Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Eupdate Helper' = '"<Current directory>\Eupdate Helper.exe"'
Modifies file system
Creates the following files
- <Current directory>\eupdate helper.exe
- %TEMP%\eupdate helper_log.txt
- %TEMP%\eup_rotate_3596.exe
Deletes following files that it created itself
- %TEMP%\eup_rotate_3596.exe
Network activity
Connects to
- '47.##8.48.69':4044
UDP
- DNS ASK id.#yz.me
Miscellaneous
Creates and executes the following
- '<Current directory>\eupdate helper.exe'
- '%TEMP%\eup_rotate_3596.exe' -standby-mutate "<Current directory>\Eupdate Helper.exe" 3596
- '<Current directory>\eupdate helper.exe' -no-rotate
Executes the following
- '<SYSTEM32>\rundll32.exe' <SYSTEM32>\FirewallControlPanel.dll,ShowNotificationDialog /configure /ETOnly 0 /OnProfiles 6 /OtherAllowed 0 /OtherBlocked 0 /OtherEdgeAllowed 0 /NewBlocked 4 "<Current directory>\eupdate help...
- '<Current directory>\eupdate helper.exe' ' (with hidden window)
- '%TEMP%\eup_rotate_3596.exe' -standby-mutate "<Current directory>\Eupdate Helper.exe" 3596' (with hidden window)
- '<Current directory>\eupdate helper.exe' -no-rotate' (with hidden window)
