Technical Information
To ensure autorun and distribution
Creates the following services
- [<HKLM>\System\CurrentControlSet\Services\mgfgdpsz] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\mgfgdpsz] 'ImagePath' = '<SYSTEM32>\mgfgdpsz\lfheyuej.exe /d"<Full path to file>"'
- [<HKLM>\SYSTEM\CurrentControlSet\services\mgfgdpsz] 'ImagePath' = '<SYSTEM32>\mgfgdpsz\lfheyuej.exe'
Malicious functions
Injects code into
the following system processes:
- <SYSTEM32>\svchost.exe
Modifies file system
Creates the following files
- %TEMP%\lfheyuej.exe
- C:\documents and settings\localservice:.repos
Moves the following files
- from %TEMP%\lfheyuej.exe to <SYSTEM32>\mgfgdpsz\lfheyuej.exe
Deletes itself.
Network activity
Connects to
- 'as###.daum.net':25
- 'ms#####p-mx2.hinet.net':25
- 'aspmx.l.google.com':25
- 'mx####.##il.gm0.yahoodns.net':25
- 'mx#.##emonmail.net':25
- 'ma##.mc-link.it':25
- 'sm#####2.mygalbani.com':25
- 'sm##.##cureserver.net':25
- 'mx#.####.opal-solutions.com':25
- 'mx.####ta.toscana.it':25
- 'mx.###compra.com.br':25
- 'da#####h1.secoges.com':25
- 'fp##.mail.dk':25
- 'i.###tagram.com':443
- 'ho#########.olc.protection.outlook.com':25
- 'mx###.##il.am0.yahoodns.net':25
- 'mx##.#mig.gmx.net':25
- 'mx#######.mail.am0.yahoodns.net':25
- 'mx#.has.dk':25
- 'em#.mail.ru':25
- 'mx#.mail.ru':25
- 'mx#.##aroutes.com':25
- 'gmail-smtp-in.l.google.com':25
- 'mt##.##0.yahoodns.net':25
- 'eu#.###.#rotection.outlook.com':25
- 'mx.##a.untd.com':25
- 'mx#.#clink.it':25
- '69.#1.136.5':443
- 'ma##.##mune.meda.mi.it':25
TCP
HTTP GET requests
- http://www.google.com/
- http://ap#.##address.com/myip
- http://ap#.#pify.org/
- http://ap#.##-cy.ru:35000/
UDP
- DNS ASK mi##########m.mail.protection.outlook.com
- DNS ASK mx#######.mail.am0.yahoodns.net
- DNS ASK ro##rs.com
- DNS ASK ya###.com.mx
- DNS ASK mx#.has.dk
- DNS ASK ha#.dk
- DNS ASK em#.mail.ru
- DNS ASK md##t.com
- DNS ASK mx#.##aroutes.com
- DNS ASK di####ifiedcpc.com
- DNS ASK mx.##a.untd.com
- DNS ASK ju##.com
- DNS ASK gm#.de
- DNS ASK ap#.#r-cy.ru
- DNS ASK pa##n.com
- DNS ASK th###ruled.com
- DNS ASK ri##o.cl
- DNS ASK ma##.#zeronline.com
- DNS ASK az###nline.com
- DNS ASK ri##.net.pl
- DNS ASK eu#.###.#rotection.outlook.com
- DNS ASK ho##ail.fr
- DNS ASK mx#.#omcast.net
- DNS ASK co##ast.net
- DNS ASK ya##o.es
- DNS ASK as###.daum.net
- DNS ASK mx##.#mig.gmx.net
- DNS ASK ya##o.de
- DNS ASK ma#l.dk
- DNS ASK i.###tagram.com
- DNS ASK ms#####p-mx2.hinet.net
- DNS ASK ms#.#inet.net
- DNS ASK ga###mini.it
- DNS ASK mx####.##il.gm0.yahoodns.net
- DNS ASK ao#.com
- DNS ASK mx#.##emonmail.net
- DNS ASK ho####yhomes.com
- DNS ASK ma##.mc-link.it
- DNS ASK sm#####2.mygalbani.com
- DNS ASK mc##ink.it
- DNS ASK la##alis.it
- DNS ASK sm##.##cureserver.net
- DNS ASK go##bcs.com
- DNS ASK sp##trum.it
- DNS ASK ho##ail.it
- DNS ASK mx#.####.opal-solutions.com
- DNS ASK kn#####geisking.co.uk
- DNS ASK mx.####ta.toscana.it
- DNS ASK us##.toscana.it
- DNS ASK da#####h1.secoges.com
- DNS ASK st##bla.it
- DNS ASK mx.###compra.com.br
- DNS ASK un####pra.com.br
- DNS ASK fp##.mail.dk
- DNS ASK wa###art.com
- DNS ASK co####.meda.mi.it
- DNS ASK mx####.##il.am0.yahoodns.net
- DNS ASK mx#.#clink.it
- DNS ASK si##.com
- DNS ASK google.com
- DNS ASK aspmx.l.google.com
- DNS ASK ka##an.com
- DNS ASK mx#.#anmail.net
- DNS ASK ha##ail.net
- DNS ASK cl######.us.messagelabs.com
- DNS ASK bs##i.com
- DNS ASK ho#########.olc.protection.outlook.com
- DNS ASK ho##ail.com
- DNS ASK vi#####br-mx.terra.com
- DNS ASK re###.sion.com
- DNS ASK 19#.###.#11.95.cbl.abuseat.org
- DNS ASK 19#.###.##1.95.sbl-xbl.spamhaus.org
- DNS ASK ma#######xcite.roc2.bluetie.com
- DNS ASK 19#.###.#11.95.zen.spamhaus.org
- DNS ASK ex##te.com
- DNS ASK mx#######201.gslb.pphosted.com
- DNS ASK ve##zon.com
- DNS ASK 19#.###.#11.95.bl.spamcop.net
- DNS ASK mt##.##0.yahoodns.net
- DNS ASK ya##o.com
- DNS ASK 19#.###.#11.95.dnsbl.sorbs.net
- DNS ASK 19#.###.211.95.in-addr.arpa
- DNS ASK te###.com.br
- DNS ASK sv#.com.ph
- DNS ASK fl##tsa.com
- DNS ASK a.##.#ildram.net
- DNS ASK mx###.##tispameurope.com
- DNS ASK mc##nk.it
- DNS ASK de##n.ph
- DNS ASK mx#.mail.ru
- DNS ASK ma#l.ru
- DNS ASK wa##art.com
- DNS ASK mx#.##taguard.no
- DNS ASK da###uard.no
- DNS ASK gmail-smtp-in.l.google.com
- DNS ASK gm##l.com
- DNS ASK no###.#ai-wetherill.com
- DNS ASK wa####therill.com
- DNS ASK in####d.smtp.vt.edu
- DNS ASK vt.edu
- DNS ASK alt1.aspmx.l.google.com
- DNS ASK la###ge-na.com
- DNS ASK mx#.###denast.iphmx.com
- DNS ASK co###nast.com
- DNS ASK mx###.##il.am0.yahoodns.net
- DNS ASK ya##o.fr
- DNS ASK ma####.exxonmobil.com
- DNS ASK ex###mobil.com
- DNS ASK mx#.#noinc.com
- DNS ASK co##eco.com
- DNS ASK f2#.com
- DNS ASK ma##.##mune.meda.mi.it
- '<DNS_SERVER>':53
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\mgfgdpsz\lfheyuej.exe' /d"<Full path to file>"
- '<SYSTEM32>\cmd.exe' /C mkdir <SYSTEM32>\mgfgdpsz\' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C move /Y "%TEMP%\lfheyuej.exe" <SYSTEM32>\mgfgdpsz\' (with hidden window)
- '<SYSTEM32>\sc.exe' create mgfgdpsz binPath= "<SYSTEM32>\mgfgdpsz\lfheyuej.exe /d\"<Full path to file>\"" type= own start= auto DisplayName= "wifi support"' (with hidden window)
- '<SYSTEM32>\sc.exe' description mgfgdpsz "wifi internet conection"' (with hidden window)
- '<SYSTEM32>\sc.exe' start mgfgdpsz' (with hidden window)
Executes the following
- '<SYSTEM32>\cmd.exe' /C mkdir <SYSTEM32>\mgfgdpsz\
- '<SYSTEM32>\cmd.exe' /C move /Y "%TEMP%\lfheyuej.exe" <SYSTEM32>\mgfgdpsz\
- '<SYSTEM32>\sc.exe' create mgfgdpsz binPath= "<SYSTEM32>\mgfgdpsz\lfheyuej.exe /d\"<Full path to file>\"" type= own start= auto DisplayName= "wifi support"
- '<SYSTEM32>\sc.exe' description mgfgdpsz "wifi internet conection"
- '<SYSTEM32>\sc.exe' start mgfgdpsz
- '<SYSTEM32>\svchost.exe'
