Technical Information
Malicious functions
Injects code into
the following user processes:
- yy.exe
Modifies file system
Creates the following files
- <Full path to file>{ed27f379-234e-4aa9-b1a4-b14a3bdbefe7}
- <Current directory>\rcx7780.tmp
- <Current directory>\yy.exe
Sets the 'hidden' attribute to the following files
- <Current directory>\yy.exe
Deletes the following files
- <Full path to file>{ed27f379-234e-4aa9-b1a4-b14a3bdbefe7}
Moves the following files
- from <Current directory>\rcx7780.tmp to <Full path to file>{ed27f379-234e-4aa9-b1a4-b14a3bdbefe7}
Substitutes the following executable files
- <Full path to file>
Moves itself
- from <Full path to file> to %TEMP%\_@7751.tmp
Network activity
Connects to
- 'yy##l.com':80
- 'hu###omains.com':443
TCP
HTTP GET requests
- http://yy##l.com/yyroom.txt
Other
- 'hu###omains.com':443
UDP
- DNS ASK yy##l.com
- DNS ASK hu###omains.com
- DNS ASK pi##iuwu.cn
- DNS ASK co##############e-chains.prod.autograph.services.mozaws.net
Miscellaneous
Creates and executes the following
- '<Current directory>\yy.exe'
