Technical Information
Malicious functions
Injects code into
the following system processes:
- %WINDIR%\syswow64\svchost.exe
Modifies file system
Creates the following files
- %HOMEPATH%:.repos
Network activity
Connects to
- 'rs####.##1-dk.mailanyone.net':25
- 'mt##.##0.yahoodns.net':25
TCP
HTTP GET requests
- http://www.google.com/
UDP
- DNS ASK microsoft.com
- DNS ASK pa###arget.com
- DNS ASK le##ns.com
- DNS ASK ms##.tcnoc.com
- DNS ASK ya##o.co.jp
- DNS ASK mx#.###l.yahoo.co.jp
- DNS ASK tt##wi.com
- DNS ASK mi####nsultores.cl
- DNS ASK wi##is.com
- DNS ASK mx#######c02.gslb.pphosted.com
- DNS ASK ar#######.theemaillaundry.net
- DNS ASK mx#.##il-scanner.eu
- DNS ASK do####shaftseal.com
- DNS ASK un##eld.com
- DNS ASK ma##.#niweld.com
- DNS ASK do###talia.com
- DNS ASK ma##.#omaitalia.com
- DNS ASK in###woven.com
- DNS ASK cu#####1.interwoven.com
- DNS ASK vi##ilio.it
- DNS ASK sm####n.virgilio.it
- DNS ASK le#####assurances.com
- DNS ASK mu####roposito.com
- DNS ASK ma##.#ailerhost.net
- DNS ASK mx#.##ailsrvr.com
- DNS ASK le##stro.fr
- DNS ASK mx##.#uphonynet.be
- DNS ASK ja######rencecompany.com
- DNS ASK sm##.##cureserver.net
- DNS ASK ja#####evalentine.com
- DNS ASK ja#####vinstudios.com
- DNS ASK mx#.##tsolmail.net
- DNS ASK ja###lhaner.com
- DNS ASK ja####iebherr.com
- DNS ASK ja###light.tv
- DNS ASK mx##.#and1.co.uk
- DNS ASK ha##ail.net
- DNS ASK le##.net
- DNS ASK mx#.#anmail.net
- DNS ASK mx###.##il.am0.yahoodns.net
- DNS ASK cr#####razycritters.com
- DNS ASK le###dex.com
- DNS ASK ya##o.fr
- DNS ASK eb####ineers.com
- DNS ASK ma##.##lengineers.com
- DNS ASK ro###tmail.com
- DNS ASK ms#.#inet.net
- DNS ASK ms#####p-mx1.hinet.net
- DNS ASK eu###nynet.be
- DNS ASK ya##o.de
- DNS ASK li#e.de
- DNS ASK hy##em.com
- DNS ASK we#####southernlife.com
- DNS ASK ya##o.co.in
- DNS ASK mx#####.#ail.gm0.yahoodns.net
- DNS ASK ma##.#28sign.com
- DNS ASK zu##ch.com
- DNS ASK la#####ercomunicare.it
- DNS ASK ma##.###etepercomunicare.it
- DNS ASK su###thq.com
- DNS ASK sk###den.com
- DNS ASK kp.org
- DNS ASK kc###ture.com
- DNS ASK im###tsci.com
- DNS ASK mx#######703.gslb.pphosted.com
- DNS ASK ma####.#ntercloud.com.bd
- DNS ASK an####onsinc.com
- DNS ASK mx#######401.gslb.pphosted.com
- DNS ASK te##s.net
- DNS ASK mx.##lus.net
- DNS ASK st###o36.co.za
- DNS ASK ma##.#tudio36.co.za
- DNS ASK yo####-optical.com
- DNS ASK dg######.yorkey-optical.com
- DNS ASK ed###n-bd.com
- DNS ASK ip##fo.io
- DNS ASK om###el.net.om
- DNS ASK d8#####.##s.barracudanetworks.com
- DNS ASK d1######.#ss.barracudanetworks.com
- DNS ASK mx#.#sfgrp.com
- DNS ASK al###ost.com
- DNS ASK mx##.1and1.com
- DNS ASK ca####chemicals.com
- DNS ASK jo###goal.org
- DNS ASK gr###-ellis.com
- DNS ASK mx#######602.gslb.pphosted.com
- DNS ASK in###ouise.com
- DNS ASK is##t.com
- DNS ASK mx#.##antel.net.om
- DNS ASK mx######b3401.pphosted.com
- DNS ASK mx#.###.#ailpod2-cph3.one.com
- DNS ASK nz.###erlimited.com
- DNS ASK mx#.##curemx.biz
- DNS ASK jw###ness.info
- DNS ASK sh##ail.com
- DNS ASK go####nbroker.ro
- DNS ASK tv###nline.com
- DNS ASK mx#.##18online.com
- DNS ASK ku##.edu
- DNS ASK at#####n-dancers.com
- DNS ASK re####ct.ovh.net
- DNS ASK co###rvcare.net
- DNS ASK fo###undinn.com
- DNS ASK li#e.fr
- DNS ASK la########m.mx1-dk.mailanyone.net
- DNS ASK mx#######601.gslb.pphosted.com
- DNS ASK km###.mail.yale.edu
- DNS ASK ns#.#trayer.edu
- DNS ASK ph####s.brown.edu
- DNS ASK sn####.#ervices.brown.edu
- DNS ASK ho##ail.de
- DNS ASK eu#.###.#rotection.outlook.com
- DNS ASK ps###.uic.edu
- DNS ASK ma##.#sych.uic.edu
- DNS ASK lg###tp.lge.com
- DNS ASK gmail-smtp-in.l.google.com
- DNS ASK lg#.com
- DNS ASK ri#####ter.mnscu.edu
- DNS ASK br###.uccs.edu
- DNS ASK es##.com.vn
- DNS ASK ma##.weber.edu
- DNS ASK aspmx.l.google.com
- DNS ASK ja##den.no
- DNS ASK sa######.email.dupont.com
- DNS ASK hi##lda.no
- DNS ASK gm##l.com
- DNS ASK na######.email.dupont.com
- DNS ASK ne###gsg.com
- DNS ASK mx#######d02.gslb.pphosted.com
- DNS ASK go###email.com
- DNS ASK ep#####ser.online.no
- DNS ASK 19#.###.211.95.in-addr.arpa
- DNS ASK ho##ail.com
- DNS ASK 19#.###.#11.95.dnsbl.sorbs.net
- DNS ASK ho#########.olc.protection.outlook.com
- DNS ASK ma##.atu.edu
- DNS ASK 19#.###.#11.95.bl.spamcop.net
- DNS ASK 19#.###.#11.95.zen.spamhaus.org
- DNS ASK 19#.###.##1.95.sbl-xbl.spamhaus.org
- DNS ASK es#n.dk
- DNS ASK alt1.gmail-smtp-in.l.google.com
- DNS ASK ko##lett.no
- DNS ASK mi##########m.mail.protection.outlook.com
- DNS ASK on##ne.no
- DNS ASK hk.####n.herominers.com
- DNS ASK mx.##line.no
- DNS ASK ho###il.co.nz
- DNS ASK ap#.###.#rotection.outlook.com
- DNS ASK ko##a.com
- DNS ASK r-####6.korea.com
- DNS ASK ya##o.com
- DNS ASK mt##.##0.yahoodns.net
- DNS ASK ce##er.no
- DNS ASK 19#.###.#11.95.cbl.abuseat.org
- DNS ASK wm##air.com
- DNS ASK ko#########.mail.protection.outlook.com
- DNS ASK xs#####851w.sanofi.com
- DNS ASK ma#####t.alorica.com
- DNS ASK li#e.it
- DNS ASK th####ngruppen.no
- DNS ASK gw#.####rity.comendo.com
- DNS ASK es#.net
- DNS ASK es#####.##il.protection.outlook.com
- DNS ASK google.com
- DNS ASK mo####e11.nsc.no
- DNS ASK sa####-aventis.com
- DNS ASK cl######.us.messagelabs.com
- DNS ASK nc###oup.com
- DNS ASK mo###ce8.nsc.no
- DNS ASK fr##urf.no
- DNS ASK mx.##isurf.no
- DNS ASK ms#.com
- DNS ASK vi########er.fra02.hls.ttvnw.net
- DNS ASK ms#####.##c.protection.outlook.com
- DNS ASK fo##ound.de
- DNS ASK mx##.##ndenserver.de
- DNS ASK qx#.no
- DNS ASK am.#um.no
- DNS ASK st##.nhh.no
- DNS ASK ma###w01.nhh.no
- DNS ASK er.##.skjonnhet.no
- DNS ASK mp##sis.com
- DNS ASK rw##.umdnj.edu
- DNS ASK ma###.wesleyan.edu
- DNS ASK mx####.email.dupont.com
- DNS ASK du####powder.com
- DNS ASK ma##.##pontpowder.com
- DNS ASK lo##0.com
- DNS ASK mx#.######deempresas.telefonica.es
- DNS ASK ha###burton.com
- DNS ASK mx#######f01.gslb.pphosted.com
- DNS ASK ma##.umd.edu
- DNS ASK mx#.##d.iphmx.com
- DNS ASK we###yan.edu
- DNS ASK li###s-elec.com
- DNS ASK ge####erlogix.com
- DNS ASK th#####elinetwork.com
- DNS ASK mx###.in-mx.net
- DNS ASK ww#.edu
- DNS ASK l-####allier.com
- DNS ASK fd#.edu
- DNS ASK ALT1.ASPMX.L.GOOGLE.COM
- DNS ASK ai#.com
- DNS ASK am####04.aig.com
- DNS ASK ns##rch.com
- DNS ASK au####dyworld.com
- DNS ASK rs#.no
- DNS ASK rs####.##1-dk.mailanyone.net
Miscellaneous
Executes the following
- '<SYSTEM32>\rundll32.exe' <SYSTEM32>\FirewallControlPanel.dll,ShowNotificationDialog /configure /ETOnly 0 /OnProfiles 6 /OtherAllowed 0 /OtherBlocked 0 /OtherEdgeAllowed 0 /NewBlocked 2 "<Full path to file>"
- '%WINDIR%\syswow64\svchost.exe' -a cryptonight-heavy --variant xhv -o hk.haven.herominers.com:10451 -u hvxyDpkRtcZaPBeYaKJ5t1XTwUT5K65EnENUmzZQc57Uhan6owyfqWTaQKAh5EQFUPFDaqbGsmVCdXapddCMPTYU6ZshRESV65.60000 -p x1 -k
