Technical Information
Malicious functions
To complicate detection of its presence in the operating system,
adds antivirus exclusion:
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -command "Add-MpPreference -ExclusionPath '%ProgramFiles%\cybsoftware\'"
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -command "Add-MpPreference -ExclusionPath '%ProgramFiles%\cybupdater\'"
Modifies file system
Creates the following files
- %WINDIR%\startup\dlls.zip
- %WINDIR%\startup\locales\sk.pak
- %WINDIR%\startup\locales\ru.pak
- %WINDIR%\startup\locales\ro.pak
- %WINDIR%\startup\locales\pt-pt.pak
- %WINDIR%\startup\locales\pt-br.pak
- %WINDIR%\startup\locales\pl.pak
- %WINDIR%\startup\locales\nl.pak
- %WINDIR%\startup\locales\nb.pak
- %WINDIR%\startup\locales\ms.pak
- %WINDIR%\startup\locales\mr.pak
- %WINDIR%\startup\locales\ml.pak
- %WINDIR%\startup\locales\lv.pak
- %WINDIR%\startup\locales\lt.pak
- %WINDIR%\startup\locales\ko.pak
- %WINDIR%\startup\locales\kn.pak
- %WINDIR%\startup\locales\sl.pak
- %WINDIR%\startup\locales\sr.pak
- %WINDIR%\startup\locales\sv.pak
- %WINDIR%\startup\locales\sw.pak
- %ProgramFiles%\cybsoftware\godlike_packages.zip
- %WINDIR%\startup\vulkan-1.dll
- %WINDIR%\startup\vk_swiftshader_icd.json
- %WINDIR%\startup\vk_swiftshader.dll
- %WINDIR%\startup\v8_context_snapshot.bin
- %WINDIR%\startup\snapshot_blob.bin
- %WINDIR%\startup\resources.pak
- %WINDIR%\startup\locales\zh-cn.pak
- %WINDIR%\startup\locales\zh-tw.pak
- %WINDIR%\startup\locales\vi.pak
- %WINDIR%\startup\locales\ur.pak
- %WINDIR%\startup\locales\uk.pak
- %WINDIR%\startup\locales\tr.pak
- %WINDIR%\startup\locales\th.pak
- %WINDIR%\startup\locales\te.pak
- %WINDIR%\startup\locales\ta.pak
- %ProgramFiles%\cybsoftware\cybsoftware.exe
- %WINDIR%\startup\locales\ja.pak
- %WINDIR%\startup\locales\it.pak
- %WINDIR%\startup\locales\id.pak
- %WINDIR%\startup\locales\ar.pak
- %WINDIR%\startup\locales\am.pak
- %WINDIR%\startup\locales\af.pak
- %WINDIR%\startup\libcef.lib
- %WINDIR%\startup\libcef.dll
- %WINDIR%\startup\libglesv2.dll
- %WINDIR%\startup\libegl.dll
- %WINDIR%\startup\icudtl.dat
- %WINDIR%\startup\d3dcompiler_47.dll
- %WINDIR%\startup\chrome_elf.dll
- %WINDIR%\startup\chrome_200_percent.pak
- %WINDIR%\startup\chrome_100_percent.pak
- %WINDIR%\startup\starter2.bat
- %WINDIR%\startup\starter.bat
- %WINDIR%\startup\startup.vbs
- %WINDIR%\startup\locales\bg.pak
- %WINDIR%\startup\locales\bn.pak
- %WINDIR%\startup\locales\ca.pak
- %WINDIR%\startup\locales\cs.pak
- %WINDIR%\startup\locales\hr.pak
- %WINDIR%\startup\locales\hi.pak
- %WINDIR%\startup\locales\he.pak
- %WINDIR%\startup\locales\gu.pak
- %WINDIR%\startup\locales\fr.pak
- %WINDIR%\startup\locales\fil.pak
- %WINDIR%\startup\locales\fi.pak
- %WINDIR%\startup\locales\et.pak
- %WINDIR%\startup\locales\fa.pak
- %WINDIR%\startup\locales\es.pak
- %WINDIR%\startup\locales\es-419.pak
- %WINDIR%\startup\locales\en-us.pak
- %WINDIR%\startup\locales\en-gb.pak
- %WINDIR%\startup\locales\el.pak
- %WINDIR%\startup\locales\de.pak
- %WINDIR%\startup\locales\da.pak
- %WINDIR%\startup\locales\hu.pak
- nul
Deletes the following files
- %WINDIR%\startup\dlls.zip
- %ProgramFiles%\cybsoftware\godlike_packages.zip
Network activity
Connects to
- 'cl##.#ybsoft.tech':80
TCP
HTTP GET requests
- http://cl##.#ybsoft.tech/install/download/dlls.zip
- http://cl##.#ybsoft.tech/install/download/godlike_packages.zip
HTTP POST requests
- http://cl##.#ybsoft.tech/install/check_license.php/
UDP
- DNS ASK cl##.#ybsoft.tech
Miscellaneous
Creates and executes the following
- '%WINDIR%\syswow64\wscript.exe' "%WINDIR%\StartUP\StartUp.vbs"
- '%ProgramFiles%\cybsoftware\cybsoftware.exe'
- '%ProgramFiles%\cybsoftware\cybsoftware.exe' --type=gpu-process --no-sandbox --log-severity=disable --lang=en-US --user-data-dir="%LOCALAPPDATA%\CEF\User Data" --gpu-preferences=UAAAAAAAAADgACAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAA...
- '%ProgramFiles%\cybsoftware\cybsoftware.exe' --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --log-severity=disable --lang=en-US --user-data-dir="%LOCALAPPDATA%\CEF\User...
- '%ProgramFiles%\cybsoftware\cybsoftware.exe' --type=renderer --log-severity=disable --user-data-dir="%LOCALAPPDATA%\CEF\User Data" --no-sandbox --log-file="%ProgramFiles%\cybsoftware\debug.log" --disable-gpu-compositing --lang=en-US --dev...
- '%WINDIR%\syswow64\cmd.exe' /C powershell -command "Add-MpPreference -ExclusionPath '%ProgramFiles%\cybsoftware\'"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C powershell -command "Add-MpPreference -ExclusionPath '%ProgramFiles%\cybupdater\'"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c ""%WINDIR%\StartUP\Starter.bat" "' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C move /y c:\users\public\desktop\*.lnk %HOMEPATH%\desktop\' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C move /y c:\users\public\desktop\*.url %HOMEPATH%\desktop\' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /C powershell -command "Add-MpPreference -ExclusionPath '%ProgramFiles%\cybsoftware\'"
- '%WINDIR%\syswow64\cmd.exe' /C powershell -command "Add-MpPreference -ExclusionPath '%ProgramFiles%\cybupdater\'"
- '%WINDIR%\syswow64\cmd.exe' /c ""%WINDIR%\StartUP\Starter2.bat" "
- '%WINDIR%\syswow64\cmd.exe' /c ""%WINDIR%\StartUP\Starter.bat" "
- '%WINDIR%\syswow64\tasklist.exe' /fi "IMAGENAME eq CybSoftware.exe"
- '%WINDIR%\syswow64\find.exe' "CybSoftware.exe"
- '%WINDIR%\syswow64\ping.exe' 127.1 -n 6
- '%WINDIR%\syswow64\cmd.exe' /C move /y c:\users\public\desktop\*.lnk %HOMEPATH%\desktop\
- '%WINDIR%\syswow64\cmd.exe' /C move /y c:\users\public\desktop\*.url %HOMEPATH%\desktop\
