Trojan.MulDrop13.17288

Technical Information

Modifies file system

Creates the following files

<Current directory>\bawjiarhnl.exe
<Current directory>\sejgycefgi.exe
<Current directory>\jgsrcibzrk.exe
<Current directory>\zjuthgxtuu.exe
<Current directory>\mcjpslkuej.exe
<Current directory>\celrxjgopl.exe
<Current directory>\pxsoigkxzh.exe
<Current directory>\znfyjkenpi.exe
<Current directory>\idspdpqmxi.exe
<Current directory>\jowxxgkpyi.exe
<Current directory>\vvamomcvgw.exe
<Current directory>\igecftxojv.exe
<Current directory>\ompgopquyh.exe
<Current directory>\fpyqsuvojk.exe
<Current directory>\ikhpipviwi.exe
<Current directory>\lfyoysedrz.exe
nul
<Current directory>\yfflsximav.exe
<Current directory>\oionwvngex.exe
<Current directory>\yqqlmpdqbv.exe
<Current directory>\wvoalbggol.exe

Deletes the following files

<Current directory>\bawjiarhnl.exe
<Current directory>\sejgycefgi.exe
<Current directory>\jgsrcibzrk.exe
<Current directory>\zjuthgxtuu.exe
<Current directory>\mcjpslkuej.exe
<Current directory>\celrxjgopl.exe
<Current directory>\znfyjkenpi.exe
<Current directory>\pxsoigkxzh.exe
<Current directory>\idspdpqmxi.exe
<Current directory>\vvamomcvgw.exe
<Current directory>\yqqlmpdqbv.exe
<Current directory>\igecftxojv.exe
<Current directory>\ompgopquyh.exe
<Current directory>\fpyqsuvojk.exe
<Current directory>\ikhpipviwi.exe
<Current directory>\lfyoysedrz.exe
<Current directory>\yfflsximav.exe
<Current directory>\oionwvngex.exe
<Current directory>\jowxxgkpyi.exe
<Current directory>\wvoalbggol.exe

Deletes itself.

Miscellaneous

Creates and executes the following

'<Current directory>\bawjiarhnl.exe'
'<Current directory>\sejgycefgi.exe'
'<Current directory>\jgsrcibzrk.exe'
'<Current directory>\zjuthgxtuu.exe'
'<Current directory>\mcjpslkuej.exe'
'<Current directory>\celrxjgopl.exe'
'<Current directory>\pxsoigkxzh.exe'
'<Current directory>\znfyjkenpi.exe'
'<Current directory>\idspdpqmxi.exe'
'<Current directory>\vvamomcvgw.exe'
'<Current directory>\yqqlmpdqbv.exe'
'<Current directory>\igecftxojv.exe'
'<Current directory>\ompgopquyh.exe'
'<Current directory>\fpyqsuvojk.exe'
'<Current directory>\ikhpipviwi.exe'
'<Current directory>\lfyoysedrz.exe'
'<Current directory>\yfflsximav.exe'
'<Current directory>\oionwvngex.exe'
'<Current directory>\jowxxgkpyi.exe'
'<Current directory>\wvoalbggol.exe'

Executes the following

'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Full path to file>"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\WKLNIXZLBY.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\TSYCVYXLTV.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\WVOALBGGOL.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\JOWXXGKPYI.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\SEJGYCEFGI.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\JGSRCIBZRK.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\ZJUTHGXTUU.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\MCJPSLKUEJ.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\CELRXJGOPL.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\PXSOIGKXZH.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\ZNFYJKENPI.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\IDSPDPQMXI.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\VVAMOMCVGW.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\YQQLMPDQBV.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\IGECFTXOJV.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\OMPGOPQUYH.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\FPYQSUVOJK.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\IKHPIPVIWI.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\LFYOYSEDRZ.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\YFFLSXIMAV.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\OIONWVNGEX.exe"
'<SYSTEM32>\ping.exe' 1.1.1.1 -n 1 -w 6000
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\BAWJIARHNL.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\QMSJABGYNU.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\ZKRZWVBECK.exe"