Trojan.MulDrop13.17269

Technical Information

Modifies file system

Creates the following files

<Current directory>\rfbjecvmju.exe
<Current directory>\iprvpkkaih.exe
<Current directory>\pvkzyolfxt.exe
<Current directory>\ylqqrsxent.exe
<Current directory>\ldfnkpjnxi.exe
<Current directory>\yemkwunogw.exe
<Current directory>\imzbxrhmow.exe
<Current directory>\scelqvtdex.exe
<Current directory>\yhxxzruqtj.exe
<Current directory>\ysmqetkbmu.exe
<Current directory>\exxvfxeobg.exe
<Current directory>\ryerzcipku.exe
<Current directory>\equokzuyuj.exe
<Current directory>\kwfstcneiv.exe
<Current directory>\rbqebgpsxh.exe
<Current directory>\hezggelmak.exe
<Current directory>\xhbikcqxlu.exe
<Current directory>\kzifwhugvi.exe
nul
<Current directory>\acrhaerays.exe
<Current directory>\ifdbkibqpw.exe
<Current directory>\sctznkxweu.exe

Deletes the following files

<Current directory>\acrhaerays.exe
<Current directory>\ylqqrsxent.exe
<Current directory>\pvkzyolfxt.exe
<Current directory>\ldfnkpjnxi.exe
<Current directory>\imzbxrhmow.exe
<Current directory>\yemkwunogw.exe
<Current directory>\scelqvtdex.exe
<Current directory>\yhxxzruqtj.exe
<Current directory>\ysmqetkbmu.exe
<Current directory>\exxvfxeobg.exe
<Current directory>\equokzuyuj.exe
<Current directory>\ryerzcipku.exe
<Current directory>\kwfstcneiv.exe
<Current directory>\rbqebgpsxh.exe
<Current directory>\hezggelmak.exe
<Current directory>\xhbikcqxlu.exe
<Current directory>\kzifwhugvi.exe
<Current directory>\rfbjecvmju.exe
<Current directory>\iprvpkkaih.exe
<Current directory>\ifdbkibqpw.exe

Deletes itself.

Miscellaneous

Creates and executes the following

'<Current directory>\rfbjecvmju.exe'
'<Current directory>\iprvpkkaih.exe'
'<Current directory>\pvkzyolfxt.exe'
'<Current directory>\ylqqrsxent.exe'
'<Current directory>\ldfnkpjnxi.exe'
'<Current directory>\yemkwunogw.exe'
'<Current directory>\imzbxrhmow.exe'
'<Current directory>\scelqvtdex.exe'
'<Current directory>\yhxxzruqtj.exe'
'<Current directory>\ifdbkibqpw.exe'
'<Current directory>\ysmqetkbmu.exe'
'<Current directory>\ryerzcipku.exe'
'<Current directory>\equokzuyuj.exe'
'<Current directory>\kwfstcneiv.exe'
'<Current directory>\rbqebgpsxh.exe'
'<Current directory>\hezggelmak.exe'
'<Current directory>\xhbikcqxlu.exe'
'<Current directory>\kzifwhugvi.exe'
'<Current directory>\acrhaerays.exe'
'<Current directory>\exxvfxeobg.exe'
'<Current directory>\sctznkxweu.exe'

Executes the following

'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Full path to file>"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\IFDBKIBQPW.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\IPRVPKKAIH.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\PVKZYOLFXT.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\YLQQRSXENT.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\LDFNKPJNXI.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\YEMKWUNOGW.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\IMZBXRHMOW.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\SCELQVTDEX.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\YHXXZRUQTJ.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\YSMQETKBMU.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\EXXVFXEOBG.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\RYERZCIPKU.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\EQUOKZUYUJ.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\KWFSTCNEIV.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\RBQEBGPSXH.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\HEZGGELMAK.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\XHBIKCQXLU.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\KZIFWHUGVI.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\ACRHAERAYS.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\RFBJECVMJU.exe"
'<SYSTEM32>\ping.exe' 1.1.1.1 -n 1 -w 6000
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\SCTZNKXWEU.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\FBMDUFTNUG.exe"