Trojan.MulDrop13.17245

Technical Information

Modifies file system

Creates the following files

<Current directory>\fdwlilfsdx.exe
<Current directory>\zypcmuuqex.exe
<Current directory>\mqerxrgaot.exe
<Current directory>\twpdgvafcg.exe
<Current directory>\zbahoybtrk.exe
<Current directory>\zuwbubrdkv.exe
<Current directory>\jccsnxdbav.exe
<Current directory>\cicthgjqyw.exe
<Current directory>\pajqbdnrik.exe
<Current directory>\ctqmnizarg.exe
<Current directory>\mjeegelrzh.exe
<Current directory>\clfgkkhllj.exe
<Current directory>\iryktgjyzv.exe
<Current directory>\pxjwbjkeni.exe
<Current directory>\vcuakndscu.exe
nul
<Current directory>\fkhsljxiku.exe
<Current directory>\vnruppucvw.exe
<Current directory>\qijlsqjawx.exe
<Current directory>\dpcoztwrmi.exe

Deletes the following files

<Current directory>\fdwlilfsdx.exe
<Current directory>\qijlsqjawx.exe
<Current directory>\mqerxrgaot.exe
<Current directory>\zbahoybtrk.exe
<Current directory>\twpdgvafcg.exe
<Current directory>\zuwbubrdkv.exe
<Current directory>\jccsnxdbav.exe
<Current directory>\pajqbdnrik.exe
<Current directory>\zypcmuuqex.exe
<Current directory>\cicthgjqyw.exe
<Current directory>\ctqmnizarg.exe
<Current directory>\pxjwbjkeni.exe
<Current directory>\clfgkkhllj.exe
<Current directory>\iryktgjyzv.exe
<Current directory>\vcuakndscu.exe
<Current directory>\fkhsljxiku.exe
<Current directory>\vnruppucvw.exe
<Current directory>\mjeegelrzh.exe
<Current directory>\dpcoztwrmi.exe

Deletes itself.

Miscellaneous

Creates and executes the following

'<Current directory>\fdwlilfsdx.exe'
'<Current directory>\zypcmuuqex.exe'
'<Current directory>\mqerxrgaot.exe'
'<Current directory>\twpdgvafcg.exe'
'<Current directory>\zbahoybtrk.exe'
'<Current directory>\zuwbubrdkv.exe'
'<Current directory>\jccsnxdbav.exe'
'<Current directory>\cicthgjqyw.exe'
'<Current directory>\qijlsqjawx.exe'
'<Current directory>\pajqbdnrik.exe'
'<Current directory>\mjeegelrzh.exe'
'<Current directory>\clfgkkhllj.exe'
'<Current directory>\iryktgjyzv.exe'
'<Current directory>\pxjwbjkeni.exe'
'<Current directory>\vcuakndscu.exe'
'<Current directory>\fkhsljxiku.exe'
'<Current directory>\vnruppucvw.exe'
'<Current directory>\ctqmnizarg.exe'
'<Current directory>\dpcoztwrmi.exe'

Executes the following

'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Full path to file>"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\QIJLSQJAWX.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\ZYPCMUUQEX.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\MQERXRGAOT.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\TWPDGVAFCG.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\ZBAHOYBTRK.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\ZUWBUBRDKV.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\JCCSNXDBAV.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\CICTHGJQYW.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\PAJQBDNRIK.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\CTQMNIZARG.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\MJEEGELRZH.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\CLFGKKHLLJ.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\IRYKTGJYZV.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\PXJWBJKENI.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\VCUAKNDSCU.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\FKHSLJXIKU.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\VNRUPPUCVW.exe"
'<SYSTEM32>\ping.exe' 1.1.1.1 -n 1 -w 6000
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\FDWLILFSDX.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\DPCOZTWRMI.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\TZPXGOLTWI.exe"