Technical Information
Malicious functions
Injects code into
the following user processes:
- yy.exe
Modifies file system
Creates the following files
- <Full path to file>{f7bffb02-d03a-4a69-a76e-69a581a60374}
- <Current directory>\rcxc83e.tmp
- <Current directory>\yy.exe
Sets the 'hidden' attribute to the following files
- <Current directory>\yy.exe
Deletes following files that it created itself
- <Full path to file>{f7bffb02-d03a-4a69-a76e-69a581a60374}
Moves the following files
- from <Current directory>\rcxc83e.tmp to <Full path to file>{f7bffb02-d03a-4a69-a76e-69a581a60374}
Substitutes the following executable files
- <Full path to file>
Moves itself
- from <Full path to file> to %TEMP%\_@c81e.tmp
Network activity
UDP
- DNS ASK yy##l.com
- DNS ASK pi##iuwu.cn
Miscellaneous
Creates and executes the following
- '<Current directory>\yy.exe'
