Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'ykvdGELP' = '%LOCALAPPDATA%\Microsoft Help\WpIyvxXs.exe'
- [HKLM\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Userinit' = 'userinit.exe,,%ProgramFiles(x86)%\Windows Photo Viewer\ljQvbIOk.exe'
- [HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Userinit' = '<SYSTEM32>\userinit.exe,,%ProgramFiles(x86)%\Windows Photo Viewer\ljQvbIOk.exe'
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\qdyuyznk.exe
Malicious functions
To bypass firewall, removes or modifies the following registry keys
- [HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'DisableNotifications' = '00000001'
- [HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'DoNotAllowExceptions' = '00000000'
- [HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'EnableFirewall' = '00000000'
To complicate detection of its presence in the operating system,
blocks execution of the following system utilities:
- Windows Task Manager (Taskmgr)
- Windows Firewall
- Windows Update
- Windows Security Center
- Windows Defender
blocks the following features:
- User Account Control (UAC)
- Windows Security Center
Injects code into
the following user processes:
- mlorhvbt.exe
Modifies file system
Creates the following files
- %ProgramFiles(x86)%\windows photo viewer\ljqvbiok.exe
- %LOCALAPPDATA%\microsoft help\wpiyvxxs.exe
- %TEMP%\mlorhvbt.exe
- %APPDATA%\microsoft\crypto\rsa\s-1-5-21-3691498038-2086406363-2140527554-1000\de08164e7b707cd244b842306dc7eada_0cb67e2f-dc95-45ca-8fb8-69bde8e3f814
Sets the 'hidden' attribute to the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\qdyuyznk.exe
Network activity
Connects to
- '95.##1.37.227':80
- 'ra###yguyp.com':80
- 'pl###aja.com':80
UDP
- DNS ASK ra###yguyp.com
- DNS ASK my#####xktsmozzthdv.com
- DNS ASK fu###rarji.com
- DNS ASK in####kegoyapgv.com
- DNS ASK ll###zza.com
- DNS ASK ml####mhnngwgh.com
- DNS ASK wy####dttczd.com
- DNS ASK hp######eomjaxywwelr.com
- DNS ASK zr###zjhse.com
- DNS ASK wb#####xlxlcvbth.com
- DNS ASK my#####bqjnwailyyoa.com
- DNS ASK pi###edhzwt.com
- DNS ASK vl###yjd.com
- DNS ASK ns#####gybtkdukmyf.com
- DNS ASK ja#####jzqrmnepeqwd.com
- DNS ASK pl###aja.com
- DNS ASK lf###jeex.com
- DNS ASK sw####huefvl.com
- DNS ASK ft####ulfhfudds.com
- DNS ASK eb######eszzjkbhhdyh.com
- DNS ASK af####rkycbeyqm.com
- DNS ASK xn######famkcltuxkif.com
- DNS ASK xj#####jfkgkihfe.com
- DNS ASK mb###rla.com
- DNS ASK vx###foazme.com
- DNS ASK kt####iyvnidd.com
- DNS ASK js###yjcv.com
- DNS ASK wv####qwwsttp.com
- DNS ASK pi####znpssx.com
- DNS ASK gg#####reouxnhqi.com
Miscellaneous
Creates and executes the following
- '%TEMP%\mlorhvbt.exe'
Restarts the analyzed sample
