Trojan.MulDrop13.17247

Technical Information

Modifies file system

Creates the following files

<Current directory>\hmbvjjocon.exe
<Current directory>\ywzzurkhoz.exe
<Current directory>\imeqvnegez.exe
<Current directory>\veunhsipno.exe
<Current directory>\ixbksqmqxc.exe
<Current directory>\ocmobtoelo.exe
<Current directory>\bdtkmysfvl.exe
<Current directory>\iimxvutsjp.exe
<Current directory>\ylozzaqmvz.exe
<Current directory>\pomptnyrgz.exe
<Current directory>\erzdivrsjm.exe
<Current directory>\rcdtzdmlmc.exe
<Current directory>\hfmvdaifpn.exe
<Current directory>\kavutdrakl.exe
<Current directory>\ovmbjgavxc.exe
<Current directory>\xlzkkcmtnc.exe
nul
<Current directory>\kdghwiqcxy.exe
<Current directory>\xwoeifcdgm.exe
<Current directory>\ozmujadqrm.exe
<Current directory>\fyzyzqftpy.exe

Deletes the following files

<Current directory>\hmbvjjocon.exe
<Current directory>\veunhsipno.exe
<Current directory>\ixbksqmqxc.exe
<Current directory>\ocmobtoelo.exe
<Current directory>\bdtkmysfvl.exe
<Current directory>\iimxvutsjp.exe
<Current directory>\ylozzaqmvz.exe
<Current directory>\erzdivrsjm.exe
<Current directory>\ozmujadqrm.exe
<Current directory>\rcdtzdmlmc.exe
<Current directory>\hfmvdaifpn.exe
<Current directory>\kavutdrakl.exe
<Current directory>\ovmbjgavxc.exe
<Current directory>\xlzkkcmtnc.exe
<Current directory>\xwoeifcdgm.exe
<Current directory>\kdghwiqcxy.exe
<Current directory>\imeqvnegez.exe
<Current directory>\ywzzurkhoz.exe

Deletes itself.

Miscellaneous

Creates and executes the following

'<Current directory>\hmbvjjocon.exe'
'<Current directory>\ywzzurkhoz.exe'
'<Current directory>\imeqvnegez.exe'
'<Current directory>\veunhsipno.exe'
'<Current directory>\ixbksqmqxc.exe'
'<Current directory>\ocmobtoelo.exe'
'<Current directory>\bdtkmysfvl.exe'
'<Current directory>\iimxvutsjp.exe'
'<Current directory>\ylozzaqmvz.exe'
'<Current directory>\erzdivrsjm.exe'
'<Current directory>\ozmujadqrm.exe'
'<Current directory>\rcdtzdmlmc.exe'
'<Current directory>\hfmvdaifpn.exe'
'<Current directory>\kavutdrakl.exe'
'<Current directory>\ovmbjgavxc.exe'
'<Current directory>\xlzkkcmtnc.exe'
'<Current directory>\kdghwiqcxy.exe'
'<Current directory>\xwoeifcdgm.exe'
'<Current directory>\pomptnyrgz.exe'
'<Current directory>\fyzyzqftpy.exe'

Executes the following

'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Full path to file>"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\FYZYZQFTPY.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\POMPTNYRGZ.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\YWZZURKHOZ.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\IMEQVNEGEZ.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\VEUNHSIPNO.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\IXBKSQMQXC.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\OCMOBTOELO.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\BDTKMYSFVL.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\IIMXVUTSJP.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\YLOZZAQMVZ.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\ERZDIVRSJM.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\OZMUJADQRM.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\RCDTZDMLMC.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\HFMVDAIFPN.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\KAVUTDRAKL.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\OVMBJGAVXC.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\XLZKKCMTNC.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\KDGHWIQCXY.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\XWOEIFCDGM.exe"
'<SYSTEM32>\ping.exe' 1.1.1.1 -n 1 -w 6000
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\HMBVJJOCON.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\ZTOURNLNBM.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\SNDIIJKZNA.exe"