Analysis of a UDP worm

This report analyzes a malware sample that achieved persistence by copying itself to the user's AppData and adding a Winlogon registry entry, injected into explorer.exe, and communicated with multiple hardcoded C2 servers over UDP (port 14000) using an obfuscated protocol. The sample used GDI-based timing/evasion techniques to bypass heuristic sandboxing, performed a second-stage decryption and decompression of commands (including changing browser homepage), and contains functionality for USB autorun propagation, remote download-and-execute, and Firefox cookie theft.