Technical Information
To ensure autorun and distribution
Creates the following services
- [<HKLM>\System\CurrentControlSet\Services\jjnpeenw] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\jjnpeenw] 'ImagePath' = '<SYSTEM32>\jjnpeenw\ajbajvzq.exe /d"<Full path to file>"'
- [<HKLM>\SYSTEM\CurrentControlSet\services\jjnpeenw] 'ImagePath' = '<SYSTEM32>\jjnpeenw\ajbajvzq.exe'
Malicious functions
Injects code into
the following system processes:
- <SYSTEM32>\svchost.exe
Modifies file system
Creates the following files
- %TEMP%\ajbajvzq.exe
- C:\documents and settings\localservice:.repos
Moves the following files
- from %TEMP%\ajbajvzq.exe to <SYSTEM32>\jjnpeenw\ajbajvzq.exe
Deletes itself.
Network activity
Connects to
- 'tc###.tctc.edu':25
- 'ma#######xcite.roc2.bluetie.com':25
- 'mt##.##0.yahoodns.net':25
- 'google.com':443
- 'mx######46b01.pphosted.com':25
- 'ma#######.la-archdiocese.net':25
- 'aspmx.l.google.com':25
- 'au##########om.mail.protection.outlook.com':25
- 'gw###.fortimail.com':25
- 'mx#.##d.iphmx.com':25
- 'mx#.##ailsrvr.com':25
- 'mx###t2.uic.edu':25
- 'mx##.###lspamprotection.com':25
- 'mx##.mail.com':25
- 'mx#######b01.gslb.pphosted.com':25
TCP
HTTP GET requests
- http://www.google.com/ncr
- http://www.google.com/
UDP
- DNS ASK mi##########m.mail.protection.outlook.com
- DNS ASK ff######x-vip1.prodigy.net
- DNS ASK cr###matic.com
- DNS ASK ma##.#redomatic.com
- DNS ASK ya###.com.br
- DNS ASK ve##zon.net
- DNS ASK ho###on.rr.com
- DNS ASK cd#######tpin01.houston.rr.com
- DNS ASK in###net.com
- DNS ASK pr######.mail.invivo-group.com
- DNS ASK lo###hotels.com
- DNS ASK mx#######101.gslb.pphosted.com
- DNS ASK ho###il.co.jp
- DNS ASK ap#.###.#rotection.outlook.com
- DNS ASK ig.#om.br
- DNS ASK mx#.##.correio.biz
- DNS ASK ae##an.com
- DNS ASK ns#.#ubay.com
- DNS ASK ya##o.fr
- DNS ASK me###eller.de
- DNS ASK mx##.#spgateway.de
- DNS ASK gm#.de
- DNS ASK sl#.com
- DNS ASK mx##.#mig.gmx.net
- DNS ASK mx#######502.gslb.pphosted.com
- DNS ASK ha##ail.net
- DNS ASK mx#.#anmail.net
- DNS ASK hr##ock.com
- DNS ASK mx#.###079-83.iphmx.com
- DNS ASK greenartplumbing.com
- DNS ASK sb###obal.net
- DNS ASK bt##rk.is
- DNS ASK ju##s-ge.de
- DNS ASK ho###litics.com
- DNS ASK ya##o.de
- DNS ASK mx###.##il.am0.yahoodns.net
- DNS ASK ra####tcapsule.com
- DNS ASK us.#bm.com
- DNS ASK mx######b2d01.pphosted.com
- DNS ASK ra#####christians.com
- DNS ASK pa######axresolution.com
- DNS ASK ar#####duterroir.com
- DNS ASK fr###e-gift.com
- DNS ASK fr.#bm.com
- DNS ASK if#i.es
- DNS ASK mx.####iciodecorreo.es
- DNS ASK pe####reniesje.nl
- DNS ASK sp#######r2.pedicureniesje.nl
- DNS ASK ru##ell.com
- DNS ASK eu#######nbound-1.mimecast.com
- DNS ASK if###bgl.com
- DNS ASK mx##.schlund.de
- DNS ASK xi##ris.de
- DNS ASK if#####.fraunhofer.de
- DNS ASK as###.#x.fraunhofer.de
- DNS ASK ca###four.com
- DNS ASK ic#####andtravel.com
- DNS ASK mx####.carrierzone.com
- DNS ASK is##orp.com
- DNS ASK us#######nbound-2.mimecast.com
- DNS ASK ho###int.org.ua
- DNS ASK we#.de
- DNS ASK mx###02.web.de
- DNS ASK ga##a.cl
- DNS ASK we###ood.edu
- DNS ASK mx##.mail.com
- DNS ASK mx##.###lspamprotection.com
- DNS ASK cu#######-2.in.mailcontrol.com
- DNS ASK ha##is.com
- DNS ASK mx.##rris.com
- DNS ASK vi####health.com
- DNS ASK ma###.#idanthealth.com
- DNS ASK mo###ecc.edu
- DNS ASK ma###.monroecc.edu
- DNS ASK vi###nueva.com
- DNS ASK ma#######.la-archdiocese.net
- DNS ASK jh##.jhmi.edu
- DNS ASK sm##.##hnshopkins.edu
- DNS ASK tc##.edu
- DNS ASK tc###.tctc.edu
- DNS ASK pa###eiss.com
- DNS ASK mx######46b01.pphosted.com
- DNS ASK au###ation.com
- DNS ASK au##########om.mail.protection.outlook.com
- DNS ASK em###.smith.edu
- DNS ASK st###case.com
- DNS ASK gw###.fortimail.com
- DNS ASK ma##.umd.edu
- DNS ASK mx#.##d.iphmx.com
- DNS ASK ch#####viewhotel.co.uk
- DNS ASK ui#.edu
- DNS ASK mx###t2.uic.edu
- DNS ASK ba####ckfilms.com
- DNS ASK wi##kie.com
- DNS ASK mx#######b01.gslb.pphosted.com
- DNS ASK ma##.com
- DNS ASK nu##eco.com
- DNS ASK ho##ail.es
- DNS ASK sd#.gov.co
- DNS ASK iy###kirler.com
- DNS ASK ge##.com
- DNS ASK ri#####aext01.roche.com
- DNS ASK gb##ng.com
- DNS ASK alt1.aspmx.l.google.com
- DNS ASK se#####marushige.com
- DNS ASK li####nkfound.org
- DNS ASK ma###.#ifelinkfound.org
- DNS ASK gr.is
- DNS ASK lo###inetv.com
- DNS ASK lo########.com.mx1.virtacore.rcimx.net
- DNS ASK pa##al.com
- DNS ASK mx#.##ypalcorp.com
- DNS ASK me###usins.com
- DNS ASK go###e.com.ua
- DNS ASK mx#######e01.gslb.pphosted.com
- DNS ASK ya##o.co.uk
- DNS ASK se##n.com
- DNS ASK po##.cris.com
- DNS ASK as####xperience.com
- DNS ASK ma##.###a-experience.com
- DNS ASK sd##ts.org
- DNS ASK is#.is
- DNS ASK us.###ckpoint.com
- DNS ASK tl####.checkpoint.com
- DNS ASK eu#####-assurances.com
- DNS ASK 3m##eb.net
- DNS ASK ha#.com
- DNS ASK vi####eworld.com
- DNS ASK ri#####ter.mnscu.edu
- DNS ASK mx#.8.is
- DNS ASK se####imation.com
- DNS ASK sp###.#ail.gandi.net
- DNS ASK sr##nt.com
- DNS ASK er##t.com
- DNS ASK sm###.ercot.com
- DNS ASK ge##an.com
- DNS ASK cg###rth.com
- DNS ASK alt2.aspmx.l.google.com
- DNS ASK sv###scini.com
- DNS ASK mx#.##ailsrvr.com
- DNS ASK ea###link.net
- DNS ASK mx#.##rthlink.net
- DNS ASK ac##inc.com
- DNS ASK mx#.###88666.iphmx.com
- DNS ASK xv##ech.com
- DNS ASK wi######mountainsports.com
- DNS ASK cu###.eagle.ca
- DNS ASK ba##.####hropmountainsports.com
- DNS ASK un###ver.com
- DNS ASK un##########.mail.protection.outlook.com
- DNS ASK be###outh.net
- DNS ASK al######x-vip2.prodigy.net
- DNS ASK w1##1.nl
- DNS ASK sp#####ter2.w1mp1.nl
- DNS ASK ao#.com
- DNS ASK mx####.##il.gm0.yahoodns.net
- DNS ASK vi#.#ina.com
- DNS ASK mx#.##p.sina.com
- DNS ASK ra##axy.com
- DNS ASK ma###.ranbaxy.com
- DNS ASK em##l.com
- DNS ASK fr###hal.com
- DNS ASK pe###lrealty.ca
- DNS ASK ma##.#wiftpage.com
- DNS ASK ac#.com
- DNS ASK 19#.###.211.95.in-addr.arpa
- DNS ASK 19#.###.#11.95.dnsbl.sorbs.net
- DNS ASK ho#.ee
- DNS ASK 19#.###.#11.95.bl.spamcop.net
- DNS ASK ti###linet.it
- DNS ASK 19#.###.#11.95.zen.spamhaus.org
- DNS ASK mx#.hot.ee
- DNS ASK ya##o.com
- DNS ASK 19#.###.##1.95.sbl-xbl.spamhaus.org
- DNS ASK et###.#ail.tiscali.it
- DNS ASK mt##.##0.yahoodns.net
- DNS ASK pa##n.com
- DNS ASK 19#.###.#11.95.cbl.abuseat.org
- DNS ASK as###.daum.net
- DNS ASK ya##o.co.in
- DNS ASK mx#####.#ail.gm0.yahoodns.net
- DNS ASK al####owheels.com
- DNS ASK ba###ogs.com
- DNS ASK ba##########.mail.protection.outlook.com
- DNS ASK ex##te.com
- DNS ASK ma#######xcite.roc2.bluetie.com
- DNS ASK wa##i.jp
- DNS ASK aspmx.l.google.com
- DNS ASK ho##ail.com
- DNS ASK ho#########.olc.protection.outlook.com
- DNS ASK un####ovident.com
- DNS ASK cl######.us.messagelabs.com
- DNS ASK gm##l.com
- DNS ASK alt2.gmail-smtp-in.l.google.com
- DNS ASK mx#.#mpal.com
- DNS ASK if##d.org
- DNS ASK za##.##la.eis.uva.es
- DNS ASK ya###.com.mx
- DNS ASK ro####irmaroc.com
- DNS ASK ro###########-com.mail.protection.outlook.com
- DNS ASK vi##r.is
- DNS ASK sp#####n.internet.is
- DNS ASK ji###net.com
- DNS ASK fe##t.nl
- DNS ASK ma##.feyst.nl
- DNS ASK mi.is
- DNS ASK li#e.de
- DNS ASK ny##x.com
- DNS ASK cm#####1.cmegroup.com
- DNS ASK ma###world.com
- DNS ASK pu######3.mail2world.com
- DNS ASK ei#.ae
- DNS ASK dc######.emirates.net.ae
- DNS ASK ij###ack.com
- DNS ASK ma##.#jetpack.com
- DNS ASK is##ndia.is
- DNS ASK em###tes.net.ae
- DNS ASK ni###n-me.ae
- DNS ASK sm##.renault.fr
- DNS ASK be##rei.com
- DNS ASK be#######om.p10.mxthunder.com
- DNS ASK ym##l.com
- DNS ASK ic##q.com
- DNS ASK mx#######901.gslb.pphosted.com
- DNS ASK hk##.net
- DNS ASK mx##.hkbn.net
- DNS ASK in##rnet.is
- DNS ASK ka##tti.com
- DNS ASK ea###inkmts.com
- DNS ASK ya###.com.ar
- DNS ASK ff##.org
- DNS ASK gl##o.com
- DNS ASK mx.####o.locaweb.com.br
- DNS ASK fi##400.com
- DNS ASK co#.net
- DNS ASK cx#.##.#.cloudfilter.net
- DNS ASK google.com
- DNS ASK go####fefitness.com
- DNS ASK ma###.##odlifefitness.com
- DNS ASK lu##ku.com
- DNS ASK mx#.#uukku.com
- DNS ASK fi#####rservices.com.br
- DNS ASK mx.####.locaweb.com.br
- DNS ASK ho###il.com.br
- DNS ASK na#.###.#rotection.outlook.com
- DNS ASK mx#.ovh.net
- DNS ASK pl####mmunity.com
- DNS ASK gm#.com
- DNS ASK mx##.gmx.net
- DNS ASK fi####tartech.com
- DNS ASK ac###ture.com
- DNS ASK mx######dcc01.pphosted.com
- DNS ASK pe###epc.com
- DNS ASK ne##pp.com
- DNS ASK mx#.###app.iphmx.com
- DNS ASK fe###rs.co.ae
- DNS ASK ho##ail.se
- DNS ASK eu#.###.#rotection.outlook.com
- DNS ASK bi###lattes.com
- DNS ASK sm##.##cureserver.net
- DNS ASK mx#.##sehost.com
- DNS ASK mx##.#tande.co.zw
- '<DNS_SERVER>':53
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\jjnpeenw\ajbajvzq.exe' /d"<Full path to file>"
- '<SYSTEM32>\cmd.exe' /C mkdir <SYSTEM32>\jjnpeenw\' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C move /Y "%TEMP%\ajbajvzq.exe" <SYSTEM32>\jjnpeenw\' (with hidden window)
- '<SYSTEM32>\sc.exe' create jjnpeenw binPath= "<SYSTEM32>\jjnpeenw\ajbajvzq.exe /d\"<Full path to file>\"" type= own start= auto DisplayName= "wifi support"' (with hidden window)
- '<SYSTEM32>\sc.exe' description jjnpeenw "wifi internet conection"' (with hidden window)
- '<SYSTEM32>\sc.exe' start jjnpeenw' (with hidden window)
Executes the following
- '<SYSTEM32>\cmd.exe' /C mkdir <SYSTEM32>\jjnpeenw\
- '<SYSTEM32>\cmd.exe' /C move /Y "%TEMP%\ajbajvzq.exe" <SYSTEM32>\jjnpeenw\
- '<SYSTEM32>\sc.exe' create jjnpeenw binPath= "<SYSTEM32>\jjnpeenw\ajbajvzq.exe /d\"<Full path to file>\"" type= own start= auto DisplayName= "wifi support"
- '<SYSTEM32>\sc.exe' description jjnpeenw "wifi internet conection"
- '<SYSTEM32>\sc.exe' start jjnpeenw
- '<SYSTEM32>\svchost.exe'
