Trojan.MulDrop13.17294

Technical Information

Modifies file system

Creates the following files

<Current directory>\hdxdoqqkxc.exe
<Current directory>\pxixyutzoo.exe
<Current directory>\znopzyepeo.exe
<Current directory>\mgvlkvryoc.exe
<Current directory>\zrzccclsqb.exe
<Current directory>\yknvheccke.exe
<Current directory>\fpgziavqyq.exe
<Current directory>\lvrdqewvnd.exe
<Current directory>\cftbmxoqea.exe
<Current directory>\vdfvriiuvd.exe
<Current directory>\ioalihknyc.exe
<Current directory>\voiiumpohq.exe
<Current directory>\ewvrnjamxq.exe
<Current directory>\lcgdwmcsmd.exe
<Current directory>\ustvxrnqud.exe
nul
<Current directory>\ynkunmwlpc.exe
<Current directory>\biqzaejzjp.exe
<Current directory>\waiwdtnkqn.exe

Deletes the following files

<Current directory>\hdxdoqqkxc.exe
<Current directory>\ynkunmwlpc.exe
<Current directory>\ustvxrnqud.exe
<Current directory>\ewvrnjamxq.exe
<Current directory>\lcgdwmcsmd.exe
<Current directory>\voiiumpohq.exe
<Current directory>\ioalihknyc.exe
<Current directory>\biqzaejzjp.exe
<Current directory>\vdfvriiuvd.exe
<Current directory>\lvrdqewvnd.exe
<Current directory>\fpgziavqyq.exe
<Current directory>\yknvheccke.exe
<Current directory>\zrzccclsqb.exe
<Current directory>\mgvlkvryoc.exe
<Current directory>\znopzyepeo.exe
<Current directory>\pxixyutzoo.exe

Deletes itself.

Miscellaneous

Creates and executes the following

'<Current directory>\hdxdoqqkxc.exe'
'<Current directory>\pxixyutzoo.exe'
'<Current directory>\znopzyepeo.exe'
'<Current directory>\mgvlkvryoc.exe'
'<Current directory>\zrzccclsqb.exe'
'<Current directory>\yknvheccke.exe'
'<Current directory>\fpgziavqyq.exe'
'<Current directory>\lvrdqewvnd.exe'
'<Current directory>\vdfvriiuvd.exe'
'<Current directory>\biqzaejzjp.exe'
'<Current directory>\ioalihknyc.exe'
'<Current directory>\voiiumpohq.exe'
'<Current directory>\ewvrnjamxq.exe'
'<Current directory>\lcgdwmcsmd.exe'
'<Current directory>\ustvxrnqud.exe'
'<Current directory>\ynkunmwlpc.exe'
'<Current directory>\cftbmxoqea.exe'
'<Current directory>\waiwdtnkqn.exe'

Executes the following

'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Full path to file>"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\WAIWDTNKQN.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\CFTBMXOQEA.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\PXIXYUTZOO.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\ZNOPZYEPEO.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\MGVLKVRYOC.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\ZRZCCCLSQB.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\YKNVHECCKE.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\FPGZIAVQYQ.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\LVRDQEWVND.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\VDFVRIIUVD.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\BIQZAEJZJP.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\IOALIHKNYC.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\VOIIUMPOHQ.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\EWVRNJAMXQ.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\LCGDWMCSMD.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\USTVXRNQUD.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\YNKUNMWLPC.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\HDXDOQQKXC.exe"
'<SYSTEM32>\ping.exe' 1.1.1.1 -n 1 -w 6000
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\TERYNQEHVP.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\JOMGMUTRNO.exe"