Technical Information
To ensure autorun and distribution
Creates the following services
- [<HKLM>\System\CurrentControlSet\Services\cgxuhykr] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\cgxuhykr] 'ImagePath' = '<SYSTEM32>\cgxuhykr\uhvyaayl.exe /d"<Full path to file>"'
- [<HKLM>\SYSTEM\CurrentControlSet\services\cgxuhykr] 'ImagePath' = '<SYSTEM32>\cgxuhykr\uhvyaayl.exe'
Malicious functions
Injects code into
the following system processes:
- <SYSTEM32>\svchost.exe
Modifies file system
Creates the following files
- %TEMP%\uhvyaayl.exe
- C:\documents and settings\localservice:.repos
Moves the following files
- from %TEMP%\uhvyaayl.exe to <SYSTEM32>\cgxuhykr\uhvyaayl.exe
Deletes itself.
Network activity
Connects to
- 'mt##.##0.yahoodns.net':25
- 'fr#####.#inamail.sina.com.cn':25
- 'mx###.##il.am0.yahoodns.net':25
- 'mx.#len.pl':25
- 'eu#.###.#rotection.outlook.com':25
- 'mx##.#spgateway.de':25
- 'gmail-smtp-in.l.google.com':25
- 'alt1.aspmx.l.google.com':25
- 'cl#######.us.messagelabs.com':25
- 'mx####.##il.gm0.yahoodns.net':25
- '69.#1.136.5':443
- 'ma##.#ihonparker.in':25
- 'ma###.#omune.venezia.it':25
- 'mx#####.#ail.gm0.yahoodns.net':25
- 'ma##.#egister.it':25
- 'mx.##ra.co.nz':25
- 'mx#######402.gslb.pphosted.com':25
- 'sm####n.libero.it':25
- 'al######x-vip1.prodigy.net':25
- 'ne##lix.com':443
- 'mx.##lus.net':25
- 'mx##.#andomain.dk':25
- 'mx.yandex.ru':25
- 'mx#.#anmail.net':25
- 'sm##.#ail.swan.sk':25
- 'ma##.##oolfotografie.nl':25
- 'ho####decharme.nl':25
- 'al######x-vip2.prodigy.net':25
- 'mx#.##.correio.biz':25
- 'd1######.#ss.barracudanetworks.com':25
- 'ma###.eircom.net':25
- 'ma##.stsnet.it':25
- 'cl#######k.eu.messagelabs.com':25
- 'ms#####p-mx1.hinet.net':25
- 'ho#########.olc.protection.outlook.com':25
- 'mx#.mail.ru':25
- 'aspmx.l.google.com':25
- 'mx#.##tsolmail.net':25
- 'ma####1.globeop.com':25
- 'mx#.##axiscloud.com':25
- 'mx#######701.gslb.pphosted.com':25
- 'ma###.hostek.com':25
- 'mx###.in-mx.com':25
- 'as#.##flexion.net':25
- 'ki###film.sk':443
- 'mx.##oltoad.com':25
- 'tu###.web2media.sk':443
- 'sm###.9services.com':25
- 'fo###.#oogleapis.com':443
- 'mx.##teria.pl':25
- 'ba#####da.airmar.com':25
- 'ma##.#####-cover.trafficmanager.net':25
- 'sm##.##cureserver.net':25
- 'du###.emsergipe.com':25
- 'et###.#ail.tiscali.it':25
- 'fo###.gstatic.com':443
- 'cd#.#dspirit.de':443
- 'sp####ght.mdsnet.it':25
- 'alt3.gmail-smtp-in.l.google.com':25
- 'mx#####os1.burgo.com':25
- 'dn#######edge01.email.rr.com':25
- 'fi#######mw15.rightnowtech.com':25
- 'ma##.###fdistributing.com':25
- 'mx#######e01.gslb.pphosted.com':25
- '14#.#6.108.92':483
- 'sm####n.eutelia.it':25
- 'ma##.##-productions.de':25
- 'sm##.a1.net':25
TCP
HTTP GET requests
- http://www.google.com/
UDP
- DNS ASK mi##########m.mail.protection.outlook.com
- DNS ASK nb##.co.nz
- DNS ASK cl#######k.eu.messagelabs.com
- DNS ASK il###istro.it
- DNS ASK si##.com
- DNS ASK fr#####.#inamail.sina.com.cn
- DNS ASK xt##.co.nz
- DNS ASK mx.##ra.co.nz
- DNS ASK al#######alacerestaurant.com
- DNS ASK ya##o.it
- DNS ASK mx###.##il.am0.yahoodns.net
- DNS ASK me###pectra.com
- DNS ASK sk#.com
- DNS ASK o2.pl
- DNS ASK mx.#len.pl
- DNS ASK li#e.it
- DNS ASK ar####methods.com
- DNS ASK fr###ier.com
- DNS ASK ku####uch-shop.de
- DNS ASK mx##.#spgateway.de
- DNS ASK ya###.com.ar
- DNS ASK 11##tri.eu
- DNS ASK ca####zeriapiave.it
- DNS ASK br#####hinyobject.com
- DNS ASK ms#####p-mx1.hinet.net
- DNS ASK gm##l.com
- DNS ASK ms#.#inet.net
- DNS ASK re###iving.com
- DNS ASK sp####ght.mdsnet.it
- DNS ASK ho###oop.com
- DNS ASK ho##law.com
- DNS ASK bu#####stribuzione.com
- DNS ASK mx#####os1.burgo.com
- DNS ASK ha##ail.net
- DNS ASK mx#.#anmail.net
- DNS ASK jz####ductions.de
- DNS ASK ma##.##-productions.de
- DNS ASK go####il.etsu.edu
- DNS ASK gu####novation.com
- DNS ASK ag##e.com
- DNS ASK ke###ichat.com
- DNS ASK gi###inc.com
- DNS ASK ch#######hopping-central.com
- DNS ASK ma####.custhelp.com
- DNS ASK fi#######mw15.rightnowtech.com
- DNS ASK gu#####tributing.com
- DNS ASK ma##.###fdistributing.com
- DNS ASK fa####dollar.com
- DNS ASK mx#######e01.gslb.pphosted.com
- DNS ASK fr###omland.it
- DNS ASK sm####n.eutelia.it
- DNS ASK ma##.#####-cover.trafficmanager.net
- DNS ASK al######x-vip2.prodigy.net
- DNS ASK sm##.a1.net
- DNS ASK alt1.aspmx.l.google.com
- DNS ASK sg####otografie.nl
- DNS ASK ma##.##oolfotografie.nl
- DNS ASK wr####udents.org
- DNS ASK go###email.com
- DNS ASK alt3.gmail-smtp-in.l.google.com
- DNS ASK ad##an.edu
- DNS ASK bi##ys.it
- DNS ASK ya##o.co.nz
- DNS ASK eu##web.sk
- DNS ASK sm##.#ail.swan.sk
- DNS ASK yandex.ru
- DNS ASK mx.yandex.ru
- DNS ASK sh##ita.dk
- DNS ASK mx##.#andomain.dk
- DNS ASK te##s.net
- DNS ASK mx.##lus.net
- DNS ASK ne##lix.com
- DNS ASK be###outh.net
- DNS ASK al######x-vip1.prodigy.net
- DNS ASK tu#.by
- DNS ASK ad###hia.net
- DNS ASK dn#######edge01.email.rr.com
- DNS ASK a1.net
- DNS ASK ho####decharme.nl
- DNS ASK ma##.mdsnet.it
- DNS ASK fo#####ohaus-mohr.de
- DNS ASK sb###obal.net
- DNS ASK ma###as.cmpc.cl
- DNS ASK mo#####e.wellsfargo.com
- DNS ASK cl#######.us.messagelabs.com
- DNS ASK ve##zon.net
- DNS ASK mx####.##il.gm0.yahoodns.net
- DNS ASK ni###parker.in
- DNS ASK ma##.#ihonparker.in
- DNS ASK co####.venezia.it
- DNS ASK ma###.#omune.venezia.it
- DNS ASK ya###.com.sg
- DNS ASK mx#####.#ail.gm0.yahoodns.net
- DNS ASK ty##n.com
- DNS ASK mx#######402.gslb.pphosted.com
- DNS ASK li##ro.it
- DNS ASK sm####n.libero.it
- DNS ASK st##et.it
- DNS ASK ma##.stsnet.it
- DNS ASK ei##om.net
- DNS ASK ma###.eircom.net
- DNS ASK fo###rcity.org
- DNS ASK d1######.#ss.barracudanetworks.com
- DNS ASK ig.#om.br
- DNS ASK mx#.##.correio.biz
- DNS ASK gmail-smtp-in.l.google.com
- DNS ASK mu####overseas.com
- DNS ASK cd#.#dspirit.de
- DNS ASK ma###.hostek.com
- DNS ASK le###iflock.it
- DNS ASK mx.###atiflock.it
- DNS ASK ya##o.com
- DNS ASK mt##.##0.yahoodns.net
- DNS ASK ae##n.nl
- DNS ASK mx#######f01.gslb.pphosted.com
- DNS ASK le##line.it
- DNS ASK mx###.in-mx.net
- DNS ASK el##vier.nl
- DNS ASK el#########.mail.protection.outlook.com
- DNS ASK xp#######am12.itap.purdue.edu
- DNS ASK le##rne.com
- DNS ASK le###matic.it
- DNS ASK aspmx.l.google.com
- DNS ASK in##ria.pl
- DNS ASK mx.##teria.pl
- DNS ASK wa##doo.nl
- DNS ASK le###rans.it
- DNS ASK le###unisi.it
- DNS ASK ne#####ndse-opera.nl
- DNS ASK mx#####1.fortytwo.nl
- DNS ASK le####riafghani.it
- DNS ASK le####clubhotel.it
- DNS ASK pu##ue.edu
- DNS ASK mx#.mail.ru
- DNS ASK in##x.ru
- DNS ASK 19#.###.211.95.in-addr.arpa
- DNS ASK 19#.###.#11.95.dnsbl.sorbs.net
- DNS ASK le####inazioni.it
- DNS ASK ma##.#egister.it
- DNS ASK 19#.###.#11.95.bl.spamcop.net
- DNS ASK 19#.###.#11.95.zen.spamhaus.org
- DNS ASK ms#.edu
- DNS ASK 19#.###.##1.95.sbl-xbl.spamhaus.org
- DNS ASK mx#######801.gslb.pphosted.com
- DNS ASK 19#.###.#11.95.cbl.abuseat.org
- DNS ASK le####eimmobili.it
- DNS ASK ma##.##vanteimmobili.it
- DNS ASK fs#.edu
- DNS ASK mx#######503.gslb.pphosted.com
- DNS ASK le###chimica.it
- DNS ASK ma##.##vanchimica.it
- DNS ASK tr###.ulm.edu
- DNS ASK is##ine.it
- DNS ASK em###.isisecure.it
- DNS ASK pl##et.nl
- DNS ASK ma####.kpnmail.nl
- DNS ASK ho##ail.com
- DNS ASK ho#########.olc.protection.outlook.com
- DNS ASK le##iero.it
- DNS ASK fo###.gstatic.com
- DNS ASK li##.co.uk
- DNS ASK du###.emsergipe.com
- DNS ASK mx###.in-mx.com
- DNS ASK gi####pearls.com
- DNS ASK ja#####wnpainting.com
- DNS ASK as#.##flexion.net
- DNS ASK ki###film.sk
- DNS ASK gi###echinc.com
- DNS ASK co###oad.com
- DNS ASK mx.##oltoad.com
- DNS ASK tu###.web2media.sk
- DNS ASK qq##.com
- DNS ASK km#.com
- DNS ASK gr####-perrotin.com
- DNS ASK sm###.9services.com
- DNS ASK ma##ort.com
- DNS ASK fo###.#oogleapis.com
- DNS ASK ba#####da.airmar.com
- DNS ASK pr#####herapeutics.com
- DNS ASK pr####-presse.com
- DNS ASK ib##l.com
- DNS ASK sm##.##cureserver.net
- DNS ASK li#t.ru
- DNS ASK jp###abe.com
- DNS ASK em###gipe.com
- DNS ASK oa##.com
- DNS ASK pi##te.ca
- DNS ASK le##or.it
- DNS ASK mx#######701.gslb.pphosted.com
- DNS ASK ti###linet.it
- DNS ASK et###.#ail.tiscali.it
- DNS ASK in##co.net
- DNS ASK ma####.lanaco.com
- DNS ASK ho##ail.de
- DNS ASK eu#.###.#rotection.outlook.com
- DNS ASK ne##om.ca
- DNS ASK sr##.com
- DNS ASK ma#l.ru
- DNS ASK dh#.nl
- DNS ASK ca####onsult.com
- DNS ASK cl######.eu.messagelabs.com
- DNS ASK ca######.#om.mx1.greymail.rcimx.net
- DNS ASK google.com
- DNS ASK gl####star.com.ni
- DNS ASK gl####star.com.tr
- DNS ASK ou###rmland.com
- DNS ASK mx#.##tsolmail.net
- DNS ASK gl##eop.com
- DNS ASK ma####1.globeop.com
- DNS ASK cc##pa.com
- DNS ASK mx#.##axiscloud.com
- DNS ASK sf###onicle.com
- DNS ASK ca###omm.com
- DNS ASK mx#.#irate.ca
- '<DNS_SERVER>':53
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\cgxuhykr\uhvyaayl.exe' /d"<Full path to file>"
- '<SYSTEM32>\cmd.exe' /C mkdir <SYSTEM32>\cgxuhykr\' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C move /Y "%TEMP%\uhvyaayl.exe" <SYSTEM32>\cgxuhykr\' (with hidden window)
- '<SYSTEM32>\sc.exe' create cgxuhykr binPath= "<SYSTEM32>\cgxuhykr\uhvyaayl.exe /d\"<Full path to file>\"" type= own start= auto DisplayName= "wifi support"' (with hidden window)
- '<SYSTEM32>\sc.exe' description cgxuhykr "wifi internet conection"' (with hidden window)
- '<SYSTEM32>\sc.exe' start cgxuhykr' (with hidden window)
Executes the following
- '<SYSTEM32>\cmd.exe' /C mkdir <SYSTEM32>\cgxuhykr\
- '<SYSTEM32>\cmd.exe' /C move /Y "%TEMP%\uhvyaayl.exe" <SYSTEM32>\cgxuhykr\
- '<SYSTEM32>\sc.exe' create cgxuhykr binPath= "<SYSTEM32>\cgxuhykr\uhvyaayl.exe /d\"<Full path to file>\"" type= own start= auto DisplayName= "wifi support"
- '<SYSTEM32>\sc.exe' description cgxuhykr "wifi internet conection"
- '<SYSTEM32>\sc.exe' start cgxuhykr
- '<SYSTEM32>\svchost.exe'
