'<Current directory>\cwdjnauklv.exe'

Executes the following

'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Full path to file>"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\PSKZQYJHPU.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\WYDDZULNDG.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\GOIVAYELTG.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\CWDJNAUKLV.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\MEQSGEOJBV.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\SKBFOAHOQI.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\ZPUJXDJCEU.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\MQBFJANDOI.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\YIICUGZMXX.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\LAQZODDVHT.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\CDZBSIAHKV.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\PEHYEFMQUJ.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\CWOUQLQZDG.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\GKFIXUXJHT.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\OOVRBICBNU.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\OHSLHKLTGW.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\YPXCAOEJWX.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\LPMZULJSGT.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\VXRINQCJOT.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\LABKRNZCZW.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\UQOCSSLBHW.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\LTQEXQPNTG.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\YLFBIVUWCU.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\BOOZYQDRXT.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\OHDWKVHAHH.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\BZKTESTJQV.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\RCMVIXQVUY.exe"
'<SYSTEM32>\ping.exe' 1.1.1.1 -n 1 -w 6000
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\FRFTGNZUYW.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\WUSYWQMSRT.exe"