Trojan.MulDrop13.17253

Technical Information

Modifies file system

Creates the following files

<Current directory>\saocvatycr.exe
<Current directory>\klmggipmbd.exe
<Current directory>\tbrxhfbcre.exe
<Current directory>\djeoijmbze.exe
<Current directory>\dcbafldlso.exe
<Current directory>\duqtlotdmr.exe
<Current directory>\zdkiqprclg.exe
<Current directory>\givmytkias.exe
<Current directory>\mggyhomwoe.exe
<Current directory>\tlzcpsnbdr.exe
<Current directory>\zrkoyvgprd.exe
<Current directory>\mrrdktkqbr.exe
<Current directory>\pmikavttoq.exe
<Current directory>\sizixycojo.exe
nul
<Current directory>\figfjvgxsd.exe
<Current directory>\avzwnevntd.exe
<Current directory>\qnmflajxdc.exe

Deletes the following files

<Current directory>\saocvatycr.exe
<Current directory>\avzwnevntd.exe
<Current directory>\tbrxhfbcre.exe
<Current directory>\djeoijmbze.exe
<Current directory>\dcbafldlso.exe
<Current directory>\duqtlotdmr.exe
<Current directory>\zdkiqprclg.exe
<Current directory>\klmggipmbd.exe
<Current directory>\givmytkias.exe
<Current directory>\tlzcpsnbdr.exe
<Current directory>\mrrdktkqbr.exe
<Current directory>\zrkoyvgprd.exe
<Current directory>\pmikavttoq.exe
<Current directory>\sizixycojo.exe
<Current directory>\figfjvgxsd.exe
<Current directory>\mggyhomwoe.exe
<Current directory>\qnmflajxdc.exe

Deletes itself.

Miscellaneous

Creates and executes the following

'<Current directory>\saocvatycr.exe'
'<Current directory>\klmggipmbd.exe'
'<Current directory>\tbrxhfbcre.exe'
'<Current directory>\djeoijmbze.exe'
'<Current directory>\dcbafldlso.exe'
'<Current directory>\duqtlotdmr.exe'
'<Current directory>\zdkiqprclg.exe'
'<Current directory>\avzwnevntd.exe'
'<Current directory>\givmytkias.exe'
'<Current directory>\tlzcpsnbdr.exe'
'<Current directory>\zrkoyvgprd.exe'
'<Current directory>\mrrdktkqbr.exe'
'<Current directory>\pmikavttoq.exe'
'<Current directory>\sizixycojo.exe'
'<Current directory>\figfjvgxsd.exe'
'<Current directory>\mggyhomwoe.exe'
'<Current directory>\qnmflajxdc.exe'

Executes the following

'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Full path to file>"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\AVZWNEVNTD.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\KLMGGIPMBD.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\TBRXHFBCRE.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\DJEOIJMBZE.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\DCBAFLDLSO.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\DUQTLOTDMR.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\ZDKIQPRCLG.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\GIVMYTKIAS.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\MGGYHOMWOE.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\TLZCPSNBDR.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\ZRKOYVGPRD.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\MRRDKTKQBR.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\PMIKAVTTOQ.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\SIZIXYCOJO.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\FIGFJVGXSD.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\SAOCVATYCR.exe"
'<SYSTEM32>\ping.exe' 1.1.1.1 -n 1 -w 6000
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\QNMFLAJXDC.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\AKKDHCFDAS.exe"