Technical Information
To ensure autorun and distribution
Sets the following service settings
- [HKLM\SYSTEM\CurrentControlSet\Services\Webview Helper] 'Start' = '00000002'
- [HKLM\SYSTEM\CurrentControlSet\Services\Webview Helper] 'ImagePath' = 'cmd /c cd /d "C:\Users\Public\Videos\nYlUdukc\" && start "" "C:\Users\Public\Videos\nYlUdukc\nYlUdukc.exe"'
Creates the following services
- 'Webview Helper' cmd /c cd /d "C:\Users\Public\Videos\nYlUdukc\" && start "" "C:\Users\Public\Videos\nYlUdukc\nYlUdukc.exe"
Malicious functions
To complicate detection of its presence in the operating system,
adds antivirus exclusion:
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoP -NonI -W Hidden -Command "Add-MpPreference -ExclusionPath '%WINDIR%','%WINDIR%\Temp','%ALLUSERSPROFILE%','C:\Users','C:\Program Files (x86)','C:\' -Force"
Patches code
in dll
- nyludukc.exe process, obs-browser-page.exe module
in NTDLL dll
- weoyr.exe process, ntdll.dll module
- app.exe process, ntdll.dll module
Terminates or attempts to terminate
the following system processes:
- <SYSTEM32>\winver.exe
- <SYSTEM32>\computerdefaults.exe
- <SYSTEM32>\cmd.exe
Modifies file system
Creates the following files
- %ALLUSERSPROFILE%\fijmmfg7h9mc0pyk\readme.md
- %ALLUSERSPROFILE%\fijmmfg7h9mc0pyk\web.dat
- %ALLUSERSPROFILE%\fijmmfg7h9mc0pyk\view.dat
- %ALLUSERSPROFILE%\fijmmfg7h9mc0pyk\app.exe._
- %ALLUSERSPROFILE%\fijmmfg7h9mc0pyk\app.exe
- %ALLUSERSPROFILE%\fijmmfg7h9mc0pyk\view.conf
- C:\users\public\videos\hcnxcifb
- C:\users\public\videos\nyludukc\readme.md
- C:\users\public\videos\nyludukc\view.conf
- %ALLUSERSPROFILE%\view.conf
- C:\users\public\videos\nyludukc\1059.exe
- C:\users\public\videos\nyludukc\faq.md
- C:\users\public\videos\nyludukc\libcef.dll
- C:\users\public\videos\nyludukc\license.md
- %WINDIR%\temp\~pp92ca.tmp
- %WINDIR%\temp\~pp9319.tmp
Deletes following files that it created itself
- C:\users\public\videos\hcnxcifb
- %ALLUSERSPROFILE%\fijmmfg7h9mc0pyk\app.exe._
- %ALLUSERSPROFILE%\fijmmfg7h9mc0pyk\view.dat
- %ALLUSERSPROFILE%\fijmmfg7h9mc0pyk\web.dat
- %ALLUSERSPROFILE%\fijmmfg7h9mc0pyk\readme.md
- %ALLUSERSPROFILE%\fijmmfg7h9mc0pyk\view.conf
- %WINDIR%\temp\~pp92ca.tmp
- %WINDIR%\temp\~pp9319.tmp
Moves the following files
- from C:\users\public\videos\nyludukc\1059.exe to C:\users\public\videos\nyludukc\nyludukc.exe
- from %ALLUSERSPROFILE%\fijmmfg7h9mc0pyk\app.exe to \:dsl
Network activity
Connects to
- '19#.#63.169.41':30077
Miscellaneous
Creates and executes the following
- '%ALLUSERSPROFILE%\fijmmfg7h9mc0pyk\app.exe'
- 'C:\users\public\videos\nyludukc\nyludukc.exe'
Executes the following
- '<SYSTEM32>\winver.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoP -NonI -W Hidden -Command "try {$null = icim MSFT_MpPreference @{ExclusionPath = @('C:\','C:\Users','%WINDIR%\Temp','%WINDIR%','%ALLUSERSPROFILE%','C:\Program Files (x86)'); Force = $True} ...
- '<SYSTEM32>\cmd.exe' /c cd /d "C:\Users\Public\Videos\nYlUdukc\" && start "" "C:\Users\Public\Videos\nYlUdukc\nYlUdukc.exe"
- '<SYSTEM32>\winver.exe' ' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoP -NonI -W Hidden -Command "try {$null = icim MSFT_MpPreference @{ExclusionPath = @('C:\','C:\Users','%WINDIR%\Temp','%WINDIR%','%ALLUSERSPROFILE%','C:\Program Files (x86)'); Force = $True} ...' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -NoP -NonI -W Hidden -Command "Add-MpPreference -ExclusionPath '%WINDIR%','%WINDIR%\Temp','%ALLUSERSPROFILE%','C:\Users','C:\Program Files (x86)','C:\' -Force"' (with hidden window)
