Technical Information
Malicious functions
Registers BHO
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7E12DC5C-89B4-360C-89E0-A593520423DB}]
Modifies file system
Creates the following files
- %TEMP%\00294823\z2qcjz.dat
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\igeclhpdiimodmaoneabohjkobfobdbg\1.0\manifest.json
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\igeclhpdiimodmaoneabohjkobfobdbg\1.0\sqlite.js
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\igeclhpdiimodmaoneabohjkobfobdbg\1.0\y85l3rf.js
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\staged\yusbejffm@p-sodr.co.uk\bootstrap.js
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\staged\yusbejffm@p-sodr.co.uk\chrome.manifest
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\staged\yusbejffm@p-sodr.co.uk\content\bg.js
- %ProgramFiles(x86)%\youtubeadblocker\b0hbk.dll
- %TEMP%\00294823\yusbejffm@p-sodr.co.uk\bootstrap.js
- %ProgramFiles(x86)%\youtubeadblocker\b0hbk.tlb
- %ProgramFiles(x86)%\youtubeadblocker\b0hbk.dat
- %LOCALAPPDATA%low\{7e12dc5c-89b4-360c-89e0-a593520423db}\youtubeadblocker.2.6.dat
- %ProgramFiles(x86)%\youtubeadblocker\b0hbk.x64.dll
- %LOCALAPPDATA%\packages\windows_ie_ac_001\ac\{7e12dc5c-89b4-360c-89e0-a593520423db}\youtubeadblocker.2.6.dat
- %ALLUSERSPROFILE%\youtubeadblocker\z2qcjz.exe
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\igeclhpdiimodmaoneabohjkobfobdbg\1.0\lsdb.js
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\igeclhpdiimodmaoneabohjkobfobdbg\1.0\content.js
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\igeclhpdiimodmaoneabohjkobfobdbg\1.0\background.html
- %TEMP%\00294823\igeclhpdiimodmaoneabohjkobfobdbg\y85l3rf.js
- %TEMP%\00294823\igeclhpdiimodmaoneabohjkobfobdbg\background.html
- %TEMP%\00294823\igeclhpdiimodmaoneabohjkobfobdbg\manifest.json
- %TEMP%\00294823\igeclhpdiimodmaoneabohjkobfobdbg\sqlite.js
- %TEMP%\00294823\igeclhpdiimodmaoneabohjkobfobdbg\content.js
- %TEMP%\00294823\igeclhpdiimodmaoneabohjkobfobdbg\lsdb.js
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\staged\yusbejffm@p-sodr.co.uk\install.rdf
- %TEMP%\00294823\yusbejffm@p-sodr.co.uk\chrome.manifest
- %TEMP%\00294823\yusbejffm@p-sodr.co.uk\install.rdf
- %TEMP%\00294823\yusbejffm@p-sodr.co.uk\content\bg.js
- %TEMP%\00294823\b0hbk.dll
- %TEMP%\00294823\b0hbk.tlb
- %TEMP%\00294823\b0hbk.x64.dll
- %TEMP%\00294823\z2qcjz.exe
- %ALLUSERSPROFILE%\youtubeadblocker\z2qcjz.dat
- %ALLUSERSPROFILE%\e4895aaa4b77af59\{4820778d-ab0d-6d18-c316-52a6a0e1d507}
Deletes the following files
- %TEMP%\00294823\z2qcjz.dat
- %TEMP%\00294823\z2qcjz.exe
- %TEMP%\00294823\b0hbk.x64.dll
- %TEMP%\00294823\b0hbk.tlb
- %TEMP%\00294823\b0hbk.dll
- %TEMP%\00294823\yusbejffm@p-sodr.co.uk\content\bg.js
- %TEMP%\00294823\yusbejffm@p-sodr.co.uk\install.rdf
- %TEMP%\00294823\yusbejffm@p-sodr.co.uk\chrome.manifest
- %TEMP%\00294823\yusbejffm@p-sodr.co.uk\bootstrap.js
- %TEMP%\00294823\igeclhpdiimodmaoneabohjkobfobdbg\lsdb.js
- %TEMP%\00294823\igeclhpdiimodmaoneabohjkobfobdbg\content.js
- %TEMP%\00294823\igeclhpdiimodmaoneabohjkobfobdbg\sqlite.js
- %TEMP%\00294823\igeclhpdiimodmaoneabohjkobfobdbg\manifest.json
- %TEMP%\00294823\igeclhpdiimodmaoneabohjkobfobdbg\background.html
- %TEMP%\00294823\igeclhpdiimodmaoneabohjkobfobdbg\y85l3rf.js
Modifies the following files
- %LOCALAPPDATA%\google\chrome\user data\default\preferences
Miscellaneous
Creates and executes the following
- '%TEMP%\00294823\z2qcjz.exe'
Executes the following
- '%WINDIR%\syswow64\regsvr32.exe' /s "%ProgramFiles(x86)%\YoutubeAdblocker\B0hbK.x64.dll"
- '<SYSTEM32>\regsvr32.exe' /s "%ProgramFiles(x86)%\YoutubeAdblocker\B0hbK.x64.dll"
