Technical Information
Malicious functions
Patches code
in dll
- utrrqs.exe process, GDI32.dll module
- utrrqs.exe process, USER32.dll module
- utrrqs.exe process, apphelp.dll module
- utrrqs.exe process, win32u.dll module
Modifies file system
Creates the following files
- <Current directory>\skinh_el.dll
- <Current directory>\works.bat
Sets the 'hidden' attribute to the following files
- <Current directory>\skinh_el.dll
Deletes following files that it created itself
- <Current directory>\works.bat
Network activity
Connects to
- 'hr##gs.com':80
- 'localhost':80
TCP
HTTP GET requests
- http://www.hr##gs.com/tj
- http://ww#.#rcygs.com/
UDP
- DNS ASK hr##gs.com
- DNS ASK ww#.#rcygs.com
- DNS ASK if####.ip138.com
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: ''
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c <Current directory>\works.bat
- '%WINDIR%\syswow64\net.exe' config workstation
- '%WINDIR%\syswow64\find.exe' "╣б╫≈╒╛╙≥"
- '%WINDIR%\syswow64\find.exe' /V "DNS"
- '%WINDIR%\syswow64\net1.exe' config workstation
- '%WINDIR%\syswow64\cmd.exe' /c <Current directory>\works.bat' (with hidden window)
