Technical Information
To ensure autorun and distribution
Creates the following services
- [<HKLM>\System\CurrentControlSet\Services\sxpoksal] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\sxpoksal] 'ImagePath' = '<SYSTEM32>\sxpoksal\nnmsdryb.exe /d"<Full path to file>"'
- [<HKLM>\SYSTEM\CurrentControlSet\services\sxpoksal] 'ImagePath' = '<SYSTEM32>\sxpoksal\nnmsdryb.exe'
Malicious functions
Injects code into
the following system processes:
- <SYSTEM32>\svchost.exe
Modifies file system
Creates the following files
- %TEMP%\nnmsdryb.exe
- C:\documents and settings\localservice:.repos
Moves the following files
- from %TEMP%\nnmsdryb.exe to <SYSTEM32>\sxpoksal\nnmsdryb.exe
Deletes itself.
Network activity
Connects to
- 'pu####ory.bc.edu':25
- 'vk.com':443
- 'mx#.##il.icloud.com':25
- 'alt1.aspmx.l.google.com':25
- 'dc######.emirates.net.ae':25
- 'lo###.vk.com':443
- 'mx.####ght.synacor.com':25
- 'sm##.##cureserver.net':25
- 'mx.##ncaser.com':25
- 'mx#.#otmail.com':25
- 'sm##.##b.shawcable.net':25
- 'alt2.aspmx.l.google.com':25
- 'vi########er.arn03.hls.ttvnw.net':443
- 'gmail-smtp-in.l.google.com':25
- 'mx#.qq.com':25
- '69.#1.136.5':443
- 'mt##.##0.yahoodns.net':25
- 'ms#####p-mx1.hinet.net':25
- 'alt3.gmail-smtp-in.l.google.com':25
TCP
HTTP GET requests
- http://www.google.com/
- http://ap#.##-cy.ru:35000/
- http://ip##fo.io/ip
UDP
- DNS ASK mi##########m.mail.protection.outlook.com
- DNS ASK am###trade.com
- DNS ASK mx#######501.gslb.pphosted.com
- DNS ASK la#.com
- DNS ASK sm##.##b-hosting.com
- DNS ASK vk.com
- DNS ASK fo##ham.edu
- DNS ASK mx#######d01.gslb.pphosted.com
- DNS ASK po#####ssense.com.br
- DNS ASK mx.####.locaweb.com.br
- DNS ASK cl######n-01.mbs.boeing.net
- DNS ASK li#e.no
- DNS ASK co####.netwizard.com.br
- DNS ASK on####schools.org
- DNS ASK alt2.aspmx.l.google.com
- DNS ASK bo###dgroup.com
- DNS ASK us##nk.com
- DNS ASK on####ratoner.com
- DNS ASK mx.##ndex.net
- DNS ASK se###-air.com
- DNS ASK ma##.#even-air.com
- DNS ASK ss#.com
- DNS ASK ma##.ssg.com
- DNS ASK on##ave.net
- DNS ASK po########.com.mx1.fsr.rcimx.net
- DNS ASK po###oy-wa.com
- DNS ASK mx###.owm.bell.net
- DNS ASK ya###.com.sg
- DNS ASK wi######ftsfuehrerschein.at
- DNS ASK mx.###business.at
- DNS ASK sa####ailing.com
- DNS ASK bu##.#iggplus.com
- DNS ASK rh####offroad.com
- DNS ASK be##net.ca
- DNS ASK mx###.bellnet.ca
- DNS ASK ms#.com
- DNS ASK po####uality.com.br
- DNS ASK bo##ng.com
- DNS ASK vi###tron.ca
- DNS ASK mx.##deotron.ca
- DNS ASK ya##o.dk
- DNS ASK hk##ar.com
- DNS ASK im####.netvigator.com
- DNS ASK pn##.edu
- DNS ASK ha##ail.net
- DNS ASK mx#.#anmail.net
- DNS ASK ya##o.com
- DNS ASK sy###tico.ca
- DNS ASK ya##o.co.in
- DNS ASK ms#####.##c.protection.outlook.com
- DNS ASK he####chonline.com
- DNS ASK d1#####.##s.barracudanetworks.com
- DNS ASK ma##.###anfamoustours.com
- DNS ASK ba##mex.com
- DNS ASK mx##.#ail.citi.com
- DNS ASK ba####america.com
- DNS ASK mx#######c05.gslb.pphosted.com
- DNS ASK bc.edu
- DNS ASK pu####ory.bc.edu
- DNS ASK ms#.#inet.net
- DNS ASK ms#####p-mx1.hinet.net
- DNS ASK co###rweb.com
- DNS ASK connorwindows.com
- DNS ASK in#####.#ail.truedefense.com
- DNS ASK sm##.##cureserver.net
- DNS ASK in###htbb.com
- DNS ASK mx.####ght.synacor.com
- DNS ASK fu##.com
- DNS ASK co###rworld.com
- DNS ASK em###tes.net.ae
- DNS ASK dc######.emirates.net.ae
- DNS ASK ma#.com
- DNS ASK mx#.##il.icloud.com
- DNS ASK co###tate.com
- DNS ASK as#####moustours.com
- DNS ASK mx#######602.gslb.pphosted.com
- DNS ASK mx.#####.#om.cust.b.hostedemail.com
- DNS ASK ne###rkkf.com
- DNS ASK lo###.vk.com
- DNS ASK on###ance.info
- DNS ASK alt1.aspmx.l.google.com
- DNS ASK ma#l.be
- DNS ASK sm###.mail.be
- DNS ASK ya###.com.br
- DNS ASK ga##.ind.br
- DNS ASK d.##.#ipnet.com.br
- DNS ASK nw####lproducts.com
- DNS ASK mx#######c01.gslb.pphosted.com
- DNS ASK ve###ser.com
- DNS ASK mx#.qq.com
- DNS ASK pr###nmail.ch
- DNS ASK do#.com
- DNS ASK ma##.#rotonmail.ch
- DNS ASK mx######da402.pphosted.com
- DNS ASK ho###epot.com
- DNS ASK mx#######601.gslb.pphosted.com
- DNS ASK vi########er.arn03.hls.ttvnw.net
- DNS ASK gm.com
- DNS ASK mx#.#mr.gm.com
- DNS ASK qq.com
- DNS ASK ly##s.com
- DNS ASK ma##.##ter-energo.com
- DNS ASK me####ragedoors.com
- DNS ASK ya##o.fr
- DNS ASK po###red.com.br
- DNS ASK ma##.##locred.com.br
- DNS ASK alt4.gmail-smtp-in.l.google.com
- DNS ASK gr###e.co.uk
- DNS ASK mx###.##erycloudtech.com
- DNS ASK po###arage.com
- DNS ASK ma###.#ologarage.com
- DNS ASK gi#.####a-geosystems.com
- DNS ASK co###ounty.org
- DNS ASK 19#.###.#11.95.cbl.abuseat.org
- DNS ASK google.com
- DNS ASK jn##.com
- DNS ASK gr####nberger.com
- DNS ASK mx#.#ycloud.at
- DNS ASK gm##l.com
- DNS ASK gmail-smtp-in.l.google.com
- DNS ASK av##ue20.it
- DNS ASK ma#####ver.mediacity.it
- DNS ASK po##gy.net
- DNS ASK ma##.pology.net
- DNS ASK ya##o.co.th
- DNS ASK mx#####.#ail.gm0.yahoodns.net
- DNS ASK mx#.#ail.qq.com
- DNS ASK fo##ail.com
- DNS ASK mx##.#aramail.com
- DNS ASK de##i.lt
- DNS ASK 19#.###.#11.95.dnsbl.sorbs.net
- DNS ASK 19#.###.#11.95.bl.spamcop.net
- DNS ASK mx##.delfi.lt
- DNS ASK mx#.#otmail.com
- DNS ASK alt3.gmail-smtp-in.l.google.com
- DNS ASK 19#.###.#11.95.zen.spamhaus.org
- DNS ASK mt##.##0.yahoodns.net
- DNS ASK 19#.###.##1.95.sbl-xbl.spamhaus.org
- DNS ASK cl####casino.com
- DNS ASK d1######.#ss.barracudanetworks.com
- DNS ASK po#####oproductions.com
- DNS ASK plus.google.com
- DNS ASK aspmx.l.google.com
- DNS ASK ya###.com.ar
- DNS ASK alt1.gmail-smtp-in.l.google.com
- DNS ASK po##illo.be
- DNS ASK ma##.#ortillo.be
- DNS ASK at#.#oeing.com
- DNS ASK ph######n-01.mbs.boeing.net
- DNS ASK ca###ail.com
- DNS ASK 19#.###.211.95.in-addr.arpa
- DNS ASK mx#.##ailsrvr.com
- DNS ASK ya##o.ca
- DNS ASK qs###5.pair.com
- DNS ASK ma##.##upomaestre.com
- DNS ASK ve##zon.net
- DNS ASK mx####.##il.gm0.yahoodns.net
- DNS ASK po###-paul.de
- DNS ASK mx#.##wer-paul.de
- DNS ASK cs##ve.net
- DNS ASK mx#.#ianet.ca
- DNS ASK sh#w.ca
- DNS ASK sm##.##b.shawcable.net
- DNS ASK da#####joelma.com.br
- DNS ASK po###paxuk.com
- DNS ASK gr####aestre.com
- DNS ASK gl####naust.com.au
- DNS ASK mx###.##il.am0.yahoodns.net
- DNS ASK de######oseussonhos.com.br
- DNS ASK li#e.de
- DNS ASK eu#.###.#rotection.outlook.com
- DNS ASK ma#l.ru
- DNS ASK mx#.mail.ru
- DNS ASK nu####edical.com.br
- DNS ASK mx.####imedical.com.br
- DNS ASK ea##link.ca
- DNS ASK sm##.###a.secureserver.net
- DNS ASK sp######.activeit.solutions
- DNS ASK mx.##ncaser.com
- DNS ASK mt#.net
- DNS ASK ho##ail.com
- DNS ASK ba######a.northern911.com
- DNS ASK po#####rtners-inc.com
- DNS ASK mx#######401.gslb.pphosted.com
- DNS ASK alt2.gmail-smtp-in.l.google.com
- DNS ASK sh#####ndustries.com
- DNS ASK ge###mar.com
- DNS ASK mx.####ndecorreo.com
- DNS ASK po#####rtnersllc.com
- DNS ASK mx#######102.gslb.pphosted.com
- DNS ASK mx.##mts.net
- DNS ASK sm####.eastlink.ca
- DNS ASK ca#####kadvantage.ca
- DNS ASK ho#########.olc.protection.outlook.com
- DNS ASK ve###nlaw.com
- DNS ASK ap#.#r-cy.ru
- DNS ASK ve#######.##m.pri-mx.na0104.smtproutes.com
- DNS ASK ge###tco.com
- DNS ASK mx.####iciodecorreo.es
- DNS ASK ms##.hinet.net
- DNS ASK ms#####p-mx2.hinet.net
- DNS ASK po#####rtners-usa.com
- DNS ASK sm###.edelkey.net
- DNS ASK hy##o.com
- '<DNS_SERVER>':53
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\sxpoksal\nnmsdryb.exe' /d"<Full path to file>"
- '<SYSTEM32>\cmd.exe' /C mkdir <SYSTEM32>\sxpoksal\' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C move /Y "%TEMP%\nnmsdryb.exe" <SYSTEM32>\sxpoksal\' (with hidden window)
- '<SYSTEM32>\sc.exe' create sxpoksal binPath= "<SYSTEM32>\sxpoksal\nnmsdryb.exe /d\"<Full path to file>\"" type= own start= auto DisplayName= "wifi support"' (with hidden window)
- '<SYSTEM32>\sc.exe' description sxpoksal "wifi internet conection"' (with hidden window)
- '<SYSTEM32>\sc.exe' start sxpoksal' (with hidden window)
Executes the following
- '<SYSTEM32>\cmd.exe' /C mkdir <SYSTEM32>\sxpoksal\
- '<SYSTEM32>\cmd.exe' /C move /Y "%TEMP%\nnmsdryb.exe" <SYSTEM32>\sxpoksal\
- '<SYSTEM32>\sc.exe' create sxpoksal binPath= "<SYSTEM32>\sxpoksal\nnmsdryb.exe /d\"<Full path to file>\"" type= own start= auto DisplayName= "wifi support"
- '<SYSTEM32>\sc.exe' description sxpoksal "wifi internet conection"
- '<SYSTEM32>\sc.exe' start sxpoksal
- '<SYSTEM32>\svchost.exe'
