Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'Problem Config Initiator Wired Port TP' = 'C:\dyqikqsyzn\ubijujhaqx.exe'
Creates the following services:
- [<HKLM>\SYSTEM\ControlSet001\Services\Color WWAN Configuration] 'ImagePath' = 'C:\dyqikqsyzn\ubijujhaqx.exe'
- [<HKLM>\SYSTEM\ControlSet001\Services\Color WWAN Configuration] 'Start' = '00000002'
Malicious functions:
Executes the following:
- 'C:\dyqikqsyzn\kwbanzvhbp.exe' "c:\dyqikqsyzn\ubijujhaqx.exe"
- 'C:\dyqikqsyzn\ubijujhaqx.exe'
- 'C:\dyqikqsyzn\ql2z7tkcddxzwodftxg.exe'
Modifies file system:
Creates the following files:
- C:\dyqikqsyzn\ubijujhaqx.exe
- C:\dyqikqsyzn\kwbanzvhbp.exe
- C:\dyqikqsyzn\egmnaysxcfle
- %WINDIR%\dyqikqsyzn\iqgs0b
- C:\dyqikqsyzn\iqgs0b
- C:\dyqikqsyzn\ql2z7tkcddxzwodftxg.exe
Sets the 'hidden' attribute to the following files:
- C:\dyqikqsyzn\kwbanzvhbp.exe
- C:\dyqikqsyzn\ubijujhaqx.exe
Deletes the following files:
- C:\dyqikqsyzn\ql2z7tkcddxzwodftxg.exe
- %WINDIR%\dyqikqsyzn\iqgs0b
Network activity:
Connects to:
- '74.#5.64.25':22739
- '79.##7.196.121':45688
- '18#.#49.85.10':32097
- '72.##1.47.203':22399
- '81.##7.50.99':52074
- '22#.#1.110.45':48008
- '2.##.167.151':22437
- '18#.#55.235.72':28122
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: ''
