Technical Information
To ensure autorun and distribution
Creates the following services
- [<HKLM>\System\CurrentControlSet\Services\vrpweccl] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\vrpweccl] 'ImagePath' = '<SYSTEM32>\vrpweccl\dxzwqmwb.exe /d"<Full path to file>"'
- [<HKLM>\SYSTEM\CurrentControlSet\services\vrpweccl] 'ImagePath' = '<SYSTEM32>\vrpweccl\dxzwqmwb.exe'
Malicious functions
Injects code into
the following system processes:
- <SYSTEM32>\svchost.exe
Modifies file system
Creates the following files
- %TEMP%\dxzwqmwb.exe
- C:\documents and settings\localservice:.repos
Moves the following files
- from %TEMP%\dxzwqmwb.exe to <SYSTEM32>\vrpweccl\dxzwqmwb.exe
Deletes itself.
Network activity
Connects to
- 'in####d.smtp.vt.edu':25
- 'mx#.#bbsnet.se':25
- 'mx#.###.c3s2.iphmx.com':25
- 'li######.#lc.protection.outlook.com':25
- 'in.###.trendmicro.com':25
- 'a3#####04.direcpc.com':25
- 'ma##.##ektro-fiebig.de':25
- 'mx.##ra.co.nz':25
- 'za###########com.mail.protection.outlook.com':25
- 'mx#######701.gslb.pphosted.com':25
- 'li#.#ishyes.net':25
- 'mx######b2d01.pphosted.com':25
- 'mx####.##il.gm0.yahoodns.net':25
- 'aspmx.l.google.com':25
- 're###.kasserver.com':25
- 'go###e.co.uk':443
- 'th#########ional-com.safesysmail.com':25
- 'ma##.#rtikor.com':25
- 'pa####x.above.com':25
- 'mx#.##.smxemail.com':25
- 'el####oelement.hr':25
- 'w0#####d.kasserver.com':25
- 'a.##.#ail.vresp.com':25
- 'ho#########.olc.protection.outlook.com':25
- 'alt1.gmail-smtp-in.l.google.com':25
- 'ma#####.cytanet.com.cy':25
- 'ma#######xcite.roc2.bluetie.com':25
- 'el##########dk.mail.protection.outlook.com':25
- '14#.#6.108.92':480
- 'in####1.enkoping.se':25
TCP
HTTP GET requests
- http://www.google.com/
UDP
- DNS ASK mi##########m.mail.protection.outlook.com
- DNS ASK mx#######701.gslb.pphosted.com
- DNS ASK af##c.com
- DNS ASK aspmx.l.google.com
- DNS ASK c4###utions.net
- DNS ASK re###.kasserver.com
- DNS ASK el####o-euler.de
- DNS ASK go###e.co.uk
- DNS ASK th#########ional-com.safesysmail.com
- DNS ASK th#####tnational.com
- DNS ASK ma##.#rtikor.com
- DNS ASK el####oenerji.com
- DNS ASK pa####x.above.com
- DNS ASK br####comercial.com
- DNS ASK mx#.##.smxemail.com
- DNS ASK wi##.ac.nz
- DNS ASK el####oelement.hr
- DNS ASK w0#####d.kasserver.com
- DNS ASK el###roelch.de
- DNS ASK a.##.#ail.vresp.com
- DNS ASK ma##.vresp.com
- DNS ASK ma#######xcite.roc2.bluetie.com
- DNS ASK ex##te.com
- DNS ASK el##########dk.mail.protection.outlook.com
- DNS ASK c4#.biz
- DNS ASK ph.#bm.com
- DNS ASK mx######b2d01.pphosted.com
- DNS ASK za##d.com
- DNS ASK tv####kholm.tv4.se
- DNS ASK in####1.enkoping.se
- DNS ASK wg#.#nkoping.se
- DNS ASK at###ticargo.se
- DNS ASK w1.##syname.se
- DNS ASK nw#.se
- DNS ASK mx#.#bbsnet.se
- DNS ASK sb#s.se
- DNS ASK mx#.###.c3s2.iphmx.com
- DNS ASK go##ti.com
- DNS ASK li######.#lc.protection.outlook.com
- DNS ASK in.###.trendmicro.com
- DNS ASK li##.com
- DNS ASK ab##cbn.com
- DNS ASK a3#####04.direcpc.com
- DNS ASK di###way.com
- DNS ASK ma##.##ektro-fiebig.de
- DNS ASK el####o-fiebig.de
- DNS ASK mx.##ra.co.nz
- DNS ASK xt##.co.nz
- DNS ASK te####asaturn.co.nz
- DNS ASK za###########com.mail.protection.outlook.com
- DNS ASK za####lastic.com
- DNS ASK li#.#ishyes.net
- DNS ASK am#.#ricsson.se
- DNS ASK el###ro.dtu.dk
- DNS ASK se####.cingular.com
- DNS ASK google.com
- DNS ASK nm##.govt.nz
- DNS ASK mx.###alsonora.com
- DNS ASK ca###sonora.com
- DNS ASK alt1.gmail-smtp-in.l.google.com
- DNS ASK gm##l.com
- DNS ASK za########bound-1.mimecast.co.za
- DNS ASK mu##ob.com
- DNS ASK mx#.qq.com
- DNS ASK qq.com
- DNS ASK mx#.#anmail.net
- DNS ASK da##.net
- DNS ASK ho#########.olc.protection.outlook.com
- DNS ASK ho##ail.com
- DNS ASK eu#.###.#rotection.outlook.com
- DNS ASK 19#.###.#11.95.cbl.abuseat.org
- DNS ASK ho##ail.de
- DNS ASK mx#.##curemx.biz
- DNS ASK 19#.###.##1.95.sbl-xbl.spamhaus.org
- DNS ASK 19#.###.#11.95.zen.spamhaus.org
- DNS ASK 19#.###.#11.95.bl.spamcop.net
- DNS ASK nz##.mil.nz
- DNS ASK 19#.###.#11.95.dnsbl.sorbs.net
- DNS ASK 19#.###.211.95.in-addr.arpa
- DNS ASK gr####saflags.com
- DNS ASK ma##.#ickstel.com
- DNS ASK ub#.com
- DNS ASK mx##.#bs.open.ch
- DNS ASK ai###lindia.com
- DNS ASK in####d.smtp.vt.edu
- DNS ASK vt.edu
- DNS ASK alt2.aspmx.l.google.com
- DNS ASK sn##on.com
- DNS ASK mx.###epiand.com
- DNS ASK di###iand.com
- DNS ASK mx#.###692-74.iphmx.com
- DNS ASK in###tia.com
- DNS ASK mx####.##il.gm0.yahoodns.net
- DNS ASK ao#.com
- DNS ASK vo###one.co.nz
- DNS ASK re###.iqhive.com
- DNS ASK ma#####.cytanet.com.cy
- DNS ASK cy###et.com.cy
- DNS ASK mx######91d01.pphosted.com
- DNS ASK ci###lar.com
- DNS ASK sm##.##cureserver.net
- DNS ASK sc####monster.com
- DNS ASK ex#####.bpbb.bigpond.com
- DNS ASK bi###nd.net.au
- DNS ASK sa####highlite.com
- DNS ASK mx#######901.gslb.pphosted.com
- DNS ASK eq###ytitle.com
- DNS ASK mx##.mb1p.com
- DNS ASK gb#.sv.se
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\vrpweccl\dxzwqmwb.exe' /d"<Full path to file>"
- '<SYSTEM32>\cmd.exe' /C mkdir <SYSTEM32>\vrpweccl\' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C move /Y "%TEMP%\dxzwqmwb.exe" <SYSTEM32>\vrpweccl\' (with hidden window)
- '<SYSTEM32>\sc.exe' create vrpweccl binPath= "<SYSTEM32>\vrpweccl\dxzwqmwb.exe /d\"<Full path to file>\"" type= own start= auto DisplayName= "wifi support"' (with hidden window)
- '<SYSTEM32>\sc.exe' description vrpweccl "wifi internet conection"' (with hidden window)
- '<SYSTEM32>\sc.exe' start vrpweccl' (with hidden window)
Executes the following
- '<SYSTEM32>\cmd.exe' /C mkdir <SYSTEM32>\vrpweccl\
- '<SYSTEM32>\cmd.exe' /C move /Y "%TEMP%\dxzwqmwb.exe" <SYSTEM32>\vrpweccl\
- '<SYSTEM32>\sc.exe' create vrpweccl binPath= "<SYSTEM32>\vrpweccl\dxzwqmwb.exe /d\"<Full path to file>\"" type= own start= auto DisplayName= "wifi support"
- '<SYSTEM32>\sc.exe' description vrpweccl "wifi internet conection"
- '<SYSTEM32>\sc.exe' start vrpweccl
- '<SYSTEM32>\svchost.exe'
