Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKLM\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon] 'Userinit' = 'userinit.exe,%LOCALAPPDATA%\jbsnbtbn\rekalwkb.exe'
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'RekAlwkb' = '%LOCALAPPDATA%\jbsnbtbn\rekalwkb.exe'
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\rekalwkb.exe
Sets the following service settings
- [HKLM\System\CurrentControlSet\Services\Micorsoft Windows Service] 'ImagePath' = '%TEMP%\ysihotdq.sys'
Creates the following services
- 'Micorsoft Windows Service' %TEMP%\ysihotdq.sys
Malicious functions
To bypass firewall, removes or modifies the following registry keys
- [HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'EnableFirewall' = '00000000'
- [HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'DoNotAllowExceptions' = '00000000'
- [HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'DisableNotifications' = '00000001'
To complicate detection of its presence in the operating system,
blocks execution of the following system utilities:
- Windows Firewall
- Windows Update
- Windows Security Center
- Windows Defender
blocks the following features:
- User Account Control (UAC)
- Windows Security Center
Injects code into
the following system processes:
- %WINDIR%\syswow64\svchost.exe
Modifies file system
Creates the following files
- %TEMP%\jmfunyjk.exe
- %ALLUSERSPROFILE%\glfqckjy.log
- %LOCALAPPDATA%\skwsevcx.log
- %LOCALAPPDATA%\jbsnbtbn\rekalwkb.exe
- %TEMP%\ysihotdq.sys
Sets the 'hidden' attribute to the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\rekalwkb.exe
Deletes the following files
- %TEMP%\ysihotdq.sys
Network activity
Connects to
- 'mb#####qkbfmhhsbh.com':443
- 'google.com':80
- 'ck####ltviespq.com':443
- 'ia###hrcy.com':443
TCP
Other
- 'mb#####qkbfmhhsbh.com':443
- 'ck####ltviespq.com':443
UDP
- DNS ASK mb#####qkbfmhhsbh.com
- DNS ASK pi#####cpfvosufk.com
- DNS ASK ma###cijblq.com
- DNS ASK qm####wjxhqwbn.com
- DNS ASK wl####emqiefh.com
- DNS ASK iq#####rwwxkgmpea.com
- DNS ASK hr#####wxlbqclhcn.com
- DNS ASK af###tckdf.com
- DNS ASK bw####bnfguesq.com
- DNS ASK ek###dqawvu.com
- DNS ASK jv#####svmawhalv.com
- DNS ASK be#####hetlyyxrc.com
- DNS ASK rn####hmohmjnf.com
- DNS ASK uh###oqqd.com
- DNS ASK mk###lgp.com
- DNS ASK ek###kgftta.com
- DNS ASK su###woocr.com
- DNS ASK hv#####myuxhgstejc.com
- DNS ASK fh###gfqm.com
- DNS ASK ff###fed.com
- DNS ASK kr###fkccem.com
- DNS ASK cj#####nsaatphlnunn.com
- DNS ASK br####gkqcrljiu.com
- DNS ASK aj###syqr.com
- DNS ASK yy####gmvujygy.com
- DNS ASK ek###hum.com
- DNS ASK vn###bhe.com
- DNS ASK di####tviwbwkr.com
- DNS ASK so#####snyrnqkej.com
- DNS ASK la###emn.com
- DNS ASK hr####fkfwcmrj.com
- DNS ASK lf####nojggswf.com
- DNS ASK gh####bneloql.com
- DNS ASK rx#####rwbsnfojchmb.com
- DNS ASK gq#####nas##jtovw.com
- DNS ASK xy####eysskltvp.com
- DNS ASK hn####ifutiw.com
- DNS ASK fd####kcifcfuc.com
- DNS ASK rj###rix.com
- DNS ASK ms###deqemx.com
- DNS ASK hg####gnfhoxrl.com
- DNS ASK ib####dgcysdcg.com
- DNS ASK tw#####uatamcnwnujw.com
- DNS ASK bq####cpowkykgf.com
- DNS ASK vf###dmyrr.com
- DNS ASK lu####pjjmnab.com
- DNS ASK ck#####pdxvlhkaghyl.com
- DNS ASK bk#####cjwyaflaq.com
- DNS ASK vw####bbajmxcvj.com
- DNS ASK nq#####nkuwtuswow.com
- DNS ASK xq#####nsmqqgcsam.com
- DNS ASK ek#####ttnctksfkeyv.com
- DNS ASK qi#####dcpdihgnqp.com
- DNS ASK qn###apb.com
- DNS ASK mo###fybgu.com
- DNS ASK bp###oqk.com
- DNS ASK yf#####dtudsugvdtkr.com
- DNS ASK mi#####ktkhuwaoytk.com
- DNS ASK wv####waoqhqodk.com
- DNS ASK rd#####gyiwwlbreb.com
- DNS ASK pc###ghh.com
- DNS ASK wr####vaburxh.com
- DNS ASK yu#####fyejgsnrd.com
- DNS ASK ny####osvojvug.com
- DNS ASK ud####rfgcmrwjp.com
- DNS ASK ag####xjdsqhye.com
- DNS ASK gk#####ffueuliggoe.com
- DNS ASK xi###fban.com
- DNS ASK cc####okhhyxp.com
- DNS ASK fv###cjeky.com
- DNS ASK dh#####tqjgllypguqw.com
- DNS ASK nj####fvchuchv.com
- DNS ASK gm#####msrkgaeqm.com
- DNS ASK jr###wvmg.com
- DNS ASK gv#####hpdulyditrh.com
- DNS ASK rg###xmwbo.com
- DNS ASK nh###hfiqep.com
- DNS ASK st#####gqvkwmuab.com
- DNS ASK xn#####qetadphwm.com
- DNS ASK fh###bhxa.com
- DNS ASK py#####wcfambovrxy.com
- DNS ASK ys###nopd.com
- DNS ASK my###freu.com
- DNS ASK ru###nnpotk.com
- DNS ASK yi#####ifgvqubce.com
- DNS ASK gr####vskauagle.com
- DNS ASK dd###ysps.com
- DNS ASK ea###jyiqkj.com
- DNS ASK do#####unuafpjaf.com
- DNS ASK eh####gjutaes.com
- DNS ASK il####meddgjyun.com
- DNS ASK cu####ixmqms.com
- DNS ASK nu####btyjec.com
- DNS ASK ch####uobyur.com
- DNS ASK xu#####jlktixpbarjf.com
- DNS ASK cr###mgatk.com
- DNS ASK nt#####iggvjqugrd.com
- DNS ASK au####qegixfdl.com
- DNS ASK dr###adt.com
- DNS ASK ia####pglcxq.com
- DNS ASK ee####caphsw.com
- DNS ASK so#####gabyqofac.com
- DNS ASK kh#####tlstoevnry.com
- DNS ASK ty####tygvteg.com
- DNS ASK wb####hqckinimw.com
- DNS ASK pa####ukffbagn.com
- DNS ASK cu###tnwlm.com
- DNS ASK eb####satalkn.com
- DNS ASK xd###ipkq.com
- DNS ASK on#####ydxikojfhfy.com
- DNS ASK mq#####ovyjmwqqbh.com
- DNS ASK uq#####csipiblph.com
- DNS ASK bg####ykkgyrswt.com
- DNS ASK qi####rikjxm.com
- DNS ASK ac###dbfibi.com
- DNS ASK ap###chhvd.com
- DNS ASK pn#####iemjvbdif.com
- DNS ASK df####ojxqdvpok.com
- DNS ASK vh#####jvkrrpaoreh.com
- DNS ASK jv#####ufntnnxclbpv.com
- DNS ASK ia###hrcy.com
- DNS ASK dt####slyjatusl.com
- DNS ASK ox###txusq.com
- DNS ASK gd#####ibdnckcit.com
- DNS ASK ky####hcggxeci.com
- DNS ASK ke###lvv.com
- DNS ASK ws####nckmmev.com
- DNS ASK wk###spswbf.com
- DNS ASK ry#####fgeouuwkgmys.com
- DNS ASK google.com
- DNS ASK ck####ltviespq.com
- DNS ASK oo####ayvbmwj.com
- DNS ASK gs#####jtfhhynbqep.com
- DNS ASK dh#####lkkfjvchbos.com
- DNS ASK ca#####gvacsmjvdeo.com
- DNS ASK lm#####rhrbkjpjm.com
- DNS ASK fk###tbip.com
- DNS ASK gk###sfp.com
- DNS ASK xh####jyyixvkkv.com
- DNS ASK rx#####mfajodqpya.com
- DNS ASK pb#####ggeshensvai.com
- DNS ASK ye#####xusokritv.com
- DNS ASK gc####dnytfex.com
- DNS ASK py####csqeqnmvh.com
- DNS ASK vm#####eixksivixx.com
- DNS ASK sk###rtjva.com
- DNS ASK ka#####ogsgfcuhqbu.com
- DNS ASK mo#####ljwkystfr.com
- DNS ASK xx#####yhccmqlnkuu.com
- DNS ASK bo#####aqqnditnbip.com
- DNS ASK px###cdw.com
- DNS ASK hu###isdcb.com
- DNS ASK hu#####dqtmyscbmywt.com
- DNS ASK wd####xtsscyre.com
- DNS ASK ww#####leixxcqshf.com
- DNS ASK ut###qhkiaw.com
- DNS ASK ao####hnnuth.com
- DNS ASK xp#####xokmmxtte.com
- DNS ASK kw###xtg.com
- DNS ASK sg####kwdhkcju.com
- DNS ASK ls###tgrnru.com
- DNS ASK wo####qwamtxo.com
- DNS ASK yk###xoek.com
- DNS ASK ae####fbwgpcjxu.com
- DNS ASK md#####qcqxfmdvopo.com
- DNS ASK np###lkho.com
- DNS ASK aj#####dhklscllkmn.com
- DNS ASK rt###wjnsib.com
- DNS ASK mh###kwoqaa.com
- DNS ASK sm#####ybkqxgggxi.com
- DNS ASK ba####ltopytrr.com
- DNS ASK oe####ubehaa.com
- DNS ASK yu####dclaqtp.com
- DNS ASK vg###okm.com
- DNS ASK ai###nuqm.com
- DNS ASK yn#####shgpdrvvi.com
- DNS ASK un#####jmnhnnghnw.com
- DNS ASK hv####sgosll.com
- DNS ASK yn####gabbuih.com
- DNS ASK rt###reg.com
- DNS ASK ii####icoaoeq.com
- DNS ASK ox###hkvjf.com
- DNS ASK gp####kgpysvrgi.com
- DNS ASK hp#####axleylunft.com
- DNS ASK ty#####mxirimafx.com
- DNS ASK vd#####vwepovavhcu.com
- DNS ASK pv####whjdsql.com
- DNS ASK hc####rivnuq.com
- DNS ASK uq#####agkhesefeje.com
- DNS ASK wt####picsawwrg.com
- DNS ASK kl#####jacuujdmi.com
- DNS ASK nj###cnew.com
- DNS ASK bk####swfleuvcn.com
- DNS ASK jd###fuf.com
- DNS ASK yw###mld.com
- DNS ASK om#####yapdirqvquph.com
- DNS ASK da####ajbaruitl.com
- DNS ASK sj#####kqqpnglnxeuy.com
- DNS ASK pj#####ocueeaptsl.com
- DNS ASK ys####khthspimi.com
- DNS ASK ww####oqwcodyhg.com
- 'localhost':55683
- 'localhost':64251
Miscellaneous
Creates and executes the following
- '%TEMP%\jmfunyjk.exe' elevate
- '%TEMP%\jmfunyjk.exe' admin
Executes the following
- '%WINDIR%\syswow64\svchost.exe'
- '%WINDIR%\syswow64\cmd.exe' /C ""%TEMP%\jmfunyjk.exe"" admin
- '%WINDIR%\syswow64\cmd.exe' /C ""%TEMP%\jmfunyjk.exe"" admin' (with hidden window)
