Trojan.MulDrop13.17314

Technical Information

Modifies file system

Creates the following files

<Current directory>\lxponfndim.exe
<Current directory>\jdbkboumlb.exe
<Current directory>\wvjhnlywup.exe
<Current directory>\glwqoqsmcp.exe
<Current directory>\jgnpettpxo.exe
<Current directory>\twagfpnffo.exe
<Current directory>\thoacrdxzy.exe
<Current directory>\jkychxajkb.exe
<Current directory>\mnpbxajmxz.exe
<Current directory>\zfwxqxnngn.exe
<Current directory>\myduccrwqc.exe
<Current directory>\pbutsxarla.exe
<Current directory>\zjzktbuqtb.exe
<Current directory>\shalnczerb.exe
<Current directory>\cxndhgldhc.exe
nul
<Current directory>\ppuzadperq.exe
<Current directory>\yfzrtijczq.exe
<Current directory>\xkunpjqlbm.exe
<Current directory>\kknqemecry.exe

Deletes the following files

<Current directory>\lxponfndim.exe
<Current directory>\jdbkboumlb.exe
<Current directory>\wvjhnlywup.exe
<Current directory>\glwqoqsmcp.exe
<Current directory>\jgnpettpxo.exe
<Current directory>\twagfpnffo.exe
<Current directory>\jkychxajkb.exe
<Current directory>\thoacrdxzy.exe
<Current directory>\kknqemecry.exe
<Current directory>\mnpbxajmxz.exe
<Current directory>\myduccrwqc.exe
<Current directory>\pbutsxarla.exe
<Current directory>\zjzktbuqtb.exe
<Current directory>\shalnczerb.exe
<Current directory>\cxndhgldhc.exe
<Current directory>\ppuzadperq.exe
<Current directory>\yfzrtijczq.exe
<Current directory>\zfwxqxnngn.exe
<Current directory>\xkunpjqlbm.exe

Deletes itself.

Miscellaneous

Creates and executes the following

'<Current directory>\lxponfndim.exe'
'<Current directory>\jdbkboumlb.exe'
'<Current directory>\wvjhnlywup.exe'
'<Current directory>\glwqoqsmcp.exe'
'<Current directory>\jgnpettpxo.exe'
'<Current directory>\twagfpnffo.exe'
'<Current directory>\thoacrdxzy.exe'
'<Current directory>\jkychxajkb.exe'
'<Current directory>\xkunpjqlbm.exe'
'<Current directory>\mnpbxajmxz.exe'
'<Current directory>\myduccrwqc.exe'
'<Current directory>\pbutsxarla.exe'
'<Current directory>\zjzktbuqtb.exe'
'<Current directory>\shalnczerb.exe'
'<Current directory>\cxndhgldhc.exe'
'<Current directory>\ppuzadperq.exe'
'<Current directory>\yfzrtijczq.exe'
'<Current directory>\zfwxqxnngn.exe'
'<Current directory>\kknqemecry.exe'

Executes the following

'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Full path to file>"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\KKNQEMECRY.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\XKUNPJQLBM.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\JDBKBOUMLB.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\WVJHNLYWUP.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\GLWQOQSMCP.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\JGNPETTPXO.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\TWAGFPNFFO.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\THOACRDXZY.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\JKYCHXAJKB.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\KZYXYKNSYN.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\MNPBXAJMXZ.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\MYDUCCRWQC.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\PBUTSXARLA.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\ZJZKTBUQTB.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\SHALNCZERB.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\CXNDHGLDHC.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\PPUZADPERQ.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\YFZRTIJCZQ.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\LXPONFNDIM.exe"
'<SYSTEM32>\ping.exe' 1.1.1.1 -n 1 -w 6000
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\ZFWXQXNNGN.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\AJLFFGCUIN.exe"