Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'YhsDtyxq' = '<LS_APPDATA>\qbbqjyra\yhsdtyxq.exe'
- [<HKLM>\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Userinit' = '<SYSTEM32>\userinit.exe,,<LS_APPDATA>\qbbqjyra\yhsdtyxq.exe'
Creates or modifies the following files
- %HOMEPATH%\start menu\programs\startup\yhsdtyxq.exe
Malicious functions
To bypass firewall, removes or modifies the following registry keys
- [<HKLM>\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'EnableFirewall' = '00000000'
- [<HKLM>\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'DoNotAllowExceptions' = '00000000'
- [<HKLM>\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'DisableNotifications' = '00000001'
To complicate detection of its presence in the operating system,
blocks execution of the following system utilities:
- Windows Update
- Windows Security Center
blocks the following features:
- User Account Control (UAC)
- Windows Security Center
Injects code into
the following system processes:
- <SYSTEM32>\svchost.exe
Modifies file system
Creates the following files
- %TEMP%\idkiblht.exe
- %TEMP%\pmrbygvo.exe
- %ALLUSERSPROFILE%\application data\gigemrit.log
- <LS_APPDATA>\shbgodes.log
- <LS_APPDATA>\qbbqjyra\yhsdtyxq.exe
Sets the 'hidden' attribute to the following files
- %HOMEPATH%\start menu\programs\startup\yhsdtyxq.exe
Network activity
UDP
- DNS ASK google.com
- DNS ASK yj####uhogysf.com
- DNS ASK tg###egcu.com
- DNS ASK er####slmbebrn.com
- DNS ASK ya##o.com
- DNS ASK ol#####vlhypjmbht.com
- DNS ASK ay####obqngj.com
- DNS ASK mo####iuvlcmbq.com
- DNS ASK dj###gfa.com
- DNS ASK pm###utwcr.com
- DNS ASK gd#####njiygogcpqsm.com
- DNS ASK xh#####vvyhrwsoqob.com
- DNS ASK ni#####hrkdmxyss.com
- DNS ASK nn#####udmvnlkgbmk.com
- DNS ASK gx#####bdjfgccqqxbw.com
- DNS ASK vx#####qluggkhrmkvn.com
- DNS ASK hg####viykfbfcj.com
- DNS ASK yt###spxd.com
- DNS ASK yg###bpikml.com
- DNS ASK qt####hvclsyn.com
- DNS ASK cv#####dvmtidjdl.com
- DNS ASK dj####gjshvb.com
- DNS ASK nr####uyfbbjqq.com
- DNS ASK xh####qwjtnbgi.com
- DNS ASK uu####cmxjsp.com
- DNS ASK mw###fhxw.com
- DNS ASK tx#####lwwhoqanvi.com
- DNS ASK lq####pyvsnxk.com
- DNS ASK uk#####siohfgbpbl.com
- DNS ASK cd###eoenun.com
- DNS ASK jv#####usabruvvxcpd.com
- DNS ASK vg###wblb.com
- DNS ASK dr####osjmhkod.com
- DNS ASK ng###stvdun.com
- DNS ASK wp###qaynd.com
- DNS ASK sn#####eshhbfmvj.com
- DNS ASK so#####cynidwchmmmw.com
- DNS ASK bo###cxbyw.com
- DNS ASK ou#####mgseponqhb.com
- DNS ASK to###pfokxr.com
- DNS ASK bing.com
- DNS ASK ti#####vyqrpwngq.com
- DNS ASK ed#####trsgabmwn.com
- DNS ASK yg####bhstodku.com
- DNS ASK si####ideqvrck.com
- DNS ASK gv#####ltxsjfbjn.com
- DNS ASK ut###bhlmsj.com
- DNS ASK fq###tenw.com
- DNS ASK wo####rdehxng.com
- DNS ASK ls#####jyhycekgl.com
- DNS ASK ds#####fwwiptqafygk.com
- DNS ASK te#####reedomain.com
- DNS ASK lv####awohdcj.com
- DNS ASK qs####thqlxhajh.com
Miscellaneous
Creates and executes the following
- '%TEMP%\idkiblht.exe'
Executes the following
- '<SYSTEM32>\svchost.exe'
