Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'svchost' = '%APPDATA%\svchost'
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\svchost.lnk
Malicious functions
Searches for windows to
detect analytical utilities:
- ClassName: 'OLLYDBG', WindowName: ''
Modifies file system
Creates the following files
- %TEMP%\ldplayer9_ru_1007_ld.exe
- %TEMP%\xclient(2)_protected.exe
- %APPDATA%\lddownloader\lddownloader.log
- %APPDATA%\svchost
Network activity
Connects to
- 'en###.ldmnq.com':443
- 'go#####a###ytics.com':80
- 'ip##pi.com':80
TCP
HTTP GET requests
- http://www.go#####a###ytics.com/collect?v=#############################################################################################################
- http://ip##pi.com/line/?fi############
Other
- 'en###.ldmnq.com':443
UDP
- DNS ASK en###.ldmnq.com
- DNS ASK go#####a###ytics.com
- DNS ASK ip##pi.com
Miscellaneous
Creates and executes the following
- '%TEMP%\ldplayer9_ru_1007_ld.exe'
- '%TEMP%\xclient(2)_protected.exe'
