Trojan.MulDrop13.17243

Technical Information

Modifies file system

Creates the following files

<Current directory>\ypptvlvsgg.exe
<Current directory>\wfzjpptmue.exe
<Current directory>\mijltmpfxh.exe
<Current directory>\pdzjjpqasf.exe
<Current directory>\vjkwrtsogr.exe
<Current directory>\ibssdqwxqg.exe
<Current directory>\vbzppviyzu.exe
<Current directory>\iugmbsmhjq.exe
<Current directory>\yxqofyjbms.exe
<Current directory>\lpxlyvvcwh.exe
<Current directory>\paoeglsgfs.exe
<Current directory>\cshndbswhr.exe
<Current directory>\vyzoxbxlfs.exe
<Current directory>\laiybzufju.exe
<Current directory>\ytqmneggsq.exe
<Current directory>\owzwrcdads.exe
<Current directory>\yeegshwytt.exe
<Current directory>\iurxmdioct.exe
nul
<Current directory>\vmzuximxlh.exe
<Current directory>\imorrfzhve.exe
<Current directory>\fvxltwbrup.exe
<Current directory>\zxfucnvmuq.exe

Deletes the following files

<Current directory>\ypptvlvsgg.exe
<Current directory>\mijltmpfxh.exe
<Current directory>\wfzjpptmue.exe
<Current directory>\pdzjjpqasf.exe
<Current directory>\vjkwrtsogr.exe
<Current directory>\ibssdqwxqg.exe
<Current directory>\vbzppviyzu.exe
<Current directory>\iugmbsmhjq.exe
<Current directory>\yxqofyjbms.exe
<Current directory>\lpxlyvvcwh.exe
<Current directory>\cshndbswhr.exe
<Current directory>\fvxltwbrup.exe
<Current directory>\vyzoxbxlfs.exe
<Current directory>\laiybzufju.exe
<Current directory>\ytqmneggsq.exe
<Current directory>\owzwrcdads.exe
<Current directory>\yeegshwytt.exe
<Current directory>\iurxmdioct.exe
<Current directory>\vmzuximxlh.exe
<Current directory>\imorrfzhve.exe
<Current directory>\zxfucnvmuq.exe
<Current directory>\paoeglsgfs.exe

Deletes itself.

Miscellaneous

Creates and executes the following

'<Current directory>\ypptvlvsgg.exe'
'<Current directory>\wfzjpptmue.exe'
'<Current directory>\mijltmpfxh.exe'
'<Current directory>\pdzjjpqasf.exe'
'<Current directory>\vjkwrtsogr.exe'
'<Current directory>\ibssdqwxqg.exe'
'<Current directory>\vbzppviyzu.exe'
'<Current directory>\iugmbsmhjq.exe'
'<Current directory>\yxqofyjbms.exe'
'<Current directory>\lpxlyvvcwh.exe'
'<Current directory>\cshndbswhr.exe'
'<Current directory>\fvxltwbrup.exe'
'<Current directory>\vyzoxbxlfs.exe'
'<Current directory>\laiybzufju.exe'
'<Current directory>\ytqmneggsq.exe'
'<Current directory>\owzwrcdads.exe'
'<Current directory>\yeegshwytt.exe'
'<Current directory>\iurxmdioct.exe'
'<Current directory>\vmzuximxlh.exe'
'<Current directory>\imorrfzhve.exe'
'<Current directory>\paoeglsgfs.exe'
'<Current directory>\zxfucnvmuq.exe'

Executes the following

'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Full path to file>"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\WFZJPPTMUE.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\MIJLTMPFXH.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\PDZJJPQASF.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\VJKWRTSOGR.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\IBSSDQWXQG.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\VBZPPVIYZU.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\IUGMBSMHJQ.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\YXQOFYJBMS.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\LPXLYVVCWH.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\CSHNDBSWHR.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\FVXLTWBRUP.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\VYZOXBXLFS.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\LAIYBZUFJU.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\YTQMNEGGSQ.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\OWZWRCDADS.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\YEEGSHWYTT.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\IURXMDIOCT.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\VMZUXIMXLH.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\IMORRFZHVE.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\YPPTVLVSGG.exe"
'<SYSTEM32>\ping.exe' 1.1.1.1 -n 1 -w 6000
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\PAOEGLSGFS.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\ZXFUCNVMUQ.exe"