Trojan.MulDrop13.17287

Technical Information

Modifies file system

Creates the following files

<Current directory>\xbeenxmsfd.exe
<Current directory>\rvtaeulnqq.exe
<Current directory>\rcxgzsdvxo.exe
nul
<Current directory>\yffxfrxgzn.exe
<Current directory>\ltbpokunwo.exe
<Current directory>\foqdfobhhc.exe
<Current directory>\svigtjxyyo.exe
<Current directory>\fvbjimlxoz.exe
<Current directory>\vnoahhzyyz.exe
<Current directory>\lxbjolfiqz.exe
<Current directory>\ijvqsgovcq.exe
<Current directory>\foercdfapz.exe
<Current directory>\zjufuammbn.exe
<Current directory>\wfdhexdrgo.exe

Deletes the following files

<Current directory>\xbeenxmsfd.exe
<Current directory>\rvtaeulnqq.exe
<Current directory>\rcxgzsdvxo.exe
<Current directory>\yffxfrxgzn.exe
<Current directory>\ltbpokunwo.exe
<Current directory>\foqdfobhhc.exe
<Current directory>\svigtjxyyo.exe
<Current directory>\fvbjimlxoz.exe
<Current directory>\vnoahhzyyz.exe
<Current directory>\ijvqsgovcq.exe
<Current directory>\lxbjolfiqz.exe
<Current directory>\zjufuammbn.exe
<Current directory>\wfdhexdrgo.exe

Deletes itself.

Miscellaneous

Creates and executes the following

'<Current directory>\xbeenxmsfd.exe'
'<Current directory>\rvtaeulnqq.exe'
'<Current directory>\rcxgzsdvxo.exe'
'<Current directory>\yffxfrxgzn.exe'
'<Current directory>\ltbpokunwo.exe'
'<Current directory>\foqdfobhhc.exe'
'<Current directory>\svigtjxyyo.exe'
'<Current directory>\fvbjimlxoz.exe'
'<Current directory>\vnoahhzyyz.exe'
'<Current directory>\lxbjolfiqz.exe'
'<Current directory>\ijvqsgovcq.exe'
'<Current directory>\foercdfapz.exe'
'<Current directory>\zjufuammbn.exe'
'<Current directory>\wfdhexdrgo.exe'

Executes the following

'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Full path to file>"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\GDQTOOKRKC.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\MIBXXSEWZO.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\JRWLKTCWQD.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\PWGPSXDJFP.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\WCRUBSWPTB.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\ZXIARVFKOA.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\WFDHEXDRGO.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\ZJUFUAMMBN.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\FOERCDFAPZ.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\IJVQSGOVCQ.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\LXBJOLFIQZ.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\VNOAHHZYYZ.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\FVBJIMLXOZ.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\SVIGTJXYYO.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\FOQDFOBHHC.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\LTBPOKUNWO.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\YFFXFRXGZN.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\RCXGZSDVXO.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\RVTAEULNQQ.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\XBEENXMSFD.exe"
'<SYSTEM32>\ping.exe' 1.1.1.1 -n 1 -w 6000
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\DIZUYLCOPL.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\WCGIQQIIBZ.exe"