Technical Information
Malicious functions
Executes the following (exploit)
- '<SYSTEM32>\rundll32.exe' %PROGRAMDATA%\YVPheBX.dll,DllRegisterServer
Injects code into
the following system processes:
- %WINDIR%\syswow64\msiexec.exe
Modifies file system
Creates the following files
- %PROGRAMDATA%\yvphebx.dll
- %APPDATA%\elkeq\irec.dll
Network activity
TCP
HTTP GET requests
- http://wm######xxbcxmucxmlc.com/files/april15.dll
- http://www.sn######hflwgthqismb.com/post.php
HTTP POST requests
- http://wm######xxbcxmucxmlc.com/post.php
- http://oj######lftfkkuxxiqd.com/post.php
- http://pw######tsshkoibaake.com/post.php
- http://sn######hflwgthqismb.com/post.php
UDP
- DNS ASK wm######xxbcxmucxmlc.com
- DNS ASK oj######lftfkkuxxiqd.com
- DNS ASK pw######tsshkoibaake.com
- DNS ASK sn######hflwgthqismb.com
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\rundll32.exe' %PROGRAMDATA%\YVPheBX.dll,DllRegisterServer' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\msiexec.exe'
