Trojan.MulDrop13.17297

Technical Information

Modifies file system

Creates the following files

<Current directory>\amavwmfzkd.exe
<Current directory>\vzseavuxll.exe
<Current directory>\cedqizndzq.exe
<Current directory>\ynywvalczm.exe
<Current directory>\ophgayqwco.exe
<Current directory>\bqpdldufmd.exe
<Current directory>\yqjjyfsemz.exe
<Current directory>\otllccoypb.exe
<Current directory>\btsiohtzzq.exe
<Current directory>\hzluxdunnc.exe
<Current directory>\oewyfhvtcp.exe
<Current directory>\bxdvrezcld.exe
<Current directory>\esuuhhixgb.exe
<Current directory>\oihliluvoc.exe
nul
<Current directory>\rdykyodqja.exe
<Current directory>\atdbzkoora.exe
<Current directory>\kjqlspifhb.exe
<Current directory>\vowsctdfsb.exe
<Current directory>\myrbbpsoca.exe

Deletes the following files

<Current directory>\amavwmfzkd.exe
<Current directory>\vzseavuxll.exe
<Current directory>\cedqizndzq.exe
<Current directory>\ynywvalczm.exe
<Current directory>\ophgayqwco.exe
<Current directory>\bqpdldufmd.exe
<Current directory>\yqjjyfsemz.exe
<Current directory>\otllccoypb.exe
<Current directory>\vowsctdfsb.exe
<Current directory>\btsiohtzzq.exe
<Current directory>\oewyfhvtcp.exe
<Current directory>\bxdvrezcld.exe
<Current directory>\esuuhhixgb.exe
<Current directory>\oihliluvoc.exe
<Current directory>\rdykyodqja.exe
<Current directory>\atdbzkoora.exe
<Current directory>\kjqlspifhb.exe
<Current directory>\hzluxdunnc.exe
<Current directory>\myrbbpsoca.exe

Deletes itself.

Miscellaneous

Creates and executes the following

'<Current directory>\amavwmfzkd.exe'
'<Current directory>\vzseavuxll.exe'
'<Current directory>\cedqizndzq.exe'
'<Current directory>\ynywvalczm.exe'
'<Current directory>\ophgayqwco.exe'
'<Current directory>\bqpdldufmd.exe'
'<Current directory>\yqjjyfsemz.exe'
'<Current directory>\otllccoypb.exe'
'<Current directory>\vowsctdfsb.exe'
'<Current directory>\btsiohtzzq.exe'
'<Current directory>\oewyfhvtcp.exe'
'<Current directory>\bxdvrezcld.exe'
'<Current directory>\esuuhhixgb.exe'
'<Current directory>\oihliluvoc.exe'
'<Current directory>\rdykyodqja.exe'
'<Current directory>\atdbzkoora.exe'
'<Current directory>\kjqlspifhb.exe'
'<Current directory>\hzluxdunnc.exe'
'<Current directory>\myrbbpsoca.exe'

Executes the following

'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Full path to file>"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\VOWSCTDFSB.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\VZSEAVUXLL.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\CEDQIZNDZQ.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\YNYWVALCZM.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\OPHGAYQWCO.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\BQPDLDUFMD.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\YQJJYFSEMZ.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\OTLLCCOYPB.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\BTSIOHTZZQ.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\HZLUXDUNNC.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\OEWYFHVTCP.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\BXDVREZCLD.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\ESUUHHIXGB.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\OIHLILUVOC.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\RDYKYODQJA.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\ATDBZKOORA.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\KJQLSPIFHB.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\AMAVWMFZKD.exe"
'<SYSTEM32>\ping.exe' 1.1.1.1 -n 1 -w 6000
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\MYRBBPSOCA.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\CIDJISYQUA.exe"