Trojan.MulDrop13.17248

Technical Information

Modifies file system

Creates the following files

<Current directory>\ltsxlgbjtj.exe
<Current directory>\njhzsrbdpt.exe
<Current directory>\dmrbwoypsv.exe
<Current directory>\nuesxtjniw.exe
<Current directory>\qpnrnosidu.exe
<Current directory>\zfajosmglu.exe
<Current directory>\gllnpwfmzh.exe
<Current directory>\tdakitjvjv.exe
<Current directory>\ctfbcxdlzv.exe
<Current directory>\plnyvuhvik.exe
<Current directory>\ajacglpufx.exe
<Current directory>\zbahoybtrk.exe
<Current directory>\szaqjzhipt.exe
<Current directory>\cpfzkesyft.exe
<Current directory>\pivwvbehoh.exe
<Current directory>\cicthgjqyw.exe
<Current directory>\pajqbdnrik.exe
<Current directory>\ctqmnizarg.exe
<Current directory>\plyjyfdkbu.exe
nul
<Current directory>\vrjnhjfpph.exe
<Current directory>\jrnzqvnjhk.exe
<Current directory>\qbnlfpdvpw.exe

Deletes the following files

<Current directory>\ltsxlgbjtj.exe
<Current directory>\ajacglpufx.exe
<Current directory>\njhzsrbdpt.exe
<Current directory>\qpnrnosidu.exe
<Current directory>\nuesxtjniw.exe
<Current directory>\zfajosmglu.exe
<Current directory>\gllnpwfmzh.exe
<Current directory>\tdakitjvjv.exe
<Current directory>\ctfbcxdlzv.exe
<Current directory>\plnyvuhvik.exe
<Current directory>\zbahoybtrk.exe
<Current directory>\jrnzqvnjhk.exe
<Current directory>\cpfzkesyft.exe
<Current directory>\szaqjzhipt.exe
<Current directory>\cicthgjqyw.exe
<Current directory>\pivwvbehoh.exe
<Current directory>\plyjyfdkbu.exe
<Current directory>\pajqbdnrik.exe
<Current directory>\ctqmnizarg.exe
<Current directory>\vrjnhjfpph.exe
<Current directory>\qbnlfpdvpw.exe
<Current directory>\dmrbwoypsv.exe

Deletes itself.

Miscellaneous

Creates and executes the following

'<Current directory>\ltsxlgbjtj.exe'
'<Current directory>\njhzsrbdpt.exe'
'<Current directory>\dmrbwoypsv.exe'
'<Current directory>\nuesxtjniw.exe'
'<Current directory>\qpnrnosidu.exe'
'<Current directory>\zfajosmglu.exe'
'<Current directory>\gllnpwfmzh.exe'
'<Current directory>\tdakitjvjv.exe'
'<Current directory>\ctfbcxdlzv.exe'
'<Current directory>\plnyvuhvik.exe'
'<Current directory>\zbahoybtrk.exe'
'<Current directory>\jrnzqvnjhk.exe'
'<Current directory>\szaqjzhipt.exe'
'<Current directory>\cpfzkesyft.exe'
'<Current directory>\pivwvbehoh.exe'
'<Current directory>\cicthgjqyw.exe'
'<Current directory>\pajqbdnrik.exe'
'<Current directory>\ctqmnizarg.exe'
'<Current directory>\plyjyfdkbu.exe'
'<Current directory>\vrjnhjfpph.exe'
'<Current directory>\ajacglpufx.exe'
'<Current directory>\qbnlfpdvpw.exe'

Executes the following

'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Full path to file>"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\KDNNZJLFHI.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\QIYRHNNLWU.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\QBNLFPDVPW.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\AJACGLPUFX.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\NJHZSRBDPT.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\DMRBWOYPSV.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\NUESXTJNIW.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\QPNRNOSIDU.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\ZFAJOSMGLU.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\GLLNPWFMZH.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\TDAKITJVJV.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\CTFBCXDLZV.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\PLNYVUHVIK.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\ZBAHOYBTRK.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\JRNZQVNJHK.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\SZAQJZHIPT.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\CPFZKESYFT.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\PIVWVBEHOH.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\CICTHGJQYW.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\PAJQBDNRIK.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\CTQMNIZARG.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\PLYJYFDKBU.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\VRJNHJFPPH.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\LTSXLGBJTJ.exe"
'<SYSTEM32>\ping.exe' 1.1.1.1 -n 1 -w 6000
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\HHWOJGKDUJ.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\ACLKADJXGX.exe"