Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\software\Wow6432Node\microsoft\windows\CurrentVersion\Run] 'yybertal.exe' = '%WINDIR%\SysWOW64\yybertal.exe'
Modifies file system
Creates the following files
- %WINDIR%\syswow64\yybertal.exe
- %WINDIR%\syswow64\leihen.exe
- %LOCALAPPDATA%\microsoft\internet explorer\domstore\w37zlxnl\www.yy[1].xml
Modifies the following files
Substitutes the following files
- %APPDATA%\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\settings.sol
Network activity
Connects to
- 'hi.##idu.com':80
- 'in####ow.baidu.com':443
- 'aq.#y.com':443
- 'lg#.yy.com':443
- 'fi##.##emebed.yy.com':80
- 'oc##.dcocsp.cn':80
- 'we#.##static.com':443
- 'we#.##static.com':80
- 'we##.#ystatic.com':443
- 'hd##.bigda.com':443
- 'hm.##idu.com':443
- 'cd#.#igda.com':443
TCP
HTTP GET requests
- http://fi##.##emebed.yy.com/channel/?cu##########
- http://oc##.dcocsp.cn/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHv1Dj%2BciPJEWH5JNtwL5Y07mRqwQUxBF%2BiECGwkG%2FZfMa4bRTQKOr7H0CEAazeQNdMUy43GisOeZFKho%3D
- http://oc##.dcocsp.cn/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAoEcNCWvIoSyJCm34Ju7Es%3D
- http://oc##.dcocsp.cn/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSmVYFXwi%2FRq9wx3PKhB8lC%2FFYUyAQUkZ9eMRWuEJ%2BtYMH3wcyqSDQvDCYCEAGgn4WFmB1OXBcN0AZmOac%3D
- http://oc##.dcocsp.cn/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSmVYFXwi%2FRq9wx3PKhB8lC%2FFYUyAQUkZ9eMRWuEJ%2BtYMH3wcyqSDQvDCYCEAokxs4T1DBNvLkP3RHex1I%3D
- http://oc##.dcocsp.cn/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSmVYFXwi%2FRq9wx3PKhB8lC%2FFYUyAQUkZ9eMRWuEJ%2BtYMH3wcyqSDQvDCYCEAisHD%2BWkjyavUxRe2%2FTTWY%3D
- http://oc##.dcocsp.cn/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSmVYFXwi%2FRq9wx3PKhB8lC%2FFYUyAQUkZ9eMRWuEJ%2BtYMH3wcyqSDQvDCYCEAnvpx8JMd2YI%2FLj0tm2%2BJA%3D
- http://oc##.dcocsp.cn/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSmVYFXwi%2FRq9wx3PKhB8lC%2FFYUyAQUkZ9eMRWuEJ%2BtYMH3wcyqSDQvDCYCEA4bFhVFH%2BXQ03AE8Rd9TYo%3D
Other
- 'hi.##idu.com':443
- 'aq.#y.com':443
- 'yy.com':443
- 'em###.bs2cdn.yy.com':443
- 'oc##.dcocsp.cn':443
- 'zo####n.bs2.yy.com':443
- 'em###.bs2dl.yy.com':443
- 'hm.##idu.com':443
UDP
- DNS ASK hi.##idu.com
- DNS ASK in####ow.baidu.com
- DNS ASK aq.#y.com
- DNS ASK lg#.yy.com
- DNS ASK fi##.##emebed.yy.com
- DNS ASK yy.com
- DNS ASK oc##.dcocsp.cn
- DNS ASK we#.##static.com
- DNS ASK em###.bs2cdn.yy.com
- DNS ASK zo#####.bs2dl.yy.com
- DNS ASK zo####n.bs2.yy.com
- DNS ASK em###.bs2dl.yy.com
- DNS ASK we##.#ystatic.com
- DNS ASK hd##.bigda.com
- DNS ASK hm.##idu.com
- DNS ASK cd#.#igda.com
Miscellaneous
Searches for the following windows
- ClassName: 'Static' WindowName: 'Г—ГЁГ–В№'
- ClassName: 'Edit' WindowName: ''
- ClassName: 'Button' WindowName: 'ɾ³ý'
- ClassName: 'Button' WindowName: ''
- ClassName: 'Static' WindowName: ''
- ClassName: '' WindowName: ''
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
Creates and executes the following
- '%WINDIR%\syswow64\yybertal.exe'
- '%WINDIR%\syswow64\leihen.exe'
