Trojan.MulDrop13.17232

Technical Information

Modifies file system

Creates the following files

<Current directory>\buosbiujsl.exe
<Current directory>\qkwfwnhufh.exe
<Current directory>\zabwprbsnh.exe
<Current directory>\jiogqnnjdh.exe
<Current directory>\wivccszsmw.exe
<Current directory>\cogpkwsybi.exe
<Current directory>\pgwdwtehlw.exe
<Current directory>\wlhpexymzj.exe
<Current directory>\zhyouagpuh.exe
<Current directory>\zhmdrplauw.exe
<Current directory>\jxdgvwsgci.exe
<Current directory>\cvdgqxyuai.exe
<Current directory>\ydxvdywcax.exe
<Current directory>\lvfrodidjl.exe
<Current directory>\sbqwxhbryx.exe
<Current directory>\ygjafdcwmk.exe
nul
<Current directory>\bkrgvfdzzi.exe
<Current directory>\ochvhkpajx.exe
<Current directory>\sfqppamesi.exe
<Current directory>\npfgykgzki.exe

Deletes the following files

<Current directory>\buosbiujsl.exe
<Current directory>\zabwprbsnh.exe
<Current directory>\jiogqnnjdh.exe
<Current directory>\cogpkwsybi.exe
<Current directory>\wivccszsmw.exe
<Current directory>\pgwdwtehlw.exe
<Current directory>\wlhpexymzj.exe
<Current directory>\zhyouagpuh.exe
<Current directory>\qkwfwnhufh.exe
<Current directory>\jxdgvwsgci.exe
<Current directory>\cvdgqxyuai.exe
<Current directory>\ydxvdywcax.exe
<Current directory>\lvfrodidjl.exe
<Current directory>\sbqwxhbryx.exe
<Current directory>\ygjafdcwmk.exe
<Current directory>\bkrgvfdzzi.exe
<Current directory>\ochvhkpajx.exe
<Current directory>\sfqppamesi.exe
<Current directory>\npfgykgzki.exe

Deletes itself.

Miscellaneous

Creates and executes the following

'<Current directory>\buosbiujsl.exe'
'<Current directory>\qkwfwnhufh.exe'
'<Current directory>\zabwprbsnh.exe'
'<Current directory>\jiogqnnjdh.exe'
'<Current directory>\wivccszsmw.exe'
'<Current directory>\cogpkwsybi.exe'
'<Current directory>\pgwdwtehlw.exe'
'<Current directory>\wlhpexymzj.exe'
'<Current directory>\zhyouagpuh.exe'
'<Current directory>\jxdgvwsgci.exe'
'<Current directory>\sfqppamesi.exe'
'<Current directory>\cvdgqxyuai.exe'
'<Current directory>\ydxvdywcax.exe'
'<Current directory>\lvfrodidjl.exe'
'<Current directory>\sbqwxhbryx.exe'
'<Current directory>\ygjafdcwmk.exe'
'<Current directory>\bkrgvfdzzi.exe'
'<Current directory>\ochvhkpajx.exe'
'<Current directory>\zhmdrplauw.exe'
'<Current directory>\npfgykgzki.exe'

Executes the following

'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Full path to file>"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\XXHEODWIIY.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\QVZFQECXGH.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\KBAOKNHMEH.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\QGLSTIISSU.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\DZSPENNBCI.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\NPFGYKGZKI.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\ZHMDRPLAUW.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\QKWFWNHUFH.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\ZABWPRBSNH.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\JIOGQNNJDH.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\WIVCCSZSMW.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\COGPKWSYBI.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\UCQFYAVGNH.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\PGWDWTEHLW.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\ZHYOUAGPUH.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\JXDGVWSGCI.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\SFQPPAMESI.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\CVDGQXYUAI.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\YDXVDYWCAX.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\LVFRODIDJL.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\SBQWXHBRYX.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\YGJAFDCWMK.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\BKRGVFDZZI.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\OCHVHKPAJX.exe"
'<SYSTEM32>\ping.exe' 1.1.1.1 -n 1 -w 6000
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\BUOSBIUJSL.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\WLHPEXYMZJ.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\HJJIMDJEDL.exe"