Trojan.MulDrop13.17332

Technical Information

Modifies file system

Creates the following files

<Current directory>\kzifwhugvi.exe
<Current directory>\mhfhcjuajs.exe
<Current directory>\zhmeooybsg.exe
<Current directory>\lauailckkv.exe
<Current directory>\vqhsbpwjsv.exe
<Current directory>\lsiufntvdf.exe
<Current directory>\vavlgsmtlg.exe
<Current directory>\ibdisprcvu.exe
<Current directory>\ogomassijg.exe
<Current directory>\orkgyuasdj.exe
<Current directory>\yhxxzruqtj.exe
<Current directory>\bcgwpuvlgi.exe
<Current directory>\ovwtbzhupw.exe
<Current directory>\equokzuyuj.exe
<Current directory>\ogzfldgpcj.exe
<Current directory>\orvrjfwhvt.exe
nul
<Current directory>\brdovcaifi.exe
<Current directory>\zpqkrmirzw.exe
<Current directory>\zwbzlkrhgt.exe

Deletes the following files

<Current directory>\kzifwhugvi.exe
<Current directory>\zwbzlkrhgt.exe
<Current directory>\lauailckkv.exe
<Current directory>\zhmeooybsg.exe
<Current directory>\lsiufntvdf.exe
<Current directory>\vqhsbpwjsv.exe
<Current directory>\ibdisprcvu.exe
<Current directory>\vavlgsmtlg.exe
<Current directory>\mhfhcjuajs.exe
<Current directory>\ogomassijg.exe
<Current directory>\yhxxzruqtj.exe
<Current directory>\bcgwpuvlgi.exe
<Current directory>\ovwtbzhupw.exe
<Current directory>\equokzuyuj.exe
<Current directory>\ogzfldgpcj.exe
<Current directory>\orvrjfwhvt.exe
<Current directory>\brdovcaifi.exe
<Current directory>\orkgyuasdj.exe
<Current directory>\zpqkrmirzw.exe

Deletes itself.

Miscellaneous

Creates and executes the following

'<Current directory>\kzifwhugvi.exe'
'<Current directory>\mhfhcjuajs.exe'
'<Current directory>\zhmeooybsg.exe'
'<Current directory>\lauailckkv.exe'
'<Current directory>\vqhsbpwjsv.exe'
'<Current directory>\lsiufntvdf.exe'
'<Current directory>\vavlgsmtlg.exe'
'<Current directory>\ibdisprcvu.exe'
'<Current directory>\zpqkrmirzw.exe'
'<Current directory>\ogomassijg.exe'
'<Current directory>\yhxxzruqtj.exe'
'<Current directory>\bcgwpuvlgi.exe'
'<Current directory>\ovwtbzhupw.exe'
'<Current directory>\equokzuyuj.exe'
'<Current directory>\ogzfldgpcj.exe'
'<Current directory>\orvrjfwhvt.exe'
'<Current directory>\brdovcaifi.exe'
'<Current directory>\orkgyuasdj.exe'
'<Current directory>\zwbzlkrhgt.exe'

Executes the following

'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Full path to file>"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\FYJQRJUSIT.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\MDUCZFNYWF.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\ZWBZLKRHGT.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\ZPQKRMIRZW.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\MHFHCJUAJS.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\ZHMEOOYBSG.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\LAUAILCKKV.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\VQHSBPWJSV.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\LSIUFNTVDF.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\VAVLGSMTLG.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\CDSRBGLPVU.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\IBDISPRCVU.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\ORKGYUASDJ.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\YHXXZRUQTJ.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\BCGWPUVLGI.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\OVWTBZHUPW.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\EQUOKZUYUJ.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\OGZFLDGPCJ.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\ORVRJFWHVT.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\BRDOVCAIFI.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\KZIFWHUGVI.exe"
'<SYSTEM32>\ping.exe' 1.1.1.1 -n 1 -w 6000
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\OGOMASSIJG.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\CKVXDEVFCS.exe"