Technical Information
To ensure autorun and distribution
Sets the following service settings
- [<HKLM>\System\CurrentControlSet\Services\xnjjhwvk] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\xnjjhwvk] 'ImagePath' = '%WINDIR%\SysWOW64\xnjjhwvk\fnfpepxs.exe /d"<Full path to file>"'
- [<HKLM>\SYSTEM\CurrentControlSet\services\xnjjhwvk] 'ImagePath' = '%WINDIR%\SysWOW64\xnjjhwvk\fnfpepxs.exe'
Creates the following services
- 'xnjjhwvk' %WINDIR%\SysWOW64\xnjjhwvk\fnfpepxs.exe /d"<Full path to file>"
- 'xnjjhwvk' %WINDIR%\SysWOW64\xnjjhwvk\fnfpepxs.exe
Malicious functions
To complicate detection of its presence in the operating system,
adds antivirus exclusion with following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths] '%WINDIR%\SysWOW64\xnjjhwvk' = '00000000'
Executes the following
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="%WINDIR%\SysWOW64\svchost.exe" enable=yes>nul
Injects code into
the following system processes:
- %WINDIR%\syswow64\svchost.exe
Modifies file system
Creates the following files
- %TEMP%\fnfpepxs.exe
- %WINDIR%\syswow64\config\systemprofile:.repos
Moves the following files
- from %TEMP%\fnfpepxs.exe to %WINDIR%\syswow64\xnjjhwvk\fnfpepxs.exe
Deletes itself.
Network activity
Connects to
- 'mi##########m.mail.protection.outlook.com':25
- 'mx##.#and1.co.uk':25
- 'ex####l.bigpond.com':25
- 'mx.####ndecorreo.com':25
- 'mx#######001.gslb.pphosted.com':25
- 'mx#.##orp.kdns.in':25
- 'r-####6.korea.com':25
- 'na#.###.#rotection.outlook.com':25
- 'mx##.##il.icloud.com':25
- 'mx####.##il.gm0.yahoodns.net':25
- 'mx.##a.untd.com':25
- 'aspmx.l.google.com':25
- 'ma##.witham.org':25
- 'ex#####e.wisdomaz.com':25
- 'mx#######b01.gslb.pphosted.com':25
- 'mx#.##ailsrvr.com':25
- 'je#####.boxcarmedia.com':25
- 'mx.####eallcities.com':25
- 'mx###.##stedmxserver.com':25
- 'smtp.google.com':25
- 'sm##.#innacker.com':25
- 'sm####.eastlink.ca':25
- 'in#######.com.1.0001.arsmtp.com':25
- 'mx#######901.gslb.pphosted.com':25
- 'ma##.##wermydeposit.com':25
- 'mx#######003.gslb.pphosted.com':25
- 'ma##.#ailerhost.net':25
- 'mx#######201.gslb.pphosted.com':25
- 'mx.##.###.cust.b.hostedemail.com':25
- 'mx#.#aver.com':25
- 'mx##.#-online.de':25
- 'mx##.1and1.com':25
- 'ma##.##mmerzbank.com':25
- 'im##.##cureserver.net':993
- 'mx#######a04.gslb.pphosted.com':25
- 'mx.##reaker.net':25
- 'mx#####ica.zoneedit.com':25
- 'ff######x-vip2.prodigy.net':25
- 'al######x-vip1.prodigy.net':25
- 'mx#######902.gslb.pphosted.com':25
- 'mx#.#anmail.net':25
- 'ma##.##riliadestot.com':25
- 'mx####-1.sscinc.com':25
- 'mx#######002.gslb.pphosted.com':25
- 'eb###seed.com':25
- 'mx#.##eamhost.com':25
- 'ma####.exxonmobil.com':25
- 'li######.#lc.protection.outlook.com':25
- 'cx#.##.#.cloudfilter.net':25
- 'gq#.#witch.tv':443
- 'alt1.aspmx.l.google.com':25
- 'sp###.#ail.gandi.net':25
- 'mx##.##a.mailcore.net':25
- 'mx######-com.icoremail.net':25
- 'mx.######mail.rediff.akadns.net':25
- 'sm##.#opmail.com':25
- 'mx##.#lackberry.com':25
- 'mx#######401.gslb.pphosted.com':25
- 'mx#.#xcomet.com':25
- 'mx#######301.gslb.pphosted.com':25
- 'mx.##.#tinternet.com':25
- 'a.##.veteres.pl':25
- 'mx#######c01.gslb.pphosted.com':25
- 'sm###.#ail.medcity.net':25
- 'mx#######501.gslb.pphosted.com':25
- 'mk###.#et.mx1.rcimx.com':25
- 'mx.##teria.pl':25
- 'mx#.###355-65.iphmx.com':25
- '10#.#7.13.33':25
- 'in###gram.com':443
- 'google.com':80
- '17#.#13.115.157':423
- '17#.#13.115.156':423
- '80.#6.75.4':423
- '17#.#13.115.155':423
- '17#.#13.115.154':423
- '17#.#13.115.153':423
- 'mx#######d01.gslb.pphosted.com':25
- 'mx#######601.gslb.pphosted.com':25
- 'mx#######a01.gslb.pphosted.com':25
- 'mx#######801.gslb.pphosted.com':25
- 'mx#######101.gslb.pphosted.com':25
- 'pa####x.above.com':25
- '17#.#13.115.158':487
- 'sv####lfheim.top':443
- 'ma##.#-email.net':25
- 'mx#######005.gslb.pphosted.com':25
- 'mx#######.mail.am0.yahoodns.net':25
- 'ma###.#anagemgroup.com':25
- 'sm###a.nfp.com':25
- 'mx#.#ate.com':25
- 'fa###ool.xyz':10060
- 'mx#######803.gslb.pphosted.com':25
- 'mx#######e01.gslb.pphosted.com':25
- 'mx######b4701.pphosted.com':25
- 'mx#######702.gslb.pphosted.com':25
- 'mu####bedsales.com':25
- 'mx#######b02.gslb.pphosted.com':25
- 'ma###.mpsa.com':25
- 'mx##.###us-vadesecure.net':25
- 'sm#####.hosting.orange.pl':25
- 'mx.#####.#om.cust.b.hostedemail.com':25
- 'mx.#len.pl':25
- 'mx#######e02.gslb.pphosted.com':25
- 'mx#######f01.gslb.pphosted.com':25
- 'em##.freenet.de':25
- 'mx######91d01.pphosted.com':25
- 'mx###.comcast.net':25
- 'mx##.mail.com':25
- 'mx#######f02.gslb.pphosted.com':25
- 'mx.########e.prod.cloud.synchronoss.net':25
- 'mt##.##0.yahoodns.net':25
- 'al######x-vip2.prodigy.net':25
- 'mx###.ziggo.nl':25
- 'mx#######d04.gslb.pphosted.com':25
- 'so####2.sohu.com':25
- 'mx#.##lkomsa.net':25
TCP
HTTP GET requests
- http://www.google.com/
Other
- 'sv####lfheim.top':443
- 'mx###.##stedmxserver.com':25
- 'je#####.boxcarmedia.com':25
- 'ex#####e.wisdomaz.com':25
- 'mx####.##il.gm0.yahoodns.net':25
- 'na#.###.#rotection.outlook.com':25
- 'mx.####ndecorreo.com':25
- 'mx#.#aver.com':25
- 'sm##.#opmail.com':25
- 'mx.######mail.rediff.akadns.net':25
- 'mx######-com.icoremail.net':25
- 'mx##.##a.mailcore.net':25
- 'sp###.#ail.gandi.net':25
- 'i.###tagram.com':443
- 'alt1.aspmx.l.google.com':25
- 'gq#.#witch.tv':443
- 'li######.#lc.protection.outlook.com':25
- 'mx#.##eamhost.com':25
- 'ma##.##riliadestot.com':25
- 'mx#.#anmail.net':25
- 'al######x-vip1.prodigy.net':25
- 'ff######x-vip2.prodigy.net':25
- 'mx#####ica.zoneedit.com':25
- 'mx.##reaker.net':25
- 'im##.##cureserver.net':993
- 'sm##.#innacker.com':25
- 'mx#.##orp.kdns.in':25
- 'smtp.google.com':25
- 'mk###.#et.mx1.rcimx.com':25
- '17#.#13.115.158':487
- '17#.#13.115.153':423
- '17#.#13.115.155':423
- '17#.#13.115.154':423
- '17#.#13.115.157':423
- '17#.#13.115.156':423
- '80.#6.75.4':423
- 'in###gram.com':443
- '10#.#7.13.33':25
- 'pa####x.above.com':25
- 'mx.##teria.pl':25
- 'mx#.###355-65.iphmx.com':25
- 'ma##.##wermydeposit.com':25
- 'mx#######c01.gslb.pphosted.com':25
- 'mx.##.#tinternet.com':25
- 'a.##.veteres.pl':25
- 'ma##.#-email.net':25
- 'mx#######.mail.am0.yahoodns.net':25
- 'mx###.ziggo.nl':25
- 'al######x-vip2.prodigy.net':25
- 'mt##.##0.yahoodns.net':25
- 'mu####bedsales.com':25
- 'fa###ool.xyz':10060
- 'mx#.#xcomet.com':25
- 'in#######.com.1.0001.arsmtp.com':25
- 'ma##.##mmerzbank.com':25
UDP
- DNS ASK mi##########m.mail.protection.outlook.com
- DNS ASK r-####6.korea.com
- DNS ASK te##nos.com
- DNS ASK mx#######001.gslb.pphosted.com
- DNS ASK eu####sidencias.com
- DNS ASK mx.####ndecorreo.com
- DNS ASK bi##ond.com
- DNS ASK ex####l.bigpond.com
- DNS ASK ta##21.com
- DNS ASK ta###gon.org
- DNS ASK mx##.#and1.co.uk
- DNS ASK ht##il.com
- DNS ASK ma##.#ailerhost.net
- DNS ASK be####alkdata.com
- DNS ASK te###planet.com
- DNS ASK mx#######201.gslb.pphosted.com
- DNS ASK cr##ers.com
- DNS ASK el###ronika.it
- DNS ASK bo##on.com
- DNS ASK em#.com
- DNS ASK go.com
- DNS ASK mx.##.###.cust.b.hostedemail.com
- DNS ASK ne###ape.net
- DNS ASK na##r.com
- DNS ASK mx#.#aver.com
- DNS ASK yo##ail.com
- DNS ASK sm##.#opmail.com
- DNS ASK mx#.##orp.kdns.in
- DNS ASK ko##a.com
- DNS ASK gc###group.com
- DNS ASK na#.###.#rotection.outlook.com
- DNS ASK we##v.net
- DNS ASK smtp.google.com
- DNS ASK wi#####.prometheusx.pl
- DNS ASK mx###.##stedmxserver.com
- DNS ASK sk####llcities.com
- DNS ASK mx.####eallcities.com
- DNS ASK bo###rmedia.com
- DNS ASK je#####.boxcarmedia.com
- DNS ASK mi####manpress.com
- DNS ASK mx#.##ailsrvr.com
- DNS ASK te###stems.com
- DNS ASK ci##a.com
- DNS ASK wi###maz.com
- DNS ASK re###fmail.com
- DNS ASK tn#.com
- DNS ASK ex#####e.wisdomaz.com
- DNS ASK wi##am.org
- DNS ASK ma##.witham.org
- DNS ASK te##s.net
- DNS ASK aspmx.l.google.com
- DNS ASK ju##.com
- DNS ASK mx.##a.untd.com
- DNS ASK ve##zon.net
- DNS ASK mx####.##il.gm0.yahoodns.net
- DNS ASK ma#.com
- DNS ASK mx##.##il.icloud.com
- DNS ASK de##.com
- DNS ASK me.com
- DNS ASK ne##en.com
- DNS ASK mx#######b01.gslb.pphosted.com
- DNS ASK mx.######mail.rediff.akadns.net
- DNS ASK at#.com
- DNS ASK ch##a.com
- DNS ASK be###outh.net
- DNS ASK sb###obal.net
- DNS ASK al######x-vip1.prodigy.net
- DNS ASK pa##ell.net
- DNS ASK ff######x-vip2.prodigy.net
- DNS ASK mi##o.net
- DNS ASK mx#####ica.zoneedit.com
- DNS ASK cp##ps.com
- DNS ASK de###ness.com
- DNS ASK ph###ker.net
- DNS ASK mx.##reaker.net
- DNS ASK di###rds.com
- DNS ASK dr###works.com
- DNS ASK ea###link.com
- DNS ASK sm##.#innacker.com
- DNS ASK im##.##cureserver.net
- DNS ASK i.###tagram.com
- DNS ASK co###rzbank.com
- DNS ASK ma##.##mmerzbank.com
- DNS ASK sm######ilding-works.com
- DNS ASK mx##.1and1.com
- DNS ASK ic##ud.com
- DNS ASK t-##line.de
- DNS ASK mx##.#-online.de
- DNS ASK fe##ick.com
- DNS ASK fh##60.org
- DNS ASK go##.com
- DNS ASK mx##.#lackberry.com
- DNS ASK mx#######902.gslb.pphosted.com
- DNS ASK ba###ftexas.com
- DNS ASK am##r.com
- DNS ASK tr####rsupply.com
- DNS ASK mx######-com.icoremail.net
- DNS ASK lu##ku.com
- DNS ASK mx##.##a.mailcore.net
- DNS ASK ae###rain.net
- DNS ASK sp###.#ail.gandi.net
- DNS ASK ca###ademy.org
- DNS ASK alt1.aspmx.l.google.com
- DNS ASK gq#.#witch.tv
- DNS ASK co#.net
- DNS ASK cx#.##.#.cloudfilter.net
- DNS ASK ib####aternoida.org
- DNS ASK li##.com
- DNS ASK li######.#lc.protection.outlook.com
- DNS ASK te###msa.net
- DNS ASK ha##ail.net
- DNS ASK wh##per.com
- DNS ASK eb###seed.com
- DNS ASK ex###mobil.com
- DNS ASK ma####.exxonmobil.com
- DNS ASK ma####acoutinho.com
- DNS ASK mx#.##eamhost.com
- DNS ASK ad##nt.com
- DNS ASK mx####-1.sscinc.com
- DNS ASK al##ia.com
- DNS ASK mx#######002.gslb.pphosted.com
- DNS ASK ma####adestot.com
- DNS ASK ma##.##riliadestot.com
- DNS ASK am###ssn.org
- DNS ASK mx#.#anmail.net
- DNS ASK mx#######a04.gslb.pphosted.com
- DNS ASK wi###cker.com
- DNS ASK mx#######301.gslb.pphosted.com
- DNS ASK ve##res.pl
- DNS ASK a.##.veteres.pl
- DNS ASK bt###ernet.com
- DNS ASK mx.##.#tinternet.com
- DNS ASK an##e.com
- DNS ASK mu###free.com
- DNS ASK ma##.#-email.net
- DNS ASK al###ate.com
- DNS ASK mx#######005.gslb.pphosted.com
- DNS ASK ro##rs.com
- DNS ASK mx#######.mail.am0.yahoodns.net
- DNS ASK ma####mgroup.com
- DNS ASK ed###djones.com
- DNS ASK ma###.#anagemgroup.com
- DNS ASK mx#######d04.gslb.pphosted.com
- DNS ASK zi##o.nl
- DNS ASK mx###.ziggo.nl
- DNS ASK at#.net
- DNS ASK al######x-vip2.prodigy.net
- DNS ASK fr###iernet.net
- DNS ASK mt##.##0.yahoodns.net
- DNS ASK ke##omp.com
- DNS ASK op###line.com
- DNS ASK mx.########e.prod.cloud.synchronoss.net
- DNS ASK pf##er.com
- DNS ASK mx#######f02.gslb.pphosted.com
- DNS ASK hc####lthcare.com
- DNS ASK sm###.#ail.medcity.net
- DNS ASK mx#######c01.gslb.pphosted.com
- DNS ASK sp##.org
- DNS ASK mx#######501.gslb.pphosted.com
- DNS ASK 23#.###.#12.82.dnsbl.sorbs.net
- DNS ASK me###spain.com
- DNS ASK 23#.###.#12.82.bl.spamcop.net
- DNS ASK 23#.###.#12.82.zen.spamhaus.org
- DNS ASK 23#.###.##2.82.sbl-xbl.spamhaus.org
- DNS ASK 23#.###.#12.82.cbl.abuseat.org
- DNS ASK pa####x.above.com
- DNS ASK he##.com
- DNS ASK mx#######801.gslb.pphosted.com
- DNS ASK su####trentals.com
- DNS ASK mx#######101.gslb.pphosted.com
- DNS ASK mh#.net
- DNS ASK ma##.com
- DNS ASK ai#.com
- DNS ASK mx#######a01.gslb.pphosted.com
- DNS ASK to####utomotive.com
- DNS ASK mx#######601.gslb.pphosted.com
- DNS ASK 23#.###.112.82.in-addr.arpa
- DNS ASK google.com
- DNS ASK in###gram.com
- DNS ASK uh##l.com
- DNS ASK mx#.###355-65.iphmx.com
- DNS ASK in##ria.pl
- DNS ASK mx.##teria.pl
- DNS ASK mk##a.net
- DNS ASK mk###.#et.mx1.rcimx.com
- DNS ASK am###trade.com
- DNS ASK sv####lfheim.top
- DNS ASK mx#######d01.gslb.pphosted.com
- DNS ASK mx##.mail.com
- DNS ASK co##ast.net
- DNS ASK mx###.comcast.net
- DNS ASK bn.com
- DNS ASK mx#######e01.gslb.pphosted.com
- DNS ASK cl####hannel.com
- DNS ASK mx#######803.gslb.pphosted.com
- DNS ASK ti##jo.com
- DNS ASK fa###ool.xyz
- DNS ASK na##.com
- DNS ASK mx#.#ate.com
- DNS ASK fi##lc.com
- DNS ASK sm###a.nfp.com
- DNS ASK so##.com
- DNS ASK so####2.sohu.com
- DNS ASK me###onic.com
- DNS ASK yo###mail.top
- DNS ASK sm####.eastlink.ca
- DNS ASK mx#.#xcomet.com
- DNS ASK ca##sjr.com
- DNS ASK mx#######401.gslb.pphosted.com
- DNS ASK we###fargo.com
- DNS ASK ch##i.org
- DNS ASK mx#######003.gslb.pphosted.com
- DNS ASK in###matica.com
- DNS ASK wi##.net
- DNS ASK ma##.##wermydeposit.com
- DNS ASK sh#.org
- DNS ASK mx#######901.gslb.pphosted.com
- DNS ASK in###kinc.com
- DNS ASK in#######.com.1.0001.arsmtp.com
- DNS ASK ga####nemail.com
- DNS ASK o2.pl
- DNS ASK mx######b4701.pphosted.com
- DNS ASK mx.#####.#om.cust.b.hostedemail.com
- DNS ASK in####erator.com
- DNS ASK sb#.com
- DNS ASK mx######91d01.pphosted.com
- DNS ASK be###outh.com
- DNS ASK em##l.com
- DNS ASK pi###los.com
- DNS ASK fr##net.de
- DNS ASK em##.freenet.de
- DNS ASK be##man.com
- DNS ASK mx#######f01.gslb.pphosted.com
- DNS ASK fm###bal.com
- DNS ASK mx#######e02.gslb.pphosted.com
- DNS ASK ly##s.com
- DNS ASK ac###scable.net
- DNS ASK in#####atehotels.com
- DNS ASK mx.#len.pl
- DNS ASK pr##igy.net
- DNS ASK or##ge.pl
- DNS ASK sm#####.hosting.orange.pl
- DNS ASK ea###link.net
- DNS ASK mx##.###us-vadesecure.net
- DNS ASK ta##et.com
- DNS ASK mx#######b02.gslb.pphosted.com
- DNS ASK mp##.com
- DNS ASK ma###.mpsa.com
- DNS ASK mu####bedsales.com
- DNS ASK ro###tmail.com
- DNS ASK mw##2o.com
- DNS ASK mx#######702.gslb.pphosted.com
- DNS ASK mx#.##lkomsa.net
Miscellaneous
Creates and executes the following
- '%WINDIR%\syswow64\xnjjhwvk\fnfpepxs.exe' /d"<Full path to file>"
- '%WINDIR%\syswow64\cmd.exe' /C mkdir %WINDIR%\SysWOW64\xnjjhwvk\' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C move /Y "%TEMP%\fnfpepxs.exe" %WINDIR%\SysWOW64\xnjjhwvk\' (with hidden window)
- '%WINDIR%\syswow64\sc.exe' create xnjjhwvk binPath= "%WINDIR%\SysWOW64\xnjjhwvk\fnfpepxs.exe /d\"<Full path to file>\"" type= own start= auto DisplayName= "wifi support"' (with hidden window)
- '%WINDIR%\syswow64\sc.exe' description xnjjhwvk "wifi internet conection"' (with hidden window)
- '%WINDIR%\syswow64\sc.exe' start xnjjhwvk' (with hidden window)
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="%WINDIR%\SysWOW64\svchost.exe" enable=yes>nul' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /C mkdir %WINDIR%\SysWOW64\xnjjhwvk\
- '%WINDIR%\syswow64\cmd.exe' /C move /Y "%TEMP%\fnfpepxs.exe" %WINDIR%\SysWOW64\xnjjhwvk\
- '%WINDIR%\syswow64\sc.exe' create xnjjhwvk binPath= "%WINDIR%\SysWOW64\xnjjhwvk\fnfpepxs.exe /d\"<Full path to file>\"" type= own start= auto DisplayName= "wifi support"
- '%WINDIR%\syswow64\sc.exe' description xnjjhwvk "wifi internet conection"
- '%WINDIR%\syswow64\sc.exe' start xnjjhwvk
- '%WINDIR%\syswow64\svchost.exe'
- '%WINDIR%\syswow64\svchost.exe' -o fastpool.xyz:10060 -u 9mLwUkiK8Yp89zQQYodWKN29jVVVz1cWDFZctWxge16Zi3TpHnSBnnVcCDhSRXdesnMBdVjtDwh1N71KD9z37EzgKSM1tmS.60000 -p x -k -a cn/half
