Technical Information
To ensure autorun and distribution
Creates the following services
- [<HKLM>\System\CurrentControlSet\Services\mugabobj] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\mugabobj] 'ImagePath' = '<SYSTEM32>\mugabobj\vugchrbo.exe /d"<Full path to file>"'
- [<HKLM>\SYSTEM\CurrentControlSet\services\mugabobj] 'ImagePath' = '<SYSTEM32>\mugabobj\vugchrbo.exe'
Malicious functions
Injects code into
the following system processes:
- <SYSTEM32>\svchost.exe
Modifies file system
Creates the following files
- %TEMP%\vugchrbo.exe
- C:\documents and settings\localservice:.repos
Moves the following files
- from %TEMP%\vugchrbo.exe to <SYSTEM32>\mugabobj\vugchrbo.exe
Deletes itself.
Network activity
Connects to
- 'mt##.##0.yahoodns.net':25
TCP
HTTP GET requests
- http://www.google.com/
UDP
- DNS ASK 19#.###.211.95.in-addr.arpa
- DNS ASK sf#.se
- DNS ASK st###e.sfr.se
- DNS ASK dc##.tas.gov.au
- DNS ASK di##alba.es
- DNS ASK mx.##pualba.es
- DNS ASK si##.com
- DNS ASK fr#####.#inamail.sina.com.cn
- DNS ASK mx##.#endpulse.net
- DNS ASK de#.gov.au
- DNS ASK mx#.###.#ailpod7-cph3.one.com
- DNS ASK de#.#a.edu.au
- DNS ASK de##########u.mail.protection.outlook.com
- DNS ASK ha##ail.net
- DNS ASK mx#.#anmail.net
- DNS ASK ry###.ltjkpg.se
- DNS ASK sp#s.se
- DNS ASK th####.ocn.ne.jp
- DNS ASK mf###.ocn.ad.jp
- DNS ASK me###team.se
- DNS ASK zn###-1.spcs.se
- DNS ASK ya##o.co.jp
- DNS ASK ca#####ltown.sa.gov.au
- DNS ASK cu#######2.in.mailcontrol.com
- DNS ASK cc##.vic.edu.au
- DNS ASK ce###.cs.nsw.gov.au
- DNS ASK ch####lm.vic.edu.au
- DNS ASK mx#######301.gslb.pphosted.com
- DNS ASK ch#####ing.wa.gov.au
- DNS ASK co#####ndra.nsw.gov.au
- DNS ASK ma########.cootamundra.nsw.gov.au
- DNS ASK da#.#ld.edu.au
- DNS ASK ya##o.de
- DNS ASK bm#.se
- DNS ASK mx#.####.arvato-systems.de
- DNS ASK da##.gov.au
- DNS ASK si#######.#ecureintellicentre.net.au
- DNS ASK mx#.###l.yahoo.co.jp
- DNS ASK mx####.##il.gm0.yahoodns.net
- DNS ASK mi##########m.mail.protection.outlook.com
- DNS ASK bi###.##rdsaustralia.com.au
- DNS ASK ma##.gmail.com
- DNS ASK sp##y.se
- DNS ASK 19#.###.#11.95.dnsbl.sorbs.net
- DNS ASK ka##ko.com
- DNS ASK 19#.###.#11.95.bl.spamcop.net
- DNS ASK alt1.aspmx.l.google.com
- DNS ASK 19#.###.#11.95.zen.spamhaus.org
- DNS ASK 19#.###.##1.95.sbl-xbl.spamhaus.org
- DNS ASK 19#.###.#11.95.cbl.abuseat.org
- DNS ASK ho##ail.com
- DNS ASK fo##ail.com
- DNS ASK li##.com.ar
- DNS ASK na#.###.#rotection.outlook.com
- DNS ASK oh##n.se
- DNS ASK oh######.##il.protection.outlook.com
- DNS ASK mx##.job.ru
- DNS ASK mx#.##.ru.job.ru
- DNS ASK du###########-au.mail.protection.outlook.com
- DNS ASK du####.wa.gov.au
- DNS ASK mx#.####y.mail2world.com
- DNS ASK de###.qld.gov.au
- DNS ASK dr##########au.mail.protection.outlook.com
- DNS ASK ho#########.olc.protection.outlook.com
- DNS ASK wo##timo.dk
- DNS ASK mx#.##linemail.io
- DNS ASK vv.se
- DNS ASK ma###dge2.vv.se
- DNS ASK bo###elle.com
- DNS ASK aspmx.l.google.com
- DNS ASK ao#.com
- DNS ASK ab###iz1.com.ph
- DNS ASK ca#####ltown.nsw.gov.au
- DNS ASK i-###u.com.ph
- DNS ASK po###.net.ph
- DNS ASK be###anlantz.se
- DNS ASK cl##a.se
- DNS ASK sn#.se
- DNS ASK mx#.epm.se
- DNS ASK dr###rm.com.au
- DNS ASK dt#.#ti.gov.ph
- DNS ASK rv###hzone.com
- DNS ASK to####mbras.com.ph
- DNS ASK cu#######-1.in.mailcontrol.com
- DNS ASK ca####dge.wa.gov.au
- DNS ASK ip##fo.io
- DNS ASK ma###.gavle.se
- DNS ASK ma#####n.lindesberg.se
- DNS ASK vg##gion.se
- DNS ASK vg#####3.vgregion.se
- DNS ASK ti##ali.se
- DNS ASK ch##lo.se
- DNS ASK ma##.parking.se
- DNS ASK lp#.es
- DNS ASK ma##.lpg.es
- DNS ASK be#####ley.nsw.gov.au
- DNS ASK cl######.us.messagelabs.com
- DNS ASK t-##line.de
- DNS ASK mx##.#-online.de
- DNS ASK ik#.liu.se
- DNS ASK e-#####ilter04.sunet.se
- DNS ASK an####ciajunta.es
- DNS ASK ba####lor.edu.au
- DNS ASK ga##e.se
- DNS ASK sp######d01.thecore.net.au
- DNS ASK pe##.lu.se
- DNS ASK no###und.lu.se
- DNS ASK si########.secureintellicentre.net.au
- DNS ASK ya##o.co.uk
- DNS ASK mx###.##il.am0.yahoodns.net
- DNS ASK ya##o.es
- DNS ASK gm##l.com
- DNS ASK gmail-smtp-in.l.google.com
- DNS ASK ya##o.com
- DNS ASK be####t.wa.gov.au
- DNS ASK ho###il.co.uk
- DNS ASK mt##.##0.yahoodns.net
- DNS ASK at#####nsc.qld.gov.au
- DNS ASK au#####ianpork.com.au
- DNS ASK au############-com-au.mail.protection.outlook.com
- DNS ASK he###ngborg.se
- DNS ASK r0#####.helsingborg.se
- DNS ASK ub.#mu.se
- DNS ASK mx#.umu.se
- DNS ASK an##.gov.au
- DNS ASK mx.#u.se
- DNS ASK mx#.#ail.qq.com
- DNS ASK ma##.##lmont.wa.gov.au
- DNS ASK ma##.##nedictine.org.au
- DNS ASK at###ca.a.se
- DNS ASK ja###sson.se
- DNS ASK mx#.###.#ailpod1-cph3.one.com
- DNS ASK br####ne.qld.gov.au
- DNS ASK br###########gov-au.mail.protection.outlook.com
- DNS ASK bs#.org.au
- DNS ASK mx.####luciajunta.es
- DNS ASK au#######nbound-1.mimecast.com
- DNS ASK en##appa.se
- DNS ASK he##.#assagen.se
- DNS ASK ni##b.se
- DNS ASK go##le.de
- DNS ASK bu#####rg.qld.gov.au
- DNS ASK bu####ton.wa.gov.au
- DNS ASK ma##.###selton.wa.gov.au
- DNS ASK em###.mullsjo.se
- DNS ASK ka##.##-edu.kalmar.se
- DNS ASK gl#.se
- DNS ASK tv####kholm.tv4.se
- DNS ASK google.com
- DNS ASK ou###.space.se
- DNS ASK hu###.sb.luth.se
- DNS ASK pa##gen.se
- DNS ASK al###ista.se
- DNS ASK
- DNS ASK be####ey.wa.gov.au
- DNS ASK ep#####.#ocusnetworks.com.au
- DNS ASK co##ast.net
- DNS ASK bi#####stralia.com.au
- DNS ASK mx#.#omcast.net
- DNS ASK kv####er-pulping.se
- DNS ASK gf#.se
- DNS ASK ar#####le.algonet.se
- DNS ASK al##net.se
- DNS ASK sa#.oru.se
- DNS ASK st####uctions.se
- DNS ASK br#####own.wa.gov.au
- DNS ASK be####ctine.org.au
- DNS ASK in######.hes.trendmicro.com
- DNS ASK un####.brostroms.se
- DNS ASK eu#.###.#rotection.outlook.com
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\mugabobj\vugchrbo.exe' /d"<Full path to file>"
- '<SYSTEM32>\cmd.exe' /C mkdir <SYSTEM32>\mugabobj\' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C move /Y "%TEMP%\vugchrbo.exe" <SYSTEM32>\mugabobj\' (with hidden window)
- '<SYSTEM32>\sc.exe' create mugabobj binPath= "<SYSTEM32>\mugabobj\vugchrbo.exe /d\"<Full path to file>\"" type= own start= auto DisplayName= "wifi support"' (with hidden window)
- '<SYSTEM32>\sc.exe' description mugabobj "wifi internet conection"' (with hidden window)
- '<SYSTEM32>\sc.exe' start mugabobj' (with hidden window)
Executes the following
- '<SYSTEM32>\cmd.exe' /C mkdir <SYSTEM32>\mugabobj\
- '<SYSTEM32>\cmd.exe' /C move /Y "%TEMP%\vugchrbo.exe" <SYSTEM32>\mugabobj\
- '<SYSTEM32>\sc.exe' create mugabobj binPath= "<SYSTEM32>\mugabobj\vugchrbo.exe /d\"<Full path to file>\"" type= own start= auto DisplayName= "wifi support"
- '<SYSTEM32>\sc.exe' description mugabobj "wifi internet conection"
- '<SYSTEM32>\sc.exe' start mugabobj
- '<SYSTEM32>\svchost.exe'
