Technical Information
To ensure autorun and distribution
Creates the following services
- [<HKLM>\System\CurrentControlSet\Services\xqwjoypt] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\xqwjoypt] 'ImagePath' = '<SYSTEM32>\xqwjoypt\fsgjlljw.exe /d"<Full path to file>"'
- [<HKLM>\SYSTEM\CurrentControlSet\services\xqwjoypt] 'ImagePath' = '<SYSTEM32>\xqwjoypt\fsgjlljw.exe'
Malicious functions
Injects code into
the following system processes:
- <SYSTEM32>\svchost.exe
Modifies file system
Creates the following files
- %TEMP%\fsgjlljw.exe
- C:\documents and settings\localservice:.repos
Moves the following files
- from %TEMP%\fsgjlljw.exe to <SYSTEM32>\xqwjoypt\fsgjlljw.exe
Deletes itself.
Network activity
Connects to
- 'mx#.gmx.com':25
- 'ip##fo.io':80
- 'ma###.afip.gov.ar':25
- 'ma##.koptur.com':25
- 'do##########-ru.mail.protection.outlook.com':25
- 'za###########com.mail.protection.outlook.com':25
- 'ho#########.olc.protection.outlook.com':25
- 'mx#.##lkomsa.net':25
- 'fo###########ic-service-prod11.ol.epicgames.com':443
- 'mx#######d02.gslb.pphosted.com':25
- 'mx.##.#tinternet.com':25
- 'sm###.chaco.gob.ar':25
- 'mx.##.#topenworld.com':25
- 'mx.###.##mail.iss.as9143.net':25
- 'ma#####ver.faa.mil.ar':25
- 'ma###.gosnadzor.ru':25
- 'mx##.mb1p.com':25
- 'um####.hinet.net':25
- 're####0.uncu.edu.ar':25
- 'mx.##a.untd.com':25
- 'sm###.azet.sk':25
- 'mx#.#harter.net':25
- 'as#####20.oracle.com':25
- 'ma#######r-01.cybertech.com.ar':25
- 'fo#########blic-api.theapinetwork.com':443
- 'mx######b2d01.pphosted.com':25
- 'Ma##.tcnp.ru':25
- 'ma##.#abe.com.ar':25
- 're###.sion.com':25
- 'alt1.gmail-smtp-in.l.google.com':25
- '14#.#6.108.92':481
- 'mx#.#otmail.com':25
- 'sm##.##cureserver.net':25
- 'mt##.##0.yahoodns.net':25
- 'aspmx.l.google.com':25
- 'gmail-smtp-in.l.google.com':25
- 'eu#.###.#rotection.outlook.com':25
- 'mx###.##il.am0.yahoodns.net':25
- 'um#########.mail.protection.outlook.com':25
- 'mx.##teria.pl':25
- 'localhost':25
- 'mx###.#olarwinds.com':25
- 'alt2.gmail-smtp-in.l.google.com':25
- 'un########.mail.protection.outlook.com':25
- 'mx#####.#ail.gm0.yahoodns.net':25
- 'mx#.#omcast.net':25
- 'alt4.gmail-smtp-in.l.google.com':25
- 'ac###########c-service-prod03.ol.epicgames.com':443
- 'jc#####ibuicao.com.br':25
- 'mx#######001.gslb.pphosted.com':25
- 'd2#####.##s.barracudanetworks.com':25
- 'mx#.mail.ru':25
- 've##########m.mail.protection.outlook.com':25
- 'tn####.telefonica.net':25
- 'sm######n-1.mecon.gov.ar':25
- '69.#1.136.5':443
- 'mx.yandex.ru':25
- 'alt3.gmail-smtp-in.l.google.com':25
- 'mx#.##h.iphmx.com':25
- 'mx##.mail.com':25
- 'mx#.#atacomm.ch':25
- 'ji##.##co.unpa.edu.ar':25
- 'mx#.##il.aliyun.com':25
TCP
HTTP GET requests
- http://www.google.com/
- http://ap#.##-cy.ru:35000/
UDP
- DNS ASK mi##########m.mail.protection.outlook.com
- DNS ASK do##or.com
- DNS ASK mx##.mail.com
- DNS ASK vt##ail.ch
- DNS ASK mx#.#atacomm.ch
- DNS ASK ua##.#npa.edu.ar
- DNS ASK ji##.##co.unpa.edu.ar
- DNS ASK ac###########c-service-prod03.ol.epicgames.com
- DNS ASK ku##nir.ru
- DNS ASK ip##fo.io
- DNS ASK af##.gov.ar
- DNS ASK ho#########.olc.protection.outlook.com
- DNS ASK ma###.afip.gov.ar
- DNS ASK ma##.com
- DNS ASK ko##ur.com
- DNS ASK ma##.koptur.com
- DNS ASK do###ospizza.ru
- DNS ASK do##########-ru.mail.protection.outlook.com
- DNS ASK za.###marine.com
- DNS ASK za###########com.mail.protection.outlook.com
- DNS ASK ho##ail.com
- DNS ASK mx#.##h.iphmx.com
- DNS ASK ya#####akwireless.com
- DNS ASK wa##aco.com
- DNS ASK kh##sa.com
- DNS ASK mx#####.#ail.gm0.yahoodns.net
- DNS ASK co##ast.net
- DNS ASK mx#.#omcast.net
- DNS ASK d-##y.com
- DNS ASK sm##.##cureserver.net
- DNS ASK da##wing.ru
- DNS ASK up##scs.com
- DNS ASK mx#######001.gslb.pphosted.com
- DNS ASK jc#####ibuicao.com.br
- DNS ASK da####systems.com
- DNS ASK su###prices.ru
- DNS ASK d2#####.##s.barracudanetworks.com
- DNS ASK ma#l.ru
- DNS ASK mx#.mail.ru
- DNS ASK ve###xinc.com
- DNS ASK ve##########m.mail.protection.outlook.com
- DNS ASK te###onica.net
- DNS ASK tn####.telefonica.net
- DNS ASK me###.gov.ar
- DNS ASK sm######n-1.mecon.gov.ar
- DNS ASK mx.yandex.ru
- DNS ASK te###msa.net
- DNS ASK mx#.##lkomsa.net
- DNS ASK wa##og.ru
- DNS ASK as#####20.oracle.com
- DNS ASK cy####ech.com.ar
- DNS ASK ma#######r-01.cybertech.com.ar
- DNS ASK be###yone.ru
- DNS ASK fo#########blic-api.theapinetwork.com
- DNS ASK br.#bm.com
- DNS ASK mx######b2d01.pphosted.com
- DNS ASK ra##.com.ar
- DNS ASK si##huk.ru
- DNS ASK or##le.com
- DNS ASK ma##.#abe.com.ar
- DNS ASK mc##il.com
- DNS ASK qi#.ru
- DNS ASK co####orfac.com.co
- DNS ASK si##.com.ar
- DNS ASK re###.sion.com
- DNS ASK al##un.com
- DNS ASK mx#.##il.aliyun.com
- DNS ASK go###dzor.ru
- DNS ASK tc#p.ru
- DNS ASK Ma##.tcnp.ru
- DNS ASK sa######obalseguros.com.ar
- DNS ASK mx.##a.untd.com
- DNS ASK ne##ero.com
- DNS ASK zu##ch.com
- DNS ASK mx#######d02.gslb.pphosted.com
- DNS ASK bt###ernet.com
- DNS ASK mx.##.#tinternet.com
- DNS ASK ec####aco.com.ar
- DNS ASK sm###.chaco.gob.ar
- DNS ASK go##girl.ru
- DNS ASK bt###nworld.com
- DNS ASK mx.##.#topenworld.com
- DNS ASK fo###########ic-service-prod11.ol.epicgames.com
- DNS ASK fa#.mil.ar
- DNS ASK in##rmod.ru
- DNS ASK ne#.com
- DNS ASK mx##.mb1p.com
- DNS ASK um###.hinet.net
- DNS ASK um####.hinet.net
- DNS ASK un##.edu.ar
- DNS ASK re####0.uncu.edu.ar
- DNS ASK au##mix.ru
- DNS ASK wh###pool.com
- DNS ASK ma#####ver.faa.mil.ar
- DNS ASK ya##o.in
- DNS ASK ma###.gosnadzor.ru
- DNS ASK un########.mail.protection.outlook.com
- DNS ASK ve####ouveuse.tk
- DNS ASK ho##ail.fr
- DNS ASK eu#.###.#rotection.outlook.com
- DNS ASK se###l.com.br
- DNS ASK pa##comp.ru
- DNS ASK alt1.aspmx.l.google.com
- DNS ASK ex#####vegroup-ae.com
- DNS ASK ho#e.pl
- DNS ASK ma####.home.net.pl
- DNS ASK tm##l.com
- DNS ASK ya##o.it
- DNS ASK gu###rgems.com
- DNS ASK mx###.##il.am0.yahoodns.net
- DNS ASK sf#.com
- DNS ASK in.###.trendmicro.com
- DNS ASK fa#####vilareal.com.br
- DNS ASK ma########.fazendavilareal.com.br
- DNS ASK ti#.it
- DNS ASK sm##.tin.it
- DNS ASK ch##ter.net
- DNS ASK mx#.#harter.net
- DNS ASK mx.###.##mail.iss.as9143.net
- DNS ASK alt1.gmail-smtp-in.l.google.com
- DNS ASK nt###rld.com
- DNS ASK sm####n.inwind.it
- DNS ASK 19#.###.211.95.in-addr.arpa
- DNS ASK co###rix.co.uk
- DNS ASK re###lypf.com
- DNS ASK es######eteixeira.com.br
- DNS ASK ma##.####nolaeteixeira.com.br
- DNS ASK ex##te.com
- DNS ASK ma#######xcite.roc2.bluetie.com
- DNS ASK in##nd.it
- DNS ASK 19#.###.#11.95.dnsbl.sorbs.net
- DNS ASK ur###oloto.ru
- DNS ASK ya##o.com
- DNS ASK 19#.###.#11.95.bl.spamcop.net
- DNS ASK 19#.###.#11.95.zen.spamhaus.org
- DNS ASK mx#.#otmail.com
- DNS ASK alt3.gmail-smtp-in.l.google.com
- DNS ASK ro###ear.com
- DNS ASK alt2.aspmx.l.google.com
- DNS ASK 19#.###.##1.95.sbl-xbl.spamhaus.org
- DNS ASK mt##.##0.yahoodns.net
- DNS ASK 19#.###.#11.95.cbl.abuseat.org
- DNS ASK us#######nbound-1.mimecast.com
- DNS ASK aspmx.l.google.com
- DNS ASK sm####ctrical.com
- DNS ASK ma##.####erminingamerica.com
- DNS ASK az#t.sk
- DNS ASK sm###.azet.sk
- DNS ASK un####ldindia.org
- DNS ASK uz#t.ru
- DNS ASK mx.##ndex.net
- DNS ASK alt2.gmail-smtp-in.l.google.com
- DNS ASK ap#.#r-cy.ru
- DNS ASK gr###iti.net
- DNS ASK te###-tatra.com
- DNS ASK ma####flowers.com
- DNS ASK mx#.gmx.com
- DNS ASK um##ore.com
- DNS ASK um#########.mail.protection.outlook.com
- DNS ASK in##ria.pl
- DNS ASK mx.##teria.pl
- DNS ASK vi##ail.net
- DNS ASK da###are.com
- DNS ASK mx###.#olarwinds.com
- DNS ASK mi##trel.ru
- DNS ASK tr###icmp.com
- DNS ASK pr###otos.ru
- DNS ASK ya##o.fr
- DNS ASK google.com
- DNS ASK ad#e.ru
- DNS ASK fo##v.se
- DNS ASK ma######ection01.atea.se
- DNS ASK ca##v.net
- DNS ASK re####n.cantv.net
- DNS ASK in####ourism.com
- DNS ASK ko##stat.ru
- DNS ASK mx#.##stinger.ru
- DNS ASK sn##on.com
- DNS ASK gm##l.com
- DNS ASK f6#.#skorea.com
- DNS ASK gmail-smtp-in.l.google.com
- DNS ASK ms.##sma.net.sa
- DNS ASK ya##o.ca
- DNS ASK it##sib.ru
- DNS ASK ed##.itc-sib.ru
- DNS ASK alt4.gmail-smtp-in.l.google.com
- DNS ASK te###uity.com
- DNS ASK ci###orp.com
- DNS ASK mx##.#ail.citi.com
- DNS ASK so#####nesmro.com.ar
- DNS ASK ne###.net.sa
- DNS ASK un##ys.com
- DNS ASK we##88.com
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\xqwjoypt\fsgjlljw.exe' /d"<Full path to file>"
- '<SYSTEM32>\cmd.exe' /C mkdir <SYSTEM32>\xqwjoypt\' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C move /Y "%TEMP%\fsgjlljw.exe" <SYSTEM32>\xqwjoypt\' (with hidden window)
- '<SYSTEM32>\sc.exe' create xqwjoypt binPath= "<SYSTEM32>\xqwjoypt\fsgjlljw.exe /d\"<Full path to file>\"" type= own start= auto DisplayName= "wifi support"' (with hidden window)
- '<SYSTEM32>\sc.exe' description xqwjoypt "wifi internet conection"' (with hidden window)
- '<SYSTEM32>\sc.exe' start xqwjoypt' (with hidden window)
Executes the following
- '<SYSTEM32>\cmd.exe' /C mkdir <SYSTEM32>\xqwjoypt\
- '<SYSTEM32>\cmd.exe' /C move /Y "%TEMP%\fsgjlljw.exe" <SYSTEM32>\xqwjoypt\
- '<SYSTEM32>\sc.exe' create xqwjoypt binPath= "<SYSTEM32>\xqwjoypt\fsgjlljw.exe /d\"<Full path to file>\"" type= own start= auto DisplayName= "wifi support"
- '<SYSTEM32>\sc.exe' description xqwjoypt "wifi internet conection"
- '<SYSTEM32>\sc.exe' start xqwjoypt
- '<SYSTEM32>\svchost.exe'
