Trojan.MulDrop13.17284

Technical Information

Modifies file system

Creates the following files

<Current directory>\rueyzafcqk.exe
<Current directory>\przuvkmlkg.exe
<Current directory>\zhmeooybsg.exe
<Current directory>\fnxqxkzppt.exe
<Current directory>\pvkzyolfxt.exe
<Current directory>\ldfnkpjnxi.exe
<Current directory>\sjqrttctlu.exe
<Current directory>\vehyjwlnyt.exe
<Current directory>\eumicsfmot.exe
<Current directory>\vxvkgycgrv.exe
<Current directory>\ysmqetkbmu.exe
<Current directory>\lstfqypkwi.exe
<Current directory>\ylbccvtlfw.exe
<Current directory>\hbotdznjnx.exe
<Current directory>\rjblweyidx.exe
nul
<Current directory>\umskmzhcqv.exe
<Current directory>\euxbndttgw.exe
<Current directory>\imoimglxwu.exe
<Current directory>\zwbzlkrhgt.exe

Deletes the following files

<Current directory>\rueyzafcqk.exe
<Current directory>\euxbndttgw.exe
<Current directory>\umskmzhcqv.exe
<Current directory>\rjblweyidx.exe
<Current directory>\hbotdznjnx.exe
<Current directory>\ylbccvtlfw.exe
<Current directory>\ysmqetkbmu.exe
<Current directory>\lstfqypkwi.exe
<Current directory>\vxvkgycgrv.exe
<Current directory>\eumicsfmot.exe
<Current directory>\vehyjwlnyt.exe
<Current directory>\sjqrttctlu.exe
<Current directory>\ldfnkpjnxi.exe
<Current directory>\fnxqxkzppt.exe
<Current directory>\pvkzyolfxt.exe
<Current directory>\zhmeooybsg.exe

Deletes itself.

Miscellaneous

Creates and executes the following

'<Current directory>\rueyzafcqk.exe'
'<Current directory>\przuvkmlkg.exe'
'<Current directory>\zhmeooybsg.exe'
'<Current directory>\fnxqxkzppt.exe'
'<Current directory>\pvkzyolfxt.exe'
'<Current directory>\ldfnkpjnxi.exe'
'<Current directory>\sjqrttctlu.exe'
'<Current directory>\vehyjwlnyt.exe'
'<Current directory>\imoimglxwu.exe'
'<Current directory>\eumicsfmot.exe'
'<Current directory>\ysmqetkbmu.exe'
'<Current directory>\lstfqypkwi.exe'
'<Current directory>\ylbccvtlfw.exe'
'<Current directory>\hbotdznjnx.exe'
'<Current directory>\rjblweyidx.exe'
'<Current directory>\umskmzhcqv.exe'
'<Current directory>\euxbndttgw.exe'
'<Current directory>\vxvkgycgrv.exe'
'<Current directory>\zwbzlkrhgt.exe'

Executes the following

'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Full path to file>"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\PRZUVKMLKG.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\ZHMEOOYBSG.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\FNXQXKZPPT.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\PVKZYOLFXT.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\LDFNKPJNXI.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\SJQRTTCTLU.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\VEHYJWLNYT.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\EUMICSFMOT.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\IMOIMGLXWU.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\VXVKGYCGRV.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\LSTFQYPKWI.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\YLBCCVTLFW.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\HBOTDZNJNX.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\RJBLWEYIDX.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\UMSKMZHCQV.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\EUXBNDTTGW.exe"
'<SYSTEM32>\ping.exe' 1.1.1.1 -n 1 -w 6000
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\RUEYZAFCQK.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\YSMQETKBMU.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\ZWBZLKRHGT.exe"