Trojan.MulDrop13.17268

Technical Information

Modifies file system

Creates the following files

<Current directory>\zzqlxposjr.exe
<Current directory>\keelabrsur.exe
<Current directory>\uurcbydjkr.exe
<Current directory>\hmyzndhsuf.exe
<Current directory>\nsjdvziyis.exe
<Current directory>\uyupecklxe.exe
<Current directory>\dohyxgvcne.exe
<Current directory>\nwuqydhavf.exe
<Current directory>\gtnrsemptf.exe
<Current directory>\aznammsdro.exe
<Current directory>\akbtsoiokr.exe
<Current directory>\japdllcmar.exe
<Current directory>\jtdwqnlwub.exe
nul
<Current directory>\jesqopbgne.exe
<Current directory>\pjlcwtcubq.exe
<Current directory>\xmwoowfjlc.exe
<Current directory>\hjnmkziphs.exe

Deletes the following files

<Current directory>\zzqlxposjr.exe
<Current directory>\pjlcwtcubq.exe
<Current directory>\jesqopbgne.exe
<Current directory>\jtdwqnlwub.exe
<Current directory>\japdllcmar.exe
<Current directory>\akbtsoiokr.exe
<Current directory>\aznammsdro.exe
<Current directory>\gtnrsemptf.exe
<Current directory>\nwuqydhavf.exe
<Current directory>\dohyxgvcne.exe
<Current directory>\uyupecklxe.exe
<Current directory>\nsjdvziyis.exe
<Current directory>\hmyzndhsuf.exe
<Current directory>\uurcbydjkr.exe
<Current directory>\keelabrsur.exe

Deletes itself.

Miscellaneous

Creates and executes the following

'<Current directory>\zzqlxposjr.exe'
'<Current directory>\keelabrsur.exe'
'<Current directory>\uurcbydjkr.exe'
'<Current directory>\hmyzndhsuf.exe'
'<Current directory>\nsjdvziyis.exe'
'<Current directory>\uyupecklxe.exe'
'<Current directory>\dohyxgvcne.exe'
'<Current directory>\xmwoowfjlc.exe'
'<Current directory>\nwuqydhavf.exe'
'<Current directory>\aznammsdro.exe'
'<Current directory>\akbtsoiokr.exe'
'<Current directory>\japdllcmar.exe'
'<Current directory>\jtdwqnlwub.exe'
'<Current directory>\jesqopbgne.exe'
'<Current directory>\pjlcwtcubq.exe'
'<Current directory>\gtnrsemptf.exe'
'<Current directory>\hjnmkziphs.exe'

Executes the following

'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Full path to file>"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\XMWOOWFJLC.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\KEELABRSUR.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\UURCBYDJKR.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\HMYZNDHSUF.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\NSJDVZIYIS.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\UYUPECKLXE.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\DOHYXGVCNE.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\NWUQYDHAVF.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\GTNRSEMPTF.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\AZNAMMSDRO.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\AKBTSOIOKR.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\JAPDLLCMAR.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\JTDWQNLWUB.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\JESQOPBGNE.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\PJLCWTCUBQ.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\ZZQLXPOSJR.exe"
'<SYSTEM32>\ping.exe' 1.1.1.1 -n 1 -w 6000
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\HJNMKZIPHS.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\EGWNUWZVMC.exe"