Trojan.MulDrop13.17293

Technical Information

Modifies file system

Creates the following files

<Current directory>\leprfdfnuw.exe
<Current directory>\kkkntfewps.exe
<Current directory>\amlpxljiau.exe
<Current directory>\dhcwnokknt.exe
<Current directory>\qajthlwmwh.exe
<Current directory>\dazisqavgv.exe
<Current directory>\qtgeenfeqs.exe
<Current directory>\dlnbqsrfzg.exe
<Current directory>\qlvyjpvoju.exe
<Current directory>\decvvuzxti.exe
<Current directory>\auxezjtxhs.exe
<Current directory>\wccdpvfmrr.exe
<Current directory>\tkxkcwdlqg.exe
<Current directory>\jnymguhfui.exe
<Current directory>\wfniszlgde.exe
<Current directory>\mipkwxiaog.exe
<Current directory>\plgrmarvbf.exe
nul
<Current directory>\vrrvvdkjqr.exe
<Current directory>\mtaxzbpcbu.exe
<Current directory>\zmhulyteli.exe
<Current directory>\chniyqgrfw.exe
<Current directory>\krnuvdoevi.exe

Deletes the following files

<Current directory>\leprfdfnuw.exe
<Current directory>\qajthlwmwh.exe
<Current directory>\dhcwnokknt.exe
<Current directory>\dazisqavgv.exe
<Current directory>\qtgeenfeqs.exe
<Current directory>\qlvyjpvoju.exe
<Current directory>\dlnbqsrfzg.exe
<Current directory>\decvvuzxti.exe
<Current directory>\wccdpvfmrr.exe
<Current directory>\chniyqgrfw.exe
<Current directory>\tkxkcwdlqg.exe
<Current directory>\wfniszlgde.exe
<Current directory>\jnymguhfui.exe
<Current directory>\mipkwxiaog.exe
<Current directory>\plgrmarvbf.exe
<Current directory>\vrrvvdkjqr.exe
<Current directory>\mtaxzbpcbu.exe
<Current directory>\zmhulyteli.exe
<Current directory>\amlpxljiau.exe
<Current directory>\kkkntfewps.exe

Deletes itself.

Miscellaneous

Creates and executes the following

'<Current directory>\leprfdfnuw.exe'
'<Current directory>\kkkntfewps.exe'
'<Current directory>\amlpxljiau.exe'
'<Current directory>\dhcwnokknt.exe'
'<Current directory>\qajthlwmwh.exe'
'<Current directory>\dazisqavgv.exe'
'<Current directory>\qtgeenfeqs.exe'
'<Current directory>\dlnbqsrfzg.exe'
'<Current directory>\qlvyjpvoju.exe'
'<Current directory>\decvvuzxti.exe'
'<Current directory>\wccdpvfmrr.exe'
'<Current directory>\chniyqgrfw.exe'
'<Current directory>\tkxkcwdlqg.exe'
'<Current directory>\jnymguhfui.exe'
'<Current directory>\wfniszlgde.exe'
'<Current directory>\mipkwxiaog.exe'
'<Current directory>\plgrmarvbf.exe'
'<Current directory>\vrrvvdkjqr.exe'
'<Current directory>\mtaxzbpcbu.exe'
'<Current directory>\zmhulyteli.exe'
'<Current directory>\auxezjtxhs.exe'
'<Current directory>\krnuvdoevi.exe'

Executes the following

'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Full path to file>"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\KRNUVDOEVI.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\AUXEZJTXHS.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\KKKNTFEWPS.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\AMLPXLJIAU.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\DHCWNOKKNT.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\QAJTHLWMWH.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\DAZISQAVGV.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\QTGEENFEQS.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\DLNBQSRFZG.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\QLVYJPVOJU.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\DECVVUZXTI.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\WCCDPVFMRR.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\CHNIYQGRFW.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\TKXKCWDLQG.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\JNYMGUHFUI.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\WFNISZLGDE.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\MIPKWXIAOG.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\PLGRMARVBF.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\VRRVVDKJQR.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\MTAXZBPCBU.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\ZMHULYTELI.exe"
'<SYSTEM32>\ping.exe' 1.1.1.1 -n 1 -w 6000
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\LEPRFDFNUW.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\AJIKUGCNFH.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\UDXYLDBARV.exe"