Technical Information
Modifies file system
Creates the following files
- <PATH_SAMPLE>.new.part
- %LOCALAPPDATA%\microsoft\clr_v4.0\usagelogs\<File name>.exe.log
- <Current directory>\.yuri_state.json
Sets the 'hidden' attribute to the following files
- <Current directory>\.yuri_state.json
Moves the following files
- from <PATH_SAMPLE>.new.part to <PATH_SAMPLE>.new
Substitutes the following executable files
- <Full path to file>
Moves itself
- from <Full path to file> to <PATH_SAMPLE>.old
Deletes itself.
Network activity
Connects to
- 'up####.ekware.com':443
- 'yu##.ekware.com':443
- 'x1.#.lencr.org':80
TCP
HTTP GET requests
Other
- 'up####.ekware.com':443
UDP
- DNS ASK up####.ekware.com
- DNS ASK yu##.ekware.com
- DNS ASK x1.#.lencr.org
Miscellaneous
Creates and executes the following
- '<Full path to file>' --after-update
Restarts the analyzed sample
