Technical Information
To ensure autorun and distribution
Creates the following services
- [<HKLM>\System\CurrentControlSet\Services\iajvxbkw] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\iajvxbkw] 'ImagePath' = '<SYSTEM32>\iajvxbkw\tjpijrhq.exe /d"<Full path to file>"'
- [<HKLM>\SYSTEM\CurrentControlSet\services\iajvxbkw] 'ImagePath' = '<SYSTEM32>\iajvxbkw\tjpijrhq.exe'
Malicious functions
Injects code into
the following system processes:
- <SYSTEM32>\svchost.exe
Modifies file system
Creates the following files
- %TEMP%\tjpijrhq.exe
- C:\documents and settings\localservice:.repos
Moves the following files
- from %TEMP%\tjpijrhq.exe to <SYSTEM32>\iajvxbkw\tjpijrhq.exe
Deletes itself.
Network activity
TCP
HTTP GET requests
- http://www.google.com/
UDP
- DNS ASK mi##########m.mail.protection.outlook.com
- DNS ASK al######x-vip1.prodigy.net
- DNS ASK be###outh.net
- DNS ASK mx.##timum.net
- DNS ASK op###line.net
- DNS ASK fo########ps.mail.am0.yahoodns.net
- DNS ASK ya###groups.com
- DNS ASK em####.chemonics.net
- DNS ASK ch###nics.net
- DNS ASK ve##zon.net
- DNS ASK mx#.##rthlink.net
- DNS ASK ea###link.net
- DNS ASK in##.co.ph
- DNS ASK sm##.tin.it
- DNS ASK ti#.it
- DNS ASK ms#####.##c.protection.outlook.com
- DNS ASK ms#.com
- DNS ASK na#.###.#rotection.outlook.com
- DNS ASK google.com
- DNS ASK li#e.cl
- DNS ASK ge###ties.com
- DNS ASK ya##o.de
- DNS ASK ch##ter.net
- DNS ASK mx.##xmail.com
- DNS ASK mx#.#harter.net
- DNS ASK wf###e.com.au
- DNS ASK go##le.de
- DNS ASK ba###est.com.au
- DNS ASK mx#.#omcast.net
- DNS ASK co##ast.net
- DNS ASK ho###il.co.uk
- DNS ASK mx#######401.gslb.pphosted.com
- DNS ASK ch###.com.au
- DNS ASK mx#######201.gslb.pphosted.com
- DNS ASK ve##zon.com
- DNS ASK mx##.#bs.open.ch
- DNS ASK ro###.vic.gov.au
- DNS ASK rt#.#sw.gov.au
- DNS ASK pa###ers.com.au
- DNS ASK al###.venus.it
- DNS ASK 20#0.it
- DNS ASK vi########er.fra02.hls.ttvnw.net
- DNS ASK alt1.gmail-smtp-in.l.google.com
- DNS ASK gm##l.com
- DNS ASK fi#####.##rkfo-2.mailguard.com.au
- DNS ASK wo####rce.com.au
- DNS ASK ma##.##rkforce.com.au
- DNS ASK ip##fo.io
- DNS ASK my##ad.net
- DNS ASK ub#.com
- DNS ASK in##nd.it
- DNS ASK cl######.us.messagelabs.com
- DNS ASK gw####.inescop.es
- DNS ASK in##cop.es
- DNS ASK ho#########.olc.protection.outlook.com
- DNS ASK ho##ail.com
- DNS ASK mt##.##0.yahoodns.net
- DNS ASK 19#.###.#11.95.cbl.abuseat.org
- DNS ASK ya##o.com
- DNS ASK sm####n.libero.it
- DNS ASK 19#.###.##1.95.sbl-xbl.spamhaus.org
- DNS ASK li##ro.it
- DNS ASK sm##.#du.xunta.es
- DNS ASK ed#.#unta.es
- DNS ASK mx###.##il.am0.yahoodns.net
- DNS ASK 19#.###.#11.95.zen.spamhaus.org
- DNS ASK ya##o.co.uk
- DNS ASK eu#.###.#rotection.outlook.com
- DNS ASK 19#.###.#11.95.bl.spamcop.net
- DNS ASK li#e.fr
- DNS ASK 19#.###.#11.95.dnsbl.sorbs.net
- DNS ASK 19#.###.211.95.in-addr.arpa
- DNS ASK aspmx.l.google.com
- DNS ASK sm####n.inwind.it
- DNS ASK ti###linet.it
- DNS ASK si##m.it
- DNS ASK sm####n.virgilio.it
- DNS ASK vi##ilio.it
- DNS ASK ya##o.it
- DNS ASK ma##.###lorresearch.com.au
- DNS ASK ta#####esearch.com.au
- DNS ASK sm###in.iol.it
- DNS ASK io#.it
- DNS ASK ca####g.wa.gov.au
- DNS ASK ma##.##ppobros.com.au
- DNS ASK ca####ros.com.au
- DNS ASK li#e.dk
- DNS ASK vr######1.roads.vic.gov.au
- DNS ASK gi#.com.au
- DNS ASK mx.####iciodecorreo.es
- DNS ASK af##o.es
- DNS ASK mx.#enr.es
- DNS ASK ep#.es
- DNS ASK ti##ali.it
- DNS ASK ma####1.minetad.es
- DNS ASK to###pain.es
- DNS ASK mx####.##il.gm0.yahoodns.net
- DNS ASK ao#.com
- DNS ASK et###.#ail.tiscali.it
- DNS ASK co##n.es
- '<DNS_SERVER>':53
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\iajvxbkw\tjpijrhq.exe' /d"<Full path to file>"
- '<SYSTEM32>\cmd.exe' /C mkdir <SYSTEM32>\iajvxbkw\' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C move /Y "%TEMP%\tjpijrhq.exe" <SYSTEM32>\iajvxbkw\' (with hidden window)
- '<SYSTEM32>\sc.exe' create iajvxbkw binPath= "<SYSTEM32>\iajvxbkw\tjpijrhq.exe /d\"<Full path to file>\"" type= own start= auto DisplayName= "wifi support"' (with hidden window)
- '<SYSTEM32>\sc.exe' description iajvxbkw "wifi internet conection"' (with hidden window)
- '<SYSTEM32>\sc.exe' start iajvxbkw' (with hidden window)
Executes the following
- '<SYSTEM32>\cmd.exe' /C mkdir <SYSTEM32>\iajvxbkw\
- '<SYSTEM32>\cmd.exe' /C move /Y "%TEMP%\tjpijrhq.exe" <SYSTEM32>\iajvxbkw\
- '<SYSTEM32>\sc.exe' create iajvxbkw binPath= "<SYSTEM32>\iajvxbkw\tjpijrhq.exe /d\"<Full path to file>\"" type= own start= auto DisplayName= "wifi support"
- '<SYSTEM32>\sc.exe' description iajvxbkw "wifi internet conection"
- '<SYSTEM32>\sc.exe' start iajvxbkw
- '<SYSTEM32>\svchost.exe'
