Technical Information
Malicious functions
Injects code into
the following user processes:
- regsvcs.exe
Modifies file system
Creates the following files
- %TEMP%\54165055\lhjd.bin
- %TEMP%\54165055\txsuuknc.txt
- %TEMP%\54165055\ftdilla.xl
- %TEMP%\54165055\wsuxfa.cpl
- %TEMP%\54165055\kuqgclj.xls
- %TEMP%\54165055\fwrwmkraiq.txt
- %TEMP%\54165055\rwptijqevd.mp3
- %TEMP%\54165055\mhci.xl
- %TEMP%\54165055\rkprni.docx
- %TEMP%\54165055\aiqpoqcha.ico
- %TEMP%\54165055\hadtvnqit.exe
- %TEMP%\54165055\fltt.dat
- %TEMP%\54165055\gashm.xls
- %TEMP%\54165055\ottvqpwn.dll
- %TEMP%\54165055\aigup.pdf
- %TEMP%\54165055\cmdnommruc.xl
- %TEMP%\54165055\bwxw.docx
- %TEMP%\54165055\tqlrdpuda.cpl
- %TEMP%\54165055\gpeeafrblc.dll
- %HOMEPATH%\temp\lhjd.bin
- %TEMP%\54165055\ufflnnfi.msc
- %TEMP%\54165055\iwdigff.mp3
- %TEMP%\54165055\kqpxecwpec.dat
- %TEMP%\54165055\knvgcwqam.ini
- %TEMP%\54165055\ebcua.ico
- %TEMP%\54165055\cgnmj.docx
- %TEMP%\54165055\jbovm.msc
- %TEMP%\54165055\xvscqagnsr.xls
- %TEMP%\54165055\astdl.xl
- %TEMP%\54165055\kvnmrd.msc
- %TEMP%\54165055\kewp.bin
- %TEMP%\54165055\keplol.dat
- %TEMP%\54165055\nseq.log
- %TEMP%\54165055\qhufhdp.exe
- %TEMP%\54165055\tmqthna.xl
- %TEMP%\54165055\llofl.xml
- %TEMP%\54165055\otwjvlt.jpg
- %TEMP%\54165055\wtmfq.ppt
- %TEMP%\54165055\qaaajifkjf.xls
- %TEMP%\54165055\kflwqmsmf.msc
- %TEMP%\54165055\kxwid.pdf
- %TEMP%\54165055\hiwrpstl.xml
- %TEMP%\54165055\agsvi.xl
- %TEMP%\54165055\onqxlaj.docx
- %TEMP%\54165055\hwig.docx
- %TEMP%\54165055\gglibuhu.docx
- %TEMP%\54165055\gowtfd.txt
- %TEMP%\regsvcs.exe
- %TEMP%\54165055\gocgo.jpg
- %TEMP%\54165055\uxdjandvc.txt
- %TEMP%\54165055\tkaltg.dat
- %TEMP%\54165055\qjvvsqe.xl
- %TEMP%\54165055\lrkatvk.ini
- %TEMP%\54165055\xsfqcb.exe
- %TEMP%\54165055\pbgwbet.vbs
- %TEMP%\54165055\ebxop.glg
- %TEMP%\54165055\rlbsfcins.bmp
- %TEMP%\54165055\dorvsfvck.txt
- %TEMP%\54165055\wkmwgeuws.xls
- %TEMP%\54165055\rnlbgr.icm
- %TEMP%\54165055\efsjlngtc.msc
- %TEMP%\54165055\xucmxj.log
- %TEMP%\54165055\odgfjcurp.bin
- %TEMP%\54165055\olfo.msc
- %TEMP%\54165055\lljflp.ini
- %TEMP%\54165055\dxvktuwkv.dll
- %TEMP%\54165055\eewlucoh.ico
- %TEMP%\54165055\phwrxe.ico
- %TEMP%\54165055\gthvqfs.jpg
- %TEMP%\54165055\qjbxw.icm
- %TEMP%\54165055\ujvxsht.xls
- %TEMP%\54165055\xdoaxutn.msc
- %TEMP%\54165055\pgjvtxjcp.ppt
- %TEMP%\54165055\mggvti.exe
- %TEMP%\54165055\oolxbdl.ico
- %TEMP%\54165055\oqsbtio.txt
- %TEMP%\54165055\jduwpu.xml
- %APPDATA%\yedcos\logs.dat
Sets the 'hidden' attribute to the following files
- %TEMP%\54165055\xsfqcb.exe
Network activity
Connects to
- '79.##4.225.79':4321
UDP
- DNS ASK ha###lcoxpw.pw
Miscellaneous
Searches for the following windows
- ClassName: 'EDIT' WindowName: ''
Creates and executes the following
- '%WINDIR%\syswow64\wscript.exe' "%TEMP%\54165055\pbgwbet.vbs"
- '%TEMP%\54165055\xsfqcb.exe' ebxop.glg
- '%TEMP%\regsvcs.exe'
