Technical Information
Malicious functions
Executes the following
- '%WINDIR%\syswow64\netsh.exe' firewall add allowedprogram "<Full path to file>" "YRCserver" ENABLE
- '%WINDIR%\syswow64\netsh.exe' firewall add allowedprogram "<Current directory>\Check.exe" "YCheck" ENABLE
- '%WINDIR%\syswow64\netsh.exe' firewall add allowedprogram "<Current directory>\vpn.exe" "YVPN" ENABLE
Searches for windows to
detect analytical utilities:
- ClassName: 'Regmonclass', WindowName: ''
- ClassName: 'Filemonclass', WindowName: ''
Modifies file system
Creates the following files
- %TEMP%\aut693d.tmp
- <Current directory>\config.ini
- %TEMP%\_data.tmp
- %TEMP%\sqlite3.exe
- %TEMP%\aut958.tmp
- <Current directory>\vpn.exe
- %TEMP%\aute830.tmp
- <Current directory>\check.exe
- %TEMP%\aute562.tmp
- %LOCALAPPDATA%\microsoft\windows\history\low\history.ie5\index.dat
- %APPDATA%\microsoft\windows\cookies\low\index.dat
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\vhziqa9m\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\jn4j9fkj\desktop.ini
- %TEMP%\aut515a.tmp
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\ku08eb65\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\index.dat
- %LOCALAPPDATA%\microsoft\windows\history\low\history.ie5\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\history\low\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\desktop.ini
- %TEMP%\modern.bmp
- %TEMP%\autdd94.tmp
- %WINDIR%\syswow64\show.dll
- %TEMP%\autdd26.tmp
- %TEMP%\1164cpknslo
- %TEMP%\autaddb.tmp
- %TEMP%\2868wdmiqwz
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\fja74ken\desktop.ini
- %TEMP%\2164aadwmsn
Sets the 'hidden' attribute to the following files
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\fja74ken\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\ku08eb65\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\jn4j9fkj\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\low\content.ie5\vhziqa9m\desktop.ini
- %LOCALAPPDATA%\microsoft\windows\history\low\history.ie5\desktop.ini
Deletes the following files
- %TEMP%\aut693d.tmp
- %TEMP%\2868wdmiqwz
- %TEMP%\autaddb.tmp
- %TEMP%\1164cpknslo
- %TEMP%\autdd26.tmp
- %TEMP%\autdd94.tmp
- %TEMP%\aute562.tmp
- %TEMP%\aute830.tmp
- %TEMP%\aut958.tmp
- %TEMP%\_data.tmp
- %TEMP%\sqlite3.exe
- %TEMP%\aut515a.tmp
- %TEMP%\2164aadwmsn
Network activity
Connects to
- 'to##k.com':80
- 'ba##u.com':443
- 'microsoft.com':80
TCP
HTTP GET requests
- http://www.to##k.com/onekey.dat
- http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt
Other
- 'ba##u.com':443
UDP
- DNS ASK to##k.com
- DNS ASK ba##u.com
- DNS ASK microsoft.com
Miscellaneous
Searches for the following windows
- ClassName: '4823-00000029' WindowName: ''
- ClassName: '18467-41' WindowName: ''
Creates and executes the following
- '<Current directory>\check.exe' /ErrorStdOut 1164
- '%TEMP%\sqlite3.exe' "data.db" .dump
- '%TEMP%\sqlite3.exe' "data.db"
- '%WINDIR%\syswow64\cmd.exe' /c netsh firewall add allowedprogram "<Full path to file>" "YRCserver" ENABLE' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c netsh firewall add allowedprogram "<Current directory>\Check.exe" "YCheck" ENABLE' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c netsh firewall add allowedprogram "<Current directory>\vpn.exe" "YVPN" ENABLE' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c %TEMP%\sqlite3.exe "data.db" .dump > "%TEMP%\_data.tmp"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c %TEMP%\sqlite3.exe "data.db" < "%TEMP%\_data.tmp"' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c netsh firewall add allowedprogram "<Full path to file>" "YRCserver" ENABLE
- '%WINDIR%\syswow64\rundll32.exe' "%WINDIR%\syswow64\WININET.dll",DispatchAPICall 1
- '%WINDIR%\syswow64\cmd.exe' /c netsh firewall add allowedprogram "<Current directory>\Check.exe" "YCheck" ENABLE
- '%WINDIR%\syswow64\cmd.exe' /c netsh firewall add allowedprogram "<Current directory>\vpn.exe" "YVPN" ENABLE
- '%WINDIR%\syswow64\cmd.exe' /c %TEMP%\sqlite3.exe "data.db" .dump > "%TEMP%\_data.tmp"
- '%WINDIR%\syswow64\cmd.exe' /c %TEMP%\sqlite3.exe "data.db" < "%TEMP%\_data.tmp"
