Trojan.MulDrop13.17325

Technical Information

Modifies file system

Creates the following files

<Current directory>\djqszdzbcu.exe
<Current directory>\iczzygrfsk.exe
<Current directory>\yeijdmozdu.exe
<Current directory>\lxqfojsanj.exe
<Current directory>\vndppnmyvj.exe
<Current directory>\ifkmbkqhfx.exe
<Current directory>\yiuofqvtqh.exe
<Current directory>\iyhfhnhsyi.exe
<Current directory>\uqocsslbhw.exe
<Current directory>\vjsknjfwiw.exe
<Current directory>\hjvzepxcrk.exe
<Current directory>\erqnrqvbrh.exe
<Current directory>\rrxjcvzkav.exe
<Current directory>\umoisyifvu.exe
<Current directory>\bszmbubtkg.exe
<Current directory>\enqlrxkoxw.exe
nul
<Current directory>\ktbxaalclj.exe
<Current directory>\qymbiefhzv.exe
<Current directory>\ryiqftjahl.exe
<Current directory>\ijkntebvzi.exe

Deletes the following files

<Current directory>\djqszdzbcu.exe
<Current directory>\yeijdmozdu.exe
<Current directory>\lxqfojsanj.exe
<Current directory>\vndppnmyvj.exe
<Current directory>\ifkmbkqhfx.exe
<Current directory>\yiuofqvtqh.exe
<Current directory>\iyhfhnhsyi.exe
<Current directory>\uqocsslbhw.exe
<Current directory>\iczzygrfsk.exe
<Current directory>\hjvzepxcrk.exe
<Current directory>\erqnrqvbrh.exe
<Current directory>\rrxjcvzkav.exe
<Current directory>\umoisyifvu.exe
<Current directory>\bszmbubtkg.exe
<Current directory>\enqlrxkoxw.exe
<Current directory>\ktbxaalclj.exe
<Current directory>\qymbiefhzv.exe
<Current directory>\ryiqftjahl.exe
<Current directory>\vjsknjfwiw.exe

Deletes itself.

Miscellaneous

Creates and executes the following

'<Current directory>\djqszdzbcu.exe'
'<Current directory>\iczzygrfsk.exe'
'<Current directory>\yeijdmozdu.exe'
'<Current directory>\lxqfojsanj.exe'
'<Current directory>\vndppnmyvj.exe'
'<Current directory>\ifkmbkqhfx.exe'
'<Current directory>\yiuofqvtqh.exe'
'<Current directory>\iyhfhnhsyi.exe'
'<Current directory>\uqocsslbhw.exe'
'<Current directory>\hjvzepxcrk.exe'
'<Current directory>\ryiqftjahl.exe'
'<Current directory>\erqnrqvbrh.exe'
'<Current directory>\rrxjcvzkav.exe'
'<Current directory>\umoisyifvu.exe'
'<Current directory>\bszmbubtkg.exe'
'<Current directory>\enqlrxkoxw.exe'
'<Current directory>\ktbxaalclj.exe'
'<Current directory>\qymbiefhzv.exe'
'<Current directory>\vjsknjfwiw.exe'
'<Current directory>\ijkntebvzi.exe'

Executes the following

'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Full path to file>"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\VJSKNJFWIW.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\ICZZYGRFSK.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\YEIJDMOZDU.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\LXQFOJSANJ.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\VNDPPNMYVJ.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\IFKMBKQHFX.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\YIUOFQVTQH.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\IYHFHNHSYI.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\UQOCSSLBHW.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\IJKNTEBVZI.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\HJVZEPXCRK.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\ERQNRQVBRH.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\RRXJCVZKAV.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\UMOISYIFVU.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\BSZMBUBTKG.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\ENQLRXKOXW.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\KTBXAALCLJ.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\QYMBIEFHZV.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\DJQSZDZBCU.exe"
'<SYSTEM32>\ping.exe' 1.1.1.1 -n 1 -w 6000
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\RYIQFTJAHL.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\YBXWAIPWRH.exe"