Trojan.MulDrop13.17240

Technical Information

Modifies file system

Creates the following files

<Current directory>\injfjfvmmt.exe
<Current directory>\gsebfocvoh.exe
<Current directory>\wvgdkmzpsr.exe
<Current directory>\dazisqavgv.exe
<Current directory>\qtgeenfeqs.exe
<Current directory>\dlnbqsrfzg.exe
<Current directory>\qlvyjpvoju.exe
<Current directory>\wrgkstwcxh.exe
<Current directory>\gspnqrychs.exe
<Current directory>\pauekwkbps.exe
<Current directory>\cacbvtwkyg.exe
<Current directory>\plgrmarvbf.exe
nul
<Current directory>\pwulschnvh.exe
<Current directory>\vbnpagbtju.exe
<Current directory>\chytjbcgxg.exe
<Current directory>\xcrkekrxyg.exe
<Current directory>\qwggegprku.exe

Deletes the following files

<Current directory>\injfjfvmmt.exe
<Current directory>\chytjbcgxg.exe
<Current directory>\vbnpagbtju.exe
<Current directory>\pwulschnvh.exe
<Current directory>\cacbvtwkyg.exe
<Current directory>\plgrmarvbf.exe
<Current directory>\pauekwkbps.exe
<Current directory>\gspnqrychs.exe
<Current directory>\wrgkstwcxh.exe
<Current directory>\qlvyjpvoju.exe
<Current directory>\dlnbqsrfzg.exe
<Current directory>\qtgeenfeqs.exe
<Current directory>\dazisqavgv.exe
<Current directory>\wvgdkmzpsr.exe

Deletes itself.

Miscellaneous

Creates and executes the following

'<Current directory>\injfjfvmmt.exe'
'<Current directory>\gsebfocvoh.exe'
'<Current directory>\wvgdkmzpsr.exe'
'<Current directory>\dazisqavgv.exe'
'<Current directory>\qtgeenfeqs.exe'
'<Current directory>\dlnbqsrfzg.exe'
'<Current directory>\qlvyjpvoju.exe'
'<Current directory>\xcrkekrxyg.exe'
'<Current directory>\wrgkstwcxh.exe'
'<Current directory>\pauekwkbps.exe'
'<Current directory>\cacbvtwkyg.exe'
'<Current directory>\plgrmarvbf.exe'
'<Current directory>\pwulschnvh.exe'
'<Current directory>\vbnpagbtju.exe'
'<Current directory>\chytjbcgxg.exe'
'<Current directory>\gspnqrychs.exe'
'<Current directory>\qwggegprku.exe'

Executes the following

'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Full path to file>"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\XCRKEKRXYG.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\GSEBFOCVOH.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\WVGDKMZPSR.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\DAZISQAVGV.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\QTGEENFEQS.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\DLNBQSRFZG.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\QLVYJPVOJU.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\WRGKSTWCXH.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\GSPNQRYCHS.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\PAUEKWKBPS.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\CACBVTWKYG.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\PLGRMARVBF.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\PWULSCHNVH.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\VBNPAGBTJU.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\CHYTJBCGXG.exe"
'<SYSTEM32>\ping.exe' 1.1.1.1 -n 1 -w 6000
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\INJFJFVMMT.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\QWGGEGPRKU.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\DEZJKJLIAG.exe"