Trojan.MulDrop13.3468

Technical Information

Modifies file system

Creates the following files

<Current directory>\rxxpujwijq.exe
<Current directory>\gxbouqaloo.exe
<Current directory>\mdmauuuqdb.exe
<Current directory>\wtzjwqnptb.exe
<Current directory>\cykveupuhn.exe
<Current directory>\prrsqrterc.exe
<Current directory>\vwcwyvmjfo.exe
<Current directory>\lsasavhncb.exe
<Current directory>\vaojbztmsb.exe
<Current directory>\iavgnwxncp.exe
<Current directory>\siipoarlkq.exe
<Current directory>\ftmgfaleno.exe
<Current directory>\ojrxyexvdp.exe
nul
<Current directory>\yzepzirtlp.exe
<Current directory>\efptieszzc.exe
<Current directory>\zriklnzxac.exe
<Current directory>\tmxxdjgrlp.exe

Deletes the following files

<Current directory>\rxxpujwijq.exe
<Current directory>\gxbouqaloo.exe
<Current directory>\mdmauuuqdb.exe
<Current directory>\wtzjwqnptb.exe
<Current directory>\cykveupuhn.exe
<Current directory>\prrsqrterc.exe
<Current directory>\vwcwyvmjfo.exe
<Current directory>\zriklnzxac.exe
<Current directory>\lsasavhncb.exe
<Current directory>\iavgnwxncp.exe
<Current directory>\siipoarlkq.exe
<Current directory>\ftmgfaleno.exe
<Current directory>\ojrxyexvdp.exe
<Current directory>\yzepzirtlp.exe
<Current directory>\efptieszzc.exe
<Current directory>\vaojbztmsb.exe
<Current directory>\tmxxdjgrlp.exe

Deletes itself.

Miscellaneous

Creates and executes the following

'<Current directory>\rxxpujwijq.exe'
'<Current directory>\gxbouqaloo.exe'
'<Current directory>\mdmauuuqdb.exe'
'<Current directory>\wtzjwqnptb.exe'
'<Current directory>\cykveupuhn.exe'
'<Current directory>\prrsqrterc.exe'
'<Current directory>\vwcwyvmjfo.exe'
'<Current directory>\zriklnzxac.exe'
'<Current directory>\lsasavhncb.exe'
'<Current directory>\iavgnwxncp.exe'
'<Current directory>\siipoarlkq.exe'
'<Current directory>\ftmgfaleno.exe'
'<Current directory>\ojrxyexvdp.exe'
'<Current directory>\yzepzirtlp.exe'
'<Current directory>\efptieszzc.exe'
'<Current directory>\vaojbztmsb.exe'
'<Current directory>\tmxxdjgrlp.exe'

Executes the following

'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Full path to file>"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\TMXXDJGRLP.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\ZRIKLNZXAC.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\GXBOUQALOO.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\MDMAUUUQDB.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\WTZJWQNPTB.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\CYKVEUPUHN.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\PRRSQRTERC.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\VWCWYVMJFO.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\JEKOCNMTDP.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\LSASAVHNCB.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\IAVGNWXNCP.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\SIIPOARLKQ.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\FTMGFALENO.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\OJRXYEXVDP.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\YZEPZIRTLP.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\EFPTIESZZC.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\RXXPUJWIJQ.exe"
'<SYSTEM32>\ping.exe' 1.1.1.1 -n 1 -w 6000
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\VAOJBZTMSB.exe"
'<SYSTEM32>\cmd.exe' /C ping 1.1.1.1 -n 1 -w 6000 > Nul & Del "<Current directory>\DYZCTJTNHL.exe"