Technical Information
To ensure autorun and distribution
Creates the following services
- [<HKLM>\System\CurrentControlSet\Services\jdhvmzfz] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\jdhvmzfz] 'ImagePath' = '<SYSTEM32>\jdhvmzfz\vmfipcon.exe /d"<Full path to file>"'
- [<HKLM>\SYSTEM\CurrentControlSet\services\jdhvmzfz] 'ImagePath' = '<SYSTEM32>\jdhvmzfz\vmfipcon.exe'
Malicious functions
Injects code into
the following system processes:
- <SYSTEM32>\svchost.exe
Modifies file system
Creates the following files
- %TEMP%\vmfipcon.exe
- C:\documents and settings\localservice:.repos
Moves the following files
- from %TEMP%\vmfipcon.exe to <SYSTEM32>\jdhvmzfz\vmfipcon.exe
Deletes itself.
Network activity
Connects to
- 'cx#.##.#.cloudfilter.net':25
- 'mx.##.##mail.iss.as9143.net':25
- 'ma###2.ksb.com':25
- 'alt1.aspmx.l.google.com':25
- 'mx.##c.tario.ru':25
- 'alt2.gmail-smtp-in.l.google.com':25
- 'mx##.#andomain.dk':25
- 'ASPMX.L.GOOGLE.COM':25
- 'ALT2.ASPMX.L.GOOGLE.com':25
- '14#.#6.108.92':483
- 'mx##.##stivalscine.com':25
- 'fo####ail.forum.dk':25
- 'mx##.#spgateway.de':25
- 'hi########-partners-com.mx62.com':25
- 'alt4.gmail-smtp-in.l.google.com':25
- 'vi###bering.dk':25
- 'eu#.###.#rotection.outlook.com':25
- 'my########.net.mx1.hrtc.rcimx.net':25
- 'mx#######a01.gslb.pphosted.com':25
- 'ne##lix.com':443
- 'dc######c9927b7.wanadoo.dk':25
- 'ma##.#am-sebe.ru':25
- 'alt1.gmail-smtp-in.l.google.com':25
- 'sm##.taarnby.dk':25
- 'sm###.susx.ac.uk':25
- 'mx#######501.gslb.pphosted.com':25
- 'ma###.###owinternational.com':25
- 'sm##.##cureserver.net':25
- 'sm##.renault.fr':25
- 'mx#######b01.gslb.pphosted.com':25
- 'mx#.mail.ru':25
- 'mx#######701.gslb.pphosted.com':25
- 'mt##.##0.yahoodns.net':25
- 'ho#########.olc.protection.outlook.com':25
- 'gmail-smtp-in.l.google.com':25
- 'ap#.###.#rotection.outlook.com':25
- 'ba####.beta-inter.net':25
- 'mx#.#otmail.com':25
- 'mx#.###.#ailpod2-cph3.one.com':25
- 'et###.#ail.tiscali.it':25
- 'mx#######f02.gslb.pphosted.com':25
- 'mx#######002.gslb.pphosted.com':25
- 'de####.bosch-org.com':25
- 'mx###.##il.gm0.yahoodns.net':25
- 'mx##.nicmail.ru':25
- 'alt3.gmail-smtp-in.l.google.com':25
- 'mx#.##mltd.co.uk':25
- 'mx##.mail.com':25
- 'mx.#########m.com.cust.a.hostedemail.com':25
- 'mx###.upcmail.net':25
- 'as#####20.oracle.com':25
- 'al######x-vip2.prodigy.net':25
- 'mx.##.#tinternet.com':25
- 'mx####.##il.gm0.yahoodns.net':25
TCP
HTTP GET requests
- http://www.google.com/
UDP
- DNS ASK mi##########m.mail.protection.outlook.com
- DNS ASK ALT2.ASPMX.L.GOOGLE.com
- DNS ASK co#####datedshoe.com
- DNS ASK ASPMX.L.GOOGLE.COM
- DNS ASK os##go.edu
- DNS ASK mx##.#andomain.dk
- DNS ASK hd###sign.dk
- DNS ASK alt2.gmail-smtp-in.l.google.com
- DNS ASK mx.##c.tario.ru
- DNS ASK si##et.ru
- DNS ASK ac####hnologies.com
- DNS ASK ma###2.ksb.com
- DNS ASK ks#.com
- DNS ASK mx.##.##mail.iss.as9143.net
- DNS ASK sk###inge.dk
- DNS ASK nt###rld.com
- DNS ASK su###x.ac.uk
- DNS ASK ya##o.com
- DNS ASK sm##.taarnby.dk
- DNS ASK ta##nby.dk
- DNS ASK mx#######501.gslb.pphosted.com
- DNS ASK am###trade.com
- DNS ASK li#t.ru
- DNS ASK ma###.###owinternational.com
- DNS ASK ar#####ternational.com
- DNS ASK sm##.##cureserver.net
- DNS ASK ym##l.org
- DNS ASK as#####20.oracle.com
- DNS ASK or##le.com
- DNS ASK sm###.susx.ac.uk
- DNS ASK ny#.edu
- DNS ASK ve##zon.net
- DNS ASK in##soft.de
- DNS ASK mx#.###.#ailpod2-cph3.one.com
- DNS ASK ho####kirkedal.dk
- DNS ASK ue#.com.pk
- DNS ASK co##girl.dk
- DNS ASK alt1.gmail-smtp-in.l.google.com
- DNS ASK ma##.#am-sebe.ru
- DNS ASK sa##sebe.ru
- DNS ASK me###ech.com
- DNS ASK ti##i.com
- DNS ASK dc######c9927b7.wanadoo.dk
- DNS ASK wa##doo.dk
- DNS ASK ne##lix.com
- DNS ASK bk.ru
- DNS ASK mx###.upcmail.net
- DNS ASK mx#######a01.gslb.pphosted.com
- DNS ASK my########.net.mx1.hrtc.rcimx.net
- DNS ASK my###estar.net
- DNS ASK eu#.###.#rotection.outlook.com
- DNS ASK li##.com.pt
- DNS ASK vi###bering.dk
- DNS ASK alt4.gmail-smtp-in.l.google.com
- DNS ASK tu##lo.ru
- DNS ASK hi########-partners-com.mx62.com
- DNS ASK hi#####der-partners.com
- DNS ASK et###.#ail.tiscali.it
- DNS ASK ti##ali.it
- DNS ASK do##or.com
- DNS ASK mx##.#spgateway.de
- DNS ASK fe####alscine.com
- DNS ASK mx##.##stivalscine.com
- DNS ASK in##e.at
- DNS ASK mx#.mail.ru
- DNS ASK zh##sa.com
- DNS ASK sm##.renault.fr
- DNS ASK re##ult.com
- DNS ASK mx#######b01.gslb.pphosted.com
- DNS ASK fi####etailing.it
- DNS ASK al######x-vip2.prodigy.net
- DNS ASK am###tech.net
- DNS ASK cx#.##.#.cloudfilter.net
- DNS ASK co#.net
- DNS ASK google.com
- DNS ASK gmail-smtp-in.l.google.com
- DNS ASK mx#.#otmail.com
- DNS ASK 19#.###.#11.95.cbl.abuseat.org
- DNS ASK mx#######701.gslb.pphosted.com
- DNS ASK mx######b2d01.pphosted.com
- DNS ASK us.#bm.com
- DNS ASK alt1.aspmx.l.google.com
- DNS ASK 19#.###.#11.95.zen.spamhaus.org
- DNS ASK ka##ko.com
- DNS ASK mx.#####.#om.cust.b.hostedemail.com
- DNS ASK ly##s.com
- DNS ASK mt##.##0.yahoodns.net
- DNS ASK 19#.###.#11.95.bl.spamcop.net
- DNS ASK ya###.com.au
- DNS ASK mx##.##bal.mailcore.com
- DNS ASK 19#.###.#11.95.dnsbl.sorbs.net
- DNS ASK so#.dk
- DNS ASK 19#.###.211.95.in-addr.arpa
- DNS ASK 19#.###.##1.95.sbl-xbl.spamhaus.org
- DNS ASK ni##.com
- DNS ASK mx.#########m.com.cust.a.hostedemail.com
- DNS ASK ho##ail.com
- DNS ASK kc###eteam.com
- DNS ASK mx##.mail.com
- DNS ASK ma##.com
- DNS ASK mx#.##mltd.co.uk
- DNS ASK ph####ooth.co.uk
- DNS ASK of#r.dk
- DNS ASK alt3.gmail-smtp-in.l.google.com
- DNS ASK mx##.nicmail.ru
- DNS ASK nf#.ru
- DNS ASK mx###.##il.gm0.yahoodns.net
- DNS ASK ya###.com.tw
- DNS ASK de####.bosch-org.com
- DNS ASK zf####ksysteme.com
- DNS ASK am###teck.net
- DNS ASK mx#######002.gslb.pphosted.com
- DNS ASK mx.##.#tinternet.com
- DNS ASK bt###ernet.com
- DNS ASK fo####ail.forum.dk
- DNS ASK fo##m.dk
- DNS ASK ma#l.ru
- DNS ASK ba####.beta-inter.net
- DNS ASK mx#######f02.gslb.pphosted.com
- DNS ASK bl##mail.dk
- DNS ASK pf##er.com
- DNS ASK ap#.###.#rotection.outlook.com
- DNS ASK li##.com.au
- DNS ASK gm##l.com
- DNS ASK ho#########.olc.protection.outlook.com
- DNS ASK in##x.ru
- DNS ASK mx####.##il.gm0.yahoodns.net
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\jdhvmzfz\vmfipcon.exe' /d"<Full path to file>"
- '<SYSTEM32>\cmd.exe' /C mkdir <SYSTEM32>\jdhvmzfz\' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C move /Y "%TEMP%\vmfipcon.exe" <SYSTEM32>\jdhvmzfz\' (with hidden window)
- '<SYSTEM32>\sc.exe' create jdhvmzfz binPath= "<SYSTEM32>\jdhvmzfz\vmfipcon.exe /d\"<Full path to file>\"" type= own start= auto DisplayName= "wifi support"' (with hidden window)
- '<SYSTEM32>\sc.exe' description jdhvmzfz "wifi internet conection"' (with hidden window)
- '<SYSTEM32>\sc.exe' start jdhvmzfz' (with hidden window)
Executes the following
- '<SYSTEM32>\cmd.exe' /C mkdir <SYSTEM32>\jdhvmzfz\
- '<SYSTEM32>\cmd.exe' /C move /Y "%TEMP%\vmfipcon.exe" <SYSTEM32>\jdhvmzfz\
- '<SYSTEM32>\sc.exe' create jdhvmzfz binPath= "<SYSTEM32>\jdhvmzfz\vmfipcon.exe /d\"<Full path to file>\"" type= own start= auto DisplayName= "wifi support"
- '<SYSTEM32>\sc.exe' description jdhvmzfz "wifi internet conection"
- '<SYSTEM32>\sc.exe' start jdhvmzfz
- '<SYSTEM32>\svchost.exe'
