Technical Information
Malicious functions
Executes the following
- '<SYSTEM32>\net.exe' stop YandexService
Modifies file system
Creates the following files
- <Current directory>\comdlg32.ocx
- C:\1.txt
- <SYSTEM32>\dnsipver.txt
- <Current directory>\ys.dat
- <SYSTEM32>\yandexservice.exe
Sets the 'hidden' attribute to the following files
- <SYSTEM32>\dnsipver.txt
Deletes the following files
- C:\1.txt
Network activity
UDP
- DNS ASK ba##ash.ru
Miscellaneous
Searches for the following windows
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebcheckMonitor' WindowName: ''
Creates and executes the following
- '<SYSTEM32>\cmd.exe' /c Echo 11111> c:\1.txt' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c net stop YandexService & takeown /f "<SYSTEM32>\yandexservice.exe" & icacls "<SYSTEM32>\yandexservice.exe" /grant user:F /c' (with hidden window)
Executes the following
- '<SYSTEM32>\cmd.exe' /c Echo 11111> c:\1.txt
- '<SYSTEM32>\cmd.exe' /c net stop YandexService & takeown /f "<SYSTEM32>\yandexservice.exe" & icacls "<SYSTEM32>\yandexservice.exe" /grant user:F /c
- '<SYSTEM32>\net1.exe' stop YandexService
