Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Eupdate Helper' = '"<Current directory>\Eupdate Helper.exe"'
Modifies file system
Creates the following files
- <Current directory>\eupdate helper.exe
- %TEMP%\eupdate helper_log.txt
- %TEMP%\eup_rotate_2380.exe
- %TEMP%\eupdatehelperpro_info.txt
Deletes following files that it created itself
- %TEMP%\eup_rotate_2380.exe
Network activity
Connects to
- 'id.#yz.me':4046
- 'x1.#.lencr.org':80
- '47.##8.48.69':4044
- 'um##.#n.eset.com':443
TCP
HTTP GET requests
- http://x1.#.lencr.org/
- http://47.###.48.69:4044/eupo/info.txt via 47.##8.48.69
Other
- 'id.#yz.me':4046
- 'um##.#n.eset.com':443
UDP
- DNS ASK id.#yz.me
- DNS ASK x1.#.lencr.org
- DNS ASK um##.#n.eset.com
Miscellaneous
Creates and executes the following
- '<Current directory>\eupdate helper.exe'
- '%TEMP%\eup_rotate_2380.exe' -standby-mutate "<Current directory>\Eupdate Helper.exe" 2380
- '<Current directory>\eupdate helper.exe' -no-rotate
Executes the following
- '<SYSTEM32>\rundll32.exe' <SYSTEM32>\FirewallControlPanel.dll,ShowNotificationDialog /configure /ETOnly 0 /OnProfiles 6 /OtherAllowed 0 /OtherBlocked 0 /OtherEdgeAllowed 0 /NewBlocked 4 "<Current directory>\eupdate help...
- '<Current directory>\eupdate helper.exe' ' (with hidden window)
- '%TEMP%\eup_rotate_2380.exe' -standby-mutate "<Current directory>\Eupdate Helper.exe" 2380' (with hidden window)
- '<Current directory>\eupdate helper.exe' -no-rotate' (with hidden window)
