Technical Information
Malicious functions
Injects code into
the following system processes:
- %WINDIR%\explorer.exe
the following user processes:
- nygillei.exe
Modifies file system
Creates the following files
- %TEMP%\nsyb5a9.tmp
- %TEMP%\vwpbb3ih0bd2khadlj
- %TEMP%\rpjkrocsrx
- %TEMP%\nygillei.exe
Deletes the following files
- %TEMP%\nygillei.exe
Network activity
Connects to
- 'ov###ay.info':80
- 'qq##ai.com':80
- 'ah###ngnuo.com':80
TCP
HTTP GET requests
- http://www.ov###ay.info/guba/?LB##############################################################################################
- http://www.qq##ai.com/guba/?LB##############################################################################################
- http://www.ah###ngnuo.com/guba/?LB##############################################################################################
UDP
- DNS ASK ov###ay.info
- DNS ASK qq##ai.com
- DNS ASK ah###ngnuo.com
Miscellaneous
Creates and executes the following
- '%TEMP%\nygillei.exe' %TEMP%\rpjkrocsrx
Executes the following
- '%WINDIR%\syswow64\control.exe'
- '%WINDIR%\syswow64\cmd.exe' del "%TEMP%\nygillei.exe"
