Trojan.MulDrop13.17224

Technical Information

Modifies file system

Creates the following files

<Current directory>\nrvzwvtdrp.exe
<Current directory>\uxrgjddnno.exe
<Current directory>\enxykzwldo.exe
<Current directory>\ksqcsdqrrb.exe
<Current directory>\xlxzeacabp.exe
<Current directory>\hbkqfenyjp.exe
<Current directory>\nyvuoipeyc.exe
<Current directory>\xoimhebcoc.exe
<Current directory>\orycizjhyc.exe
<Current directory>\ajrkxhjxib.exe
<Current directory>\acoecjahcl.exe
<Current directory>\nvvbooeqla.exe
<Current directory>\dxedsmbkpc.exe
<Current directory>\agrrfozkoy.exe
<Current directory>\nggortllyn.exe
nul
<Current directory>\aynkcqpuib.exe
<Current directory>\kzecyldnrb.exe
<Current directory>\oovpxvcfmp.exe

Deletes the following files

<Current directory>\nrvzwvtdrp.exe
<Current directory>\aynkcqpuib.exe
<Current directory>\nggortllyn.exe
<Current directory>\dxedsmbkpc.exe
<Current directory>\agrrfozkoy.exe
<Current directory>\nvvbooeqla.exe
<Current directory>\acoecjahcl.exe
<Current directory>\kzecyldnrb.exe
<Current directory>\ajrkxhjxib.exe
<Current directory>\xoimhebcoc.exe
<Current directory>\nyvuoipeyc.exe
<Current directory>\hbkqfenyjp.exe
<Current directory>\xlxzeacabp.exe
<Current directory>\ksqcsdqrrb.exe
<Current directory>\enxykzwldo.exe
<Current directory>\uxrgjddnno.exe

Deletes itself.

Miscellaneous

Creates and executes the following

'<Current directory>\nrvzwvtdrp.exe'
'<Current directory>\uxrgjddnno.exe'
'<Current directory>\enxykzwldo.exe'
'<Current directory>\ksqcsdqrrb.exe'
'<Current directory>\xlxzeacabp.exe'
'<Current directory>\hbkqfenyjp.exe'
'<Current directory>\nyvuoipeyc.exe'
'<Current directory>\xoimhebcoc.exe'
'<Current directory>\ajrkxhjxib.exe'
'<Current directory>\kzecyldnrb.exe'
'<Current directory>\acoecjahcl.exe'
'<Current directory>\nvvbooeqla.exe'
'<Current directory>\dxedsmbkpc.exe'
'<Current directory>\agrrfozkoy.exe'
'<Current directory>\nggortllyn.exe'
'<Current directory>\aynkcqpuib.exe'
'<Current directory>\orycizjhyc.exe'
'<Current directory>\oovpxvcfmp.exe'

Executes the following

'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Full path to file>"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\OOVPXVCFMP.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\ORYCIZJHYC.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\UXRGJDDNNO.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\ENXYKZWLDO.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\KSQCSDQRRB.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\XLXZEACABP.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\HBKQFENYJP.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\NYVUOIPEYC.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\XOIMHEBCOC.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\AJRKXHJXIB.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\KZECYLDNRB.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\ACOECJAHCL.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\NVVBOOEQLA.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\DXEDSMBKPC.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\AGRRFOZKOY.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\NGGORTLLYN.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\AYNKCQPUIB.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\NRVZWVTDRP.exe"
'<SYSTEM32>\ping.exe' 1.1.1.1 -n 1 -w 6000
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\BNOSMYYDCA.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\RGBBSTEFUA.exe"