Technical Information
To ensure autorun and distribution
Creates the following services
- [<HKLM>\System\CurrentControlSet\Services\dlrppyfc] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\dlrppyfc] 'ImagePath' = '<SYSTEM32>\dlrppyfc\qvfaugdf.exe /d"<Full path to file>"'
- [<HKLM>\SYSTEM\CurrentControlSet\services\dlrppyfc] 'ImagePath' = '<SYSTEM32>\dlrppyfc\qvfaugdf.exe'
Malicious functions
Injects code into
the following system processes:
- <SYSTEM32>\svchost.exe
Modifies file system
Creates the following files
- %TEMP%\qvfaugdf.exe
- C:\documents and settings\localservice:.repos
Moves the following files
- from %TEMP%\qvfaugdf.exe to <SYSTEM32>\dlrppyfc\qvfaugdf.exe
Deletes itself.
Network activity
TCP
HTTP GET requests
- http://www.google.com/
UDP
- DNS ASK mi##########m.mail.protection.outlook.com
- DNS ASK gmail-smtp-in.l.google.com
- DNS ASK mu###b.co.ae
- DNS ASK me##ato.ae
- DNS ASK me########.mail.protection.outlook.com
- DNS ASK ex##te.com
- DNS ASK ma#######xcite.roc2.bluetie.com
- DNS ASK pl###tfair.com
- DNS ASK al####tamani.co.ae
- DNS ASK gm##l.com
- DNS ASK mx#.##anetfair.com
- DNS ASK alt1.aspmx.l.google.com
- DNS ASK ma###.mclink.it
- DNS ASK so###ractors.it
- DNS ASK pp######02.25-151.libero.it
- DNS ASK gr####ivantini.it
- DNS ASK zu##u.it
- DNS ASK hm##y.it
- DNS ASK tz##nes.net
- DNS ASK pa##r.ae
- DNS ASK ma###.bancosta.it
- DNS ASK ba##osta.it
- DNS ASK mx#######201.gslb.pphosted.com
- DNS ASK pe##########ae.mail.protection.outlook.com
- DNS ASK sk##2.com
- DNS ASK ei#.ae
- DNS ASK dc######.emirates.net.ae
- DNS ASK pa###nergy.ae
- DNS ASK er###.gov.ae
- DNS ASK an###llanet.com
- DNS ASK mx.#im.it
- DNS ASK mx##.#pcmail.net
- DNS ASK di###t.co.ae
- DNS ASK ho#########.olc.protection.outlook.com
- DNS ASK ib#.com
- DNS ASK mx######b2d01.pphosted.com
- DNS ASK ve##zon.net
- DNS ASK mx####.##il.gm0.yahoodns.net
- DNS ASK wa###art.com
- DNS ASK du##b.ae
- DNS ASK eu#######nbound-1.mimecast.com
- DNS ASK ho##ail.com
- DNS ASK sm##.sba.net.ae
- DNS ASK wa###grant.com
- DNS ASK mu##.jhu.edu
- DNS ASK li###rtz.com
- DNS ASK li###enton.edu
- DNS ASK pa####inless.com
- DNS ASK qq.com
- DNS ASK mx#.qq.com
- DNS ASK bo#.com.br
- DNS ASK mt##.##0.yahoodns.net
- DNS ASK mx#.#ol.com.br
- DNS ASK ho###il.co.jp
- DNS ASK mx##.1and1.com
- DNS ASK mx#.##ailsrvr.com
- DNS ASK mc####eschools.org
- DNS ASK of####readynola.com
- DNS ASK ho##ail.fr
- DNS ASK eu#.###.#rotection.outlook.com
- DNS ASK li#e.at
- DNS ASK ma###irkle.com
- DNS ASK ya##o.com
- DNS ASK mo#####smobaracca.com
- DNS ASK sm##.toffs.com
- DNS ASK to##s.com
- DNS ASK mx####.##il.am0.yahoodns.net
- DNS ASK mo##vate.ae
- DNS ASK cl######.eu.messagelabs.com
- DNS ASK ce###ryair.com
- DNS ASK mx#.##tsolmail.net
- DNS ASK la###eadu.ca
- DNS ASK ad##tco.ae
- DNS ASK bl######y.adnatcongsco.ae
- DNS ASK st####rdalumni.org
- DNS ASK br###ols6.com
- DNS ASK alt2.aspmx.l.google.com
- DNS ASK re##mail.es
- DNS ASK mx##.1and1.es
- DNS ASK li#e.ca
- DNS ASK na#.###.#rotection.outlook.com
- DNS ASK tr###tindia.com
- DNS ASK tr###ntity.com
- DNS ASK uw#.ac.za
- DNS ASK ti#.it
- DNS ASK we###rker.com
- DNS ASK pe###fac.co.ae
- DNS ASK si###gency.com
- DNS ASK im####.emirates.net.ae
- DNS ASK ep##dxb.ae
- DNS ASK ma##.##centralcu.org
- DNS ASK ua#.gov.ae
- DNS ASK de##.gov.ae
- DNS ASK mx#.#ewa.gov.ae
- DNS ASK li###ily.hk.com
- DNS ASK ma##.##family.hk.com
- DNS ASK ma##.netbeat.de
- DNS ASK mi#.co.ae
- DNS ASK sk###c.co.ae
- DNS ASK co##ast.net
- DNS ASK ch##.org
- DNS ASK ks###ane.org
- DNS ASK as#.##flexion.net
- DNS ASK du#####avenonearth.com
- DNS ASK sp######.managemyserver.co
- DNS ASK em###t.co.ae
- DNS ASK mx#.#omcast.net
- DNS ASK li##.net
- DNS ASK mx##.###lspamprotection.com
- DNS ASK br##ny.it
- DNS ASK vi#####br-mx.terra.com
- DNS ASK tr###tmedia.ae
- DNS ASK ua##.ac.ae
- DNS ASK ua########.mail.protection.outlook.com
- DNS ASK li##ro.it
- DNS ASK sm####n.libero.it
- DNS ASK st###gnet.org
- DNS ASK 19#.###.#11.95.dnsbl.sorbs.net
- DNS ASK nw###.#x.esu.k12.oh.us
- DNS ASK ny#.edu
- DNS ASK 19#.###.211.95.in-addr.arpa
- DNS ASK 19#.###.#11.95.bl.spamcop.net
- DNS ASK dr###com.com
- DNS ASK 19#.###.#11.95.zen.spamhaus.org
- DNS ASK pp######nd-2.cdscore.com
- DNS ASK mu###ipio.re.it
- DNS ASK 19#.###.##1.95.sbl-xbl.spamhaus.org
- DNS ASK 19#.###.#11.95.cbl.abuseat.org
- DNS ASK po###.comune.re.it
- DNS ASK te###.com.br
- DNS ASK mx#######a01.gslb.pphosted.com
- DNS ASK pr##edi.com
- DNS ASK ch######arketbaskets.com
- DNS ASK sm#.ae
- DNS ASK et###.#ail.tiscali.it
- DNS ASK ma######way01.yourcloud.ae
- DNS ASK nw##a.org
- DNS ASK ma##.co.ae
- DNS ASK be#o.ae
- DNS ASK gw####.fortimail.com
- DNS ASK ti###linet.it
- DNS ASK mx#.#anmail.net
- DNS ASK ri###rsound.com
- DNS ASK dp#.ae
- DNS ASK vs#.sk
- DNS ASK da##omp.it
- DNS ASK ma##.dalcomp.it
- DNS ASK si###.com.gt
- DNS ASK google.com
- DNS ASK ip#.co.ae
- DNS ASK to###ngroup.ae
- DNS ASK ri###rsp.com
- DNS ASK az###tralcu.org
- DNS ASK mx####r.wedos.net
- DNS ASK te##data.ae
- DNS ASK ha##ail.net
- DNS ASK ma###.#lrostamani.ae
- DNS ASK la####school.co.ae
- DNS ASK ag###sys.co.ae
- DNS ASK em###tes.net.ae
- DNS ASK ac######.emirates.net.ae
- DNS ASK sb###obal.net
- DNS ASK ff######x-vip2.prodigy.net
- DNS ASK bl####nder.co.uk
- DNS ASK ti##ali.it
- DNS ASK mx.##.##mail.iss.as9143.net
- DNS ASK d1######.#ss.barracudanetworks.com
- DNS ASK ho##ail.sg
- DNS ASK ap#.###.#rotection.outlook.com
- DNS ASK us##a.com
- DNS ASK pe###mania.com
- DNS ASK mx.##ission.com
- DNS ASK aspmx.l.google.com
- DNS ASK lm#.co.ae
- DNS ASK wc##.org
- DNS ASK al###tamani.ae
- DNS ASK po####biastucane.it
- DNS ASK pu######licypartners.com
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\dlrppyfc\qvfaugdf.exe' /d"<Full path to file>"
- '<SYSTEM32>\cmd.exe' /C mkdir <SYSTEM32>\dlrppyfc\' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C move /Y "%TEMP%\qvfaugdf.exe" <SYSTEM32>\dlrppyfc\' (with hidden window)
- '<SYSTEM32>\sc.exe' create dlrppyfc binPath= "<SYSTEM32>\dlrppyfc\qvfaugdf.exe /d\"<Full path to file>\"" type= own start= auto DisplayName= "wifi support"' (with hidden window)
- '<SYSTEM32>\sc.exe' description dlrppyfc "wifi internet conection"' (with hidden window)
- '<SYSTEM32>\sc.exe' start dlrppyfc' (with hidden window)
Executes the following
- '<SYSTEM32>\cmd.exe' /C mkdir <SYSTEM32>\dlrppyfc\
- '<SYSTEM32>\cmd.exe' /C move /Y "%TEMP%\qvfaugdf.exe" <SYSTEM32>\dlrppyfc\
- '<SYSTEM32>\sc.exe' create dlrppyfc binPath= "<SYSTEM32>\dlrppyfc\qvfaugdf.exe /d\"<Full path to file>\"" type= own start= auto DisplayName= "wifi support"
- '<SYSTEM32>\sc.exe' description dlrppyfc "wifi internet conection"
- '<SYSTEM32>\sc.exe' start dlrppyfc
- '<SYSTEM32>\svchost.exe'
