Trojan.MulDrop13.17250

Technical Information

Modifies file system

Creates the following files

<Current directory>\cyesrvomrp.exe
<Current directory>\qyjyrcshwf.exe
<Current directory>\aooikglgmf.exe
<Current directory>\ngdeedqhwc.exe
<Current directory>\nzsybggzpe.exe
<Current directory>\nsgrhiwjip.exe
<Current directory>\akoosnbssd.exe
<Current directory>\ksqmigycib.exe
<Current directory>\jabgljujad.exe
<Current directory>\mggyhomwoe.exe
<Current directory>\pjxxxrurbd.exe
<Current directory>\teovvuvmwb.exe
<Current directory>\cubnoypkec.exe
nul
<Current directory>\mvdqmxrsnf.exe
<Current directory>\givmytkias.exe
<Current directory>\akkdhcfdas.exe

Deletes the following files

<Current directory>\cyesrvomrp.exe
<Current directory>\mvdqmxrsnf.exe
<Current directory>\cubnoypkec.exe
<Current directory>\teovvuvmwb.exe
<Current directory>\pjxxxrurbd.exe
<Current directory>\mggyhomwoe.exe
<Current directory>\givmytkias.exe
<Current directory>\jabgljujad.exe
<Current directory>\akoosnbssd.exe
<Current directory>\nsgrhiwjip.exe
<Current directory>\nzsybggzpe.exe
<Current directory>\ngdeedqhwc.exe
<Current directory>\aooikglgmf.exe
<Current directory>\qyjyrcshwf.exe
<Current directory>\ksqmigycib.exe
<Current directory>\akkdhcfdas.exe

Deletes itself.

Miscellaneous

Creates and executes the following

'<Current directory>\cyesrvomrp.exe'
'<Current directory>\mvdqmxrsnf.exe'
'<Current directory>\cubnoypkec.exe'
'<Current directory>\teovvuvmwb.exe'
'<Current directory>\pjxxxrurbd.exe'
'<Current directory>\mggyhomwoe.exe'
'<Current directory>\givmytkias.exe'
'<Current directory>\jabgljujad.exe'
'<Current directory>\akoosnbssd.exe'
'<Current directory>\nsgrhiwjip.exe'
'<Current directory>\nzsybggzpe.exe'
'<Current directory>\ngdeedqhwc.exe'
'<Current directory>\aooikglgmf.exe'
'<Current directory>\qyjyrcshwf.exe'
'<Current directory>\ksqmigycib.exe'
'<Current directory>\akkdhcfdas.exe'

Executes the following

'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Full path to file>"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\HMKUNBZOCS.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\AKKDHCFDAS.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\KSQMIGYCIB.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\QYJYRCSHWF.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\AOOIKGLGMF.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\NGDEEDQHWC.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\NZSYBGGZPE.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\NSGRHIWJIP.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\HUWAQZREAP.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\AKOOSNBSSD.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\GIVMYTKIAS.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\MGGYHOMWOE.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\PJXXXRURBD.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\TEOVVUVMWB.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\CUBNOYPKEC.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\MVDQMXRSNF.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\CYESRVOMRP.exe"
'<SYSTEM32>\ping.exe' 1.1.1.1 -n 1 -w 6000
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\JABGLJUJAD.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\EYFCSWIBNR.exe"