Technical Information
Malicious functions:
To bypass firewall, removes or modifies the following registry keys:
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile] 'EnableFirewall' = '00000000'
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile] 'DoNotAllowExceptions' = '00000000'
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile] 'DisableNotifications' = '00000001'
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'EnableFirewall' = '00000000'
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'DoNotAllowExceptions' = '00000000'
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'DisableNotifications' = '00000001'
To complicate detection of its presence in the operating system,
blocks execution of the following system utilities:
- Windows Update
blocks the following features:
- Windows Security Center
Creates and executes the following:
- '<LS_APPDATA>\ydc.exe' -gav <Full path to file>
Modifies file system:
Creates the following files:
- <LS_APPDATA>\16aal08pv0rmvkk0rmfp67osul5l5o
- %TEMP%\cmk6.tmp
- %ALLUSERSPROFILE%\Application Data\16aal08pv0rmvkk0rmfp67osul5l5o
- %HOMEPATH%\Templates\16aal08pv0rmvkk0rmfp67osul5l5o
- %TEMP%\16aal08pv0rmvkk0rmfp67osul5l5o
- %TEMP%\cdi5.tmp
- %TEMP%\cdi2.tmp
- %TEMP%\cmk1.tmp
- %TEMP%\cmk3.tmp
- %TEMP%\cmk4.tmp
- <LS_APPDATA>\ydc.exe
Deletes the following files:
- %TEMP%\cmk4.tmp
- %TEMP%\cdi5.tmp
- %TEMP%\cmk6.tmp
- %TEMP%\cmk1.tmp
- %TEMP%\cdi2.tmp
- %TEMP%\cmk3.tmp
Deletes itself.
Network activity:
Connects to:
- 'bi###akumuv.com':80
- 'wa####fykylic.com':80
- 'ki####zasalel.com':80
- 'qa###umopy.com':80
- 'je###itego.com':80
- 'va####tenate.com':80
- 'we###aloqad.com':80
- 'ne####vigoken.com':80
- 'de###oryr.com':80
- 'ga####nymepewo.com':80
- 'me####lecotele.com':80
- 'wy####tasulaz.com':80
- 'zi####xaboci.com':80
- 'be####rycoxeqo.com':80
- 'xa####rulysemo.com':80
- 'pe####hypivi.com':80
- 'wa###ukov.com':80
- 'ka####nucatih.com':80
- 'cy####vuzilu.com':80
- 'ky####firuqym.com':80
TCP:
HTTP GET requests:
- http://bi###akumuv.com/1007000112
- http://wa####fykylic.com/1007000112
- http://ki####zasalel.com/1007000112
- http://qa###umopy.com/1007000112
- http://je###itego.com/1007000112
- http://va####tenate.com/1007000112
- http://we###aloqad.com/1007000112
- http://ne####vigoken.com/1007000112
- http://de###oryr.com/1007000112
- http://ga####nymepewo.com/1007000112
- http://me####lecotele.com/1007000112
- http://wy####tasulaz.com/1007000112
- http://zi####xaboci.com/1007000112
- http://be####rycoxeqo.com/1007000112
- http://xa####rulysemo.com/1007000112
- http://pe####hypivi.com/1007000112
- http://wa###ukov.com/1007000112
- http://ka####nucatih.com/1007000112
- http://cy####vuzilu.com/1007000112
- http://ky####firuqym.com/1007000112
UDP:
- DNS ASK bi###akumuv.com
- DNS ASK wa####fykylic.com
- DNS ASK ki####zasalel.com
- DNS ASK qa###umopy.com
- DNS ASK je###itego.com
- DNS ASK va####tenate.com
- DNS ASK we###aloqad.com
- DNS ASK ne####vigoken.com
- DNS ASK de###oryr.com
- DNS ASK ga####nymepewo.com
- DNS ASK me####lecotele.com
- DNS ASK wy####tasulaz.com
- DNS ASK zi####xaboci.com
- DNS ASK be####rycoxeqo.com
- DNS ASK xa####rulysemo.com
- DNS ASK pe####hypivi.com
- DNS ASK wa###ukov.com
- DNS ASK ka####nucatih.com
- DNS ASK cy####vuzilu.com
- DNS ASK ky####firuqym.com
Miscellaneous:
Searches for the following windows:
- ClassName: 'cljafofdpalbac' WindowName: 'dhnppijjklmp'
