Technical Information
To ensure autorun and distribution
Creates the following services
- [<HKLM>\System\CurrentControlSet\Services\eikhtmkc] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\eikhtmkc] 'ImagePath' = '<SYSTEM32>\eikhtmkc\dpqkfbcz.exe /d"<Full path to file>"'
- [<HKLM>\SYSTEM\CurrentControlSet\services\eikhtmkc] 'ImagePath' = '<SYSTEM32>\eikhtmkc\dpqkfbcz.exe'
Malicious functions
Injects code into
the following system processes:
- <SYSTEM32>\svchost.exe
Modifies file system
Creates the following files
- %TEMP%\dpqkfbcz.exe
- C:\documents and settings\localservice:.repos
Moves the following files
- from %TEMP%\dpqkfbcz.exe to <SYSTEM32>\eikhtmkc\dpqkfbcz.exe
Deletes itself.
Network activity
Connects to
- 'mx####.##il.gm0.yahoodns.net':25
TCP
HTTP GET requests
- http://www.google.com/
UDP
- DNS ASK mi##########m.mail.protection.outlook.com
- DNS ASK il##.com
- DNS ASK ft#.ilog.fr
- DNS ASK ap####.samoatelco.com
- DNS ASK oa##ood.org
- DNS ASK kp.org
- DNS ASK mx#######703.gslb.pphosted.com
- DNS ASK sp####um-health.org
- DNS ASK mx#######201.gslb.pphosted.com
- DNS ASK ca##er.org
- DNS ASK mx#.###00635.iphmx.com
- DNS ASK km###twork.org
- DNS ASK ok##s.org
- DNS ASK ma###wi5.ok.gov
- DNS ASK ya##o.fr
- DNS ASK mx###.##il.am0.yahoodns.net
- DNS ASK al##el.net
- DNS ASK ch#####nsmemorial.org
- DNS ASK ma##.b-io.co
- DNS ASK hy###quest.com
- DNS ASK mx#.qq.com
- DNS ASK go##pe.com
- DNS ASK ha###ywood.com
- DNS ASK he####riscoe.com
- DNS ASK he########oe.com.1.0001.arsmtp.com
- DNS ASK ma#.com
- DNS ASK mx#.##il.icloud.com
- DNS ASK ho##op.com
- DNS ASK ma##.#-email.net
- DNS ASK li#e.ca
- DNS ASK na#.###.#rotection.outlook.com
- DNS ASK bv#.net
- DNS ASK mx#.##ailsrvr.com
- DNS ASK ym##l.com
- DNS ASK hu####office.com
- DNS ASK no##ail.com
- DNS ASK mx#.##upalotos.pl
- DNS ASK mx#######f01.gslb.pphosted.com
- DNS ASK sm##.#osting.tp.pl
- DNS ASK ma#####dit.neostrada.pl
- DNS ASK ok##k.co.uk
- DNS ASK cl######.eu.messagelabs.com
- DNS ASK no#######onroad.freeserve.co.uk
- DNS ASK ba#####cotland.co.uk
- DNS ASK ti###linet.it
- DNS ASK et###.#ail.tiscali.it
- DNS ASK om###neusa.com
- DNS ASK ya##o.de
- DNS ASK no#s.fr
- DNS ASK sm###in.sfr.fr
- DNS ASK ao#.com
- DNS ASK mx####.##il.gm0.yahoodns.net
- DNS ASK ma####m-group.com
- DNS ASK wo##mac.com
- DNS ASK mx#######701.gslb.pphosted.com
- DNS ASK google.com
- DNS ASK yr##.com
- DNS ASK lo###paliwa.pl
- DNS ASK si##.com
- DNS ASK fr#####.#inamail.sina.com.cn
- DNS ASK st##ck.pl
- DNS ASK pg##oe.net
- DNS ASK pg########.mail.protection.outlook.com
- DNS ASK al##ata.net
- DNS ASK cl######.us.messagelabs.com
- DNS ASK al###ream.net
- DNS ASK mx####.#egamailservers.com
- DNS ASK ms#.#inet.net
- DNS ASK ms#####p-mx1.hinet.net
- DNS ASK ms##.hinet.net
- DNS ASK ms#####p-mx2.hinet.net
- DNS ASK ed###esse.pl
- DNS ASK sm##.#dipresse.pl
- DNS ASK vo##e.co.uk
- DNS ASK ne###rada.pl
- DNS ASK qq.com
- DNS ASK mx##.#indstream.net
- DNS ASK cc##.net
- DNS ASK aspmx.l.google.com
- DNS ASK ya##o.com
- DNS ASK mt##.##0.yahoodns.net
- DNS ASK ho##ail.com
- DNS ASK ho#########.olc.protection.outlook.com
- DNS ASK gt######0.grupotpc.com.br
- DNS ASK sh#w.ca
- DNS ASK fd#.com
- DNS ASK ms#.com
- DNS ASK ms#####.##c.protection.outlook.com
- DNS ASK ad###are.com
- DNS ASK vi##o.net
- DNS ASK vi#######.#ail.protection.outlook.com
- DNS ASK sm##.##b.shawcable.net
- DNS ASK co###bia.com.br
- DNS ASK ac###igh.com
- DNS ASK a-####onsulting.com
- DNS ASK 19#.###.211.95.in-addr.arpa
- DNS ASK ho###il.co.uk
- DNS ASK 19#.###.#11.95.dnsbl.sorbs.net
- DNS ASK eu#.###.#rotection.outlook.com
- DNS ASK co##ast.net
- DNS ASK 19#.###.#11.95.bl.spamcop.net
- DNS ASK mx#.#omcast.net
- DNS ASK ha##ail.net
- DNS ASK 19#.###.#11.95.zen.spamhaus.org
- DNS ASK mx#.#anmail.net
- DNS ASK ea###link.net
- DNS ASK mx#.##rthlink.net
- DNS ASK 19#.###.##1.95.sbl-xbl.spamhaus.org
- DNS ASK to##to.com
- DNS ASK 19#.###.#11.95.cbl.abuseat.org
- DNS ASK ae#####cisioncorp.com
- DNS ASK gl########cipal.com.1.arsmtp.com
- DNS ASK om###acific.com
- DNS ASK gl####principal.com
- DNS ASK mx###.in-mx.net
- DNS ASK ca###one.net
- DNS ASK mx.##bleone.net
- DNS ASK le##an.com
- DNS ASK ry####mpanies.com
- DNS ASK mx#.###ncompanies.com
- DNS ASK sa####-aventis.com
- DNS ASK xs#####656b.sanofi.com
- DNS ASK pe####brasive.com
- DNS ASK d1######.#ss.barracudanetworks.com
- DNS ASK ex##te.com
- DNS ASK ma#######xcite.roc2.bluetie.com
- DNS ASK fi######lsystemsgroup.com
- DNS ASK gi###ndunn.com
- DNS ASK mx#.####ondunn.iphmx.com
- DNS ASK ne###ard.com
- DNS ASK an###gic.com
- DNS ASK sm##.##cureserver.net
- DNS ASK au#######nbound-1.mimecast.com
- DNS ASK sb##.net
- DNS ASK ma#####rtual.gwtc.net
- DNS ASK no###state.net
- DNS ASK no########.net.mx1.nstel.rcimx.net
- DNS ASK aq####crehab.com
- DNS ASK av####aconsult.com
- DNS ASK ma##.##rasyaconsult.com
- DNS ASK sh###tel.net
- DNS ASK ba######apitalonline.com
- DNS ASK bt##a.com
- DNS ASK ct.###itoltitle.com
- DNS ASK dw#.com
- DNS ASK alt2.aspmx.l.google.com
- DNS ASK pi##et.net
- DNS ASK cl###onutz.com
- DNS ASK bc##eo.com
- DNS ASK an##########.mail.protection.outlook.com
- '<DNS_SERVER>':53
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\eikhtmkc\dpqkfbcz.exe' /d"<Full path to file>"
- '<SYSTEM32>\cmd.exe' /C mkdir <SYSTEM32>\eikhtmkc\' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C move /Y "%TEMP%\dpqkfbcz.exe" <SYSTEM32>\eikhtmkc\' (with hidden window)
- '<SYSTEM32>\sc.exe' create eikhtmkc binPath= "<SYSTEM32>\eikhtmkc\dpqkfbcz.exe /d\"<Full path to file>\"" type= own start= auto DisplayName= "wifi support"' (with hidden window)
- '<SYSTEM32>\sc.exe' description eikhtmkc "wifi internet conection"' (with hidden window)
- '<SYSTEM32>\sc.exe' start eikhtmkc' (with hidden window)
Executes the following
- '<SYSTEM32>\cmd.exe' /C mkdir <SYSTEM32>\eikhtmkc\
- '<SYSTEM32>\cmd.exe' /C move /Y "%TEMP%\dpqkfbcz.exe" <SYSTEM32>\eikhtmkc\
- '<SYSTEM32>\sc.exe' create eikhtmkc binPath= "<SYSTEM32>\eikhtmkc\dpqkfbcz.exe /d\"<Full path to file>\"" type= own start= auto DisplayName= "wifi support"
- '<SYSTEM32>\sc.exe' description eikhtmkc "wifi internet conection"
- '<SYSTEM32>\sc.exe' start eikhtmkc
- '<SYSTEM32>\svchost.exe'
