Trojan.MulDrop13.17327

Technical Information

Modifies file system

Creates the following files

<Current directory>\naywrmggwk.exe
<Current directory>\vdjrjqrvfw.exe
<Current directory>\objrdrwklw.exe
<Current directory>\vhuemuqyaj.exe
<Current directory>\izcayrczjf.exe
<Current directory>\rppkzwoxrf.exe
<Current directory>\riedwyehli.exe
<Current directory>\bqrvxuqgbi.exe
<Current directory>\oiyrjzchkw.exe
<Current directory>\xylbkwofsf.exe
<Current directory>\kqsywbaoct.exe
<Current directory>\rwdkeeturf.exe
<Current directory>\amrtfbnshg.exe
<Current directory>\neyqrgruqu.exe
<Current directory>\ukrcabshfg.exe
<Current directory>\apcgifmntt.exe
nul
<Current directory>\kfpybjflbt.exe
<Current directory>\idcuxlfmwh.exe
<Current directory>\yvpcwotwoh.exe

Deletes the following files

<Current directory>\naywrmggwk.exe
<Current directory>\vdjrjqrvfw.exe
<Current directory>\vhuemuqyaj.exe
<Current directory>\objrdrwklw.exe
<Current directory>\izcayrczjf.exe
<Current directory>\rppkzwoxrf.exe
<Current directory>\riedwyehli.exe
<Current directory>\bqrvxuqgbi.exe
<Current directory>\idcuxlfmwh.exe
<Current directory>\oiyrjzchkw.exe
<Current directory>\kqsywbaoct.exe
<Current directory>\amrtfbnshg.exe
<Current directory>\rwdkeeturf.exe
<Current directory>\neyqrgruqu.exe
<Current directory>\apcgifmntt.exe
<Current directory>\ukrcabshfg.exe
<Current directory>\kfpybjflbt.exe
<Current directory>\xylbkwofsf.exe
<Current directory>\yvpcwotwoh.exe

Deletes itself.

Miscellaneous

Creates and executes the following

'<Current directory>\naywrmggwk.exe'
'<Current directory>\vdjrjqrvfw.exe'
'<Current directory>\objrdrwklw.exe'
'<Current directory>\vhuemuqyaj.exe'
'<Current directory>\izcayrczjf.exe'
'<Current directory>\rppkzwoxrf.exe'
'<Current directory>\riedwyehli.exe'
'<Current directory>\bqrvxuqgbi.exe'
'<Current directory>\idcuxlfmwh.exe'
'<Current directory>\oiyrjzchkw.exe'
'<Current directory>\kqsywbaoct.exe'
'<Current directory>\rwdkeeturf.exe'
'<Current directory>\amrtfbnshg.exe'
'<Current directory>\neyqrgruqu.exe'
'<Current directory>\ukrcabshfg.exe'
'<Current directory>\apcgifmntt.exe'
'<Current directory>\kfpybjflbt.exe'
'<Current directory>\xylbkwofsf.exe'
'<Current directory>\yvpcwotwoh.exe'

Executes the following

'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Full path to file>"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\IDCUXLFMWH.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\VDJRJQRVFW.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\OBJRDRWKLW.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\VHUEMUQYAJ.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\IZCAYRCZJF.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\RPPKZWOXRF.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\RIEDWYEHLI.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\BQRVXUQGBI.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\OIYRJZCHKW.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\XYLBKWOFSF.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\KQSYWBAOCT.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\RWDKEETURF.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\AMRTFBNSHG.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\NEYQRGRUQU.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\UKRCABSHFG.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\APCGIFMNTT.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\KFPYBJFLBT.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\NAYWRMGGWK.exe"
'<SYSTEM32>\ping.exe' 1.1.1.1 -n 1 -w 6000
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\YVPCWOTWOH.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\PFKTDKZYXH.exe"