Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'ixezinaz' = '"%WINDIR%\ydakagep.exe"'
Malicious functions:
Executes the following:
- '<SYSTEM32>\vssadmin.exe' Delete Shadows /All /Quiet
- '%WINDIR%\explorer.exe'
Injects code into
the following system processes:
- %WINDIR%\explorer.exe
Searches for registry branches where third party applications store passwords:
- [<HKCU>\Software\Microsoft\Internet Account Manager]
- [<HKCU>\Software\Microsoft\Internet Account Manager\Accounts]
Modifies file system :
Creates the following files:
- %ALLUSERSPROFILE%\Application Data\aryxehenyxyrynuf\02000000
- %ALLUSERSPROFILE%\Application Data\aryxehenyxyrynuf\00000000
- %ALLUSERSPROFILE%\Application Data\aryxehenyxyrynuf\01000000
- %WINDIR%\ydakagep.exe
Network activity:
Connects to:
- 'il#####pil.tyxolwec.net':443
- 'aj#####h.tyxolwec.net':443
- 'yw######llu.tyxolwec.net':443
- 'el##.#yxolwec.net':443
- 'lg######aju.tyxolwec.net':443
- 'ih#####qa.tyxolwec.net':443
- 'ob###.tyxolwec.net':443
- 'ab###.tyxolwec.net':443
- 'eh#####kin.tyxolwec.net':443
- 'uk###.tyxolwec.net':443
- 'jh#####pug.tyxolwec.net':443
- 'aj##.#yxolwec.net':443
- 'us####.tyxolwec.net':443
- 'ab####.tyxolwec.net':443
- 'ul#####xi.tyxolwec.net':443
- 'oc#####zof.tyxolwec.net':443
- 'ys#####.tyxolwec.net':443
- 'eg#####ziw.tyxolwec.net':443
- 'er####.tyxolwec.net':443
- 'ys##.#yxolwec.net':443
- 'od####.tyxolwec.net':443
- 'ex####.tyxolwec.net':443
- 'uf##.#yxolwec.net':443
- 'pm######iqy.tyxolwec.net':443
- 'sr##.#yxolwec.net':443
- 'up######eno.tyxolwec.net':443
- 'nm####.tyxolwec.net':443
- 'ek####.tyxolwec.net':443
- 'ut#####qij.tyxolwec.net':443
- 'yx#####lab.tyxolwec.net':443
UDP:
- DNS ASK il#####pil.tyxolwec.net
- DNS ASK aj#####h.tyxolwec.net
- DNS ASK yw######llu.tyxolwec.net
- DNS ASK el##.#yxolwec.net
- DNS ASK lg######aju.tyxolwec.net
- DNS ASK ih#####qa.tyxolwec.net
- DNS ASK ob###.tyxolwec.net
- DNS ASK ab###.tyxolwec.net
- DNS ASK eh#####kin.tyxolwec.net
- DNS ASK uk###.tyxolwec.net
- DNS ASK jh#####pug.tyxolwec.net
- DNS ASK aj##.#yxolwec.net
- DNS ASK us####.tyxolwec.net
- DNS ASK ab####.tyxolwec.net
- DNS ASK ul#####xi.tyxolwec.net
- DNS ASK oc#####zof.tyxolwec.net
- DNS ASK ys#####.tyxolwec.net
- DNS ASK eg#####ziw.tyxolwec.net
- DNS ASK er####.tyxolwec.net
- DNS ASK ys##.#yxolwec.net
- DNS ASK od####.tyxolwec.net
- DNS ASK ex####.tyxolwec.net
- DNS ASK uf##.#yxolwec.net
- DNS ASK pm######iqy.tyxolwec.net
- DNS ASK sr##.#yxolwec.net
- DNS ASK up######eno.tyxolwec.net
- DNS ASK nm####.tyxolwec.net
- DNS ASK ek####.tyxolwec.net
- DNS ASK ut#####qij.tyxolwec.net
- DNS ASK yx#####lab.tyxolwec.net
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: ''
