Technical Information
To ensure autorun and distribution
Creates the following services
- [<HKLM>\System\CurrentControlSet\Services\kblahxux] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\kblahxux] 'ImagePath' = '<SYSTEM32>\kblahxux\brxqrzpy.exe /d"<Full path to file>"'
- [<HKLM>\SYSTEM\CurrentControlSet\services\kblahxux] 'ImagePath' = '<SYSTEM32>\kblahxux\brxqrzpy.exe'
Malicious functions
Injects code into
the following system processes:
- <SYSTEM32>\svchost.exe
Modifies file system
Creates the following files
- %TEMP%\brxqrzpy.exe
- C:\documents and settings\localservice:.repos
Moves the following files
- from %TEMP%\brxqrzpy.exe to <SYSTEM32>\kblahxux\brxqrzpy.exe
Deletes itself.
Network activity
Connects to
- 'mt##.##0.yahoodns.net':25
- 'ma##.##nder-world.de':25
- 'mx#.##antel.net.om':25
- 'bi#######ensen.dk.mx.one.com':25
- 'mx###.owm.bell.net':25
- 'sm###.gov.pe.ca':25
- 'mx#.##tsolmail.net':25
- 'dc###.#eamaccent.com':25
- 'alt3.gmail-smtp-in.l.google.com':25
- 'fm#.#reemail.hu':25
- 'ea###.mxlogin.com':25
- 'ma##.##interactive.com':25
- 'mx###.in-mx.com':25
- 'd8#####.##s.barracudanetworks.com':25
- 'mx##.phpnet.org':25
- 'mx.##wway.com':25
- '15#.#03.115.77':80
- 'cu#######-1.in.mailcontrol.com':25
- 'ma##.#lavisa.com.mx':25
- 'd1######.#ss.barracudanetworks.com':25
- 'fi####b.waycom.net':25
- 'ms#####.##c.protection.outlook.com':25
- 'mx##.#mig.gmx.net':25
- 'mc#######.#ail.protection.outlook.com':25
- 'ma#########.mail.protection.outlook.com':25
- 'ir####rt.cbnm.com':25
- 'en###onova.ca':80
- 'sm##.##b.shawcable.net':25
- 'mx#.##empresas.pt':25
- 'sm####n.orange.fr':25
- '14#.#6.108.92':483
- 'bi######1.netvigator.com':25
- '17#.#17.168.35':443
- 'mx#.##ailsrvr.com':25
- 'cl#######.us.messagelabs.com':25
- 'ma##.#o-link.net':25
- 'ip##fo.io':80
- 'mg##.ksc.co.th':25
- 'ASPMX.L.GOOGLE.com':25
- 'go##le.ca':443
- 'in##.rambler.ru':25
- 'ma#######ay112.ehealthsask.ca':25
- 'mx#.#anmail.net':25
- 'va#####.allstate.com':25
- 'ma######2.prudential.com':25
- 'ALT2.ASPMX.L.GOOGLE.COM':25
- 'gmail-smtp-in.l.google.com':25
- '1-####-mx01.co.za':25
- 'ALT1.ASPMX.L.GOOGLE.COM':25
- 'mx#######001.gslb.pphosted.com':25
- 'mx###.##il.am0.yahoodns.net':25
- 'mx#.#otmail.com':25
- 'ho#########.olc.protection.outlook.com':25
- 'eu#.###.#rotection.outlook.com':25
- 'mx#.#gdsb.on.ca':25
- 'mx.####.egs-seg.gc.ca':25
- 'sm##.##cureserver.net':25
- 'mx.####aempresas.com.br':25
- 'mx.####iciodecorreo.es':25
- 'mx#######a02.gslb.pphosted.com':25
- 'mx####.##il.am0.yahoodns.net':25
- 'mx##.#pcmail.net':25
- 'ma#######xcite.roc2.bluetie.com':25
- 'mx#.qq.com':25
- 'de####.bosch-org.com':25
- 'mx#.##il.icloud.com':25
- 'ma#####e02.dogado.net':25
- 'alt1.gmail-smtp-in.l.google.com':25
- 'dn#######edge01.email.rr.com':25
- 'alt4.gmail-smtp-in.l.google.com':25
- 'mx#######601.gslb.pphosted.com':25
TCP
HTTP GET requests
- http://www.google.com/
UDP
- DNS ASK mi##########m.mail.protection.outlook.com
- DNS ASK gl###lcps.com
- DNS ASK ge##harm.ca
- DNS ASK a2###mos.com
- DNS ASK ea###.mxlogin.com
- DNS ASK fr##mail.hu
- DNS ASK fm#.#reemail.hu
- DNS ASK wo##ay.com
- DNS ASK ma##.##interactive.com
- DNS ASK mx.##wway.com
- DNS ASK go#####tateplanning.com
- DNS ASK mx#.##tsolmail.net
- DNS ASK sm###.gov.pe.ca
- DNS ASK sy###tico.ca
- DNS ASK mx###.owm.bell.net
- DNS ASK go#####tatepower.com
- DNS ASK om###el.net.om
- DNS ASK mx#.##antel.net.om
- DNS ASK bi####upjensen.dk
- DNS ASK go######ateportables.com
- DNS ASK bi#######ensen.dk.mx.one.com
- DNS ASK ih##.org
- DNS ASK iw##.com
- DNS ASK cl###aples.com
- DNS ASK mx###.in-mx.com
- DNS ASK sm##.##cureserver.net
- DNS ASK ma##box.rs
- DNS ASK nr#.ca
- DNS ASK mx.####.egs-seg.gc.ca
- DNS ASK cl###usictr.com
- DNS ASK ho##ail.it
- DNS ASK ca###surf.com
- DNS ASK mx##.#pcmail.net
- DNS ASK br####aysman.com
- DNS ASK go##ink.net
- DNS ASK nr#.gc.ca
- DNS ASK st###myx.com
- DNS ASK cb##.com
- DNS ASK ir####rt.cbnm.com
- DNS ASK cl###musix.net
- DNS ASK mx##.phpnet.org
- DNS ASK go#####tatemedical.com
- DNS ASK la####rilling.com
- DNS ASK d8#####.##s.barracudanetworks.com
- DNS ASK ma##.#o-link.net
- DNS ASK nf#.ca
- DNS ASK fo####ider.com.br
- DNS ASK mx.####aempresas.com.br
- DNS ASK ya##o.es
- DNS ASK go#####tatereload.com
- DNS ASK mc#######.#ail.protection.outlook.com
- DNS ASK gm#.de
- DNS ASK mx##.#mig.gmx.net
- DNS ASK li#e.it
- DNS ASK me###anager.com
- DNS ASK me###roup.com
- DNS ASK zi#####in.gartner.com
- DNS ASK km##t.com
- DNS ASK ma#########.mail.protection.outlook.com
- DNS ASK mc##g.com
- DNS ASK ms#.com
- DNS ASK fi####b.waycom.net
- DNS ASK is##c.com
- DNS ASK d1######.#ss.barracudanetworks.com
- DNS ASK dp##.com
- DNS ASK ce####nialrd.com
- DNS ASK we###fargo.com
- DNS ASK ba######hastanesi.com.tr
- DNS ASK cu#######-1.in.mailcontrol.com
- DNS ASK ms#####.##c.protection.outlook.com
- DNS ASK bl###reen.com
- DNS ASK ma##ntl.com
- DNS ASK en###onova.ca
- DNS ASK mx#######601.gslb.pphosted.com
- DNS ASK dc###.#eamaccent.com
- DNS ASK un####plusinc.com
- DNS ASK mx#.##ailsrvr.com
- DNS ASK go#####tatestars.com
- DNS ASK pl###sa.com.mx
- DNS ASK ma##.#lavisa.com.mx
- DNS ASK go####statetire.com
- DNS ASK cl#######.us.messagelabs.com
- DNS ASK rh##int.com
- DNS ASK bi######1.netvigator.com
- DNS ASK ar##676.com
- DNS ASK go#.ge
- DNS ASK or##ge.fr
- DNS ASK sm####n.orange.fr
- DNS ASK lu####lvetica.pt
- DNS ASK mx#.##empresas.pt
- DNS ASK sh#w.ca
- DNS ASK sm##.##b.shawcable.net
- DNS ASK ma######gresultsgroup.com
- DNS ASK go######ateproperties.org
- DNS ASK ma##.##nder-world.de
- DNS ASK bi####-world.com
- DNS ASK hu####aitribe.org
- DNS ASK mx.####iciodecorreo.es
- DNS ASK cl##mr.com
- DNS ASK mx.###ertad.link
- DNS ASK ba##mex.com
- DNS ASK mx##.#ail.citi.com
- DNS ASK ex##te.com
- DNS ASK ma#######xcite.roc2.bluetie.com
- DNS ASK cb#.ca
- DNS ASK cl######.us.messagelabs.com
- DNS ASK ALT1.ASPMX.L.GOOGLE.COM
- DNS ASK ms#.edu
- DNS ASK alt3.gmail-smtp-in.l.google.com
- DNS ASK sm#.##ronto.on.ca
- DNS ASK ja###group.com
- DNS ASK dr####astics.com
- DNS ASK ar#######.theemaillaundry.net
- DNS ASK su#.com
- DNS ASK us#####20.oracle.com
- DNS ASK ho##ail.de
- DNS ASK eu#.###.#rotection.outlook.com
- DNS ASK mx#######801.gslb.pphosted.com
- DNS ASK go.##emiss.edu
- DNS ASK ma##.##h.toronto.on.ca
- DNS ASK ma##.###tantknockout.com
- DNS ASK in####tknockout.com
- DNS ASK 19#.###.211.95.in-addr.arpa
- DNS ASK 19#.###.#11.95.bl.spamcop.net
- DNS ASK 19#.###.#11.95.zen.spamhaus.org
- DNS ASK 19#.###.##1.95.sbl-xbl.spamhaus.org
- DNS ASK 19#.###.#11.95.cbl.abuseat.org
- DNS ASK ya##o.it
- DNS ASK mx###.##il.am0.yahoodns.net
- DNS ASK mo###lisa.eu
- DNS ASK alt2.gmail-smtp-in.l.google.com
- DNS ASK mx#.#otmail.com
- DNS ASK 19#.###.#11.95.dnsbl.sorbs.net
- DNS ASK ma##.vianova.it
- DNS ASK ya##o.com
- DNS ASK in###nuansa.com
- DNS ASK 12#.com
- DNS ASK 12#####.mxmail.netease.com
- DNS ASK ch#####akeclimate.org
- DNS ASK ALT2.ASPMX.L.GOOGLE.COM
- DNS ASK or##le.com
- DNS ASK us#####40.oracle.com
- DNS ASK al##nt.ca
- DNS ASK mt##.##0.yahoodns.net
- DNS ASK pa##er.com
- DNS ASK lo###noz.com
- DNS ASK mx###n.bell.ca
- DNS ASK ip##fo.io
- DNS ASK mx#.#gdsb.on.ca
- DNS ASK sa#.rr.com
- DNS ASK dn#######edge01.email.rr.com
- DNS ASK ch###ngel.net
- DNS ASK alt1.gmail-smtp-in.l.google.com
- DNS ASK ma#####e02.dogado.net
- DNS ASK ma#.com
- DNS ASK mx#.##il.icloud.com
- DNS ASK bo###rexroth.ca
- DNS ASK de####.bosch-org.com
- DNS ASK qq.com
- DNS ASK mx#.qq.com
- DNS ASK ho##ail.com
- DNS ASK ho#########.olc.protection.outlook.com
- DNS ASK ya##o.ro
- DNS ASK br####hevrolet.com
- DNS ASK mx####.##il.am0.yahoodns.net
- DNS ASK sw.ca
- DNS ASK mx#######a02.gslb.pphosted.com
- DNS ASK va#####.allstate.com
- DNS ASK alt4.gmail-smtp-in.l.google.com
- DNS ASK ug##b.on.ca
- DNS ASK ya##o.de
- DNS ASK jk##my.com
- DNS ASK ks#.th.com
- DNS ASK ASPMX.L.GOOGLE.com
- DNS ASK wo###n-hs.com
- DNS ASK ca####calumni.com
- DNS ASK ha##ail.net
- DNS ASK mx#.#anmail.net
- DNS ASK hu###energy.ca
- DNS ASK mx#######001.gslb.pphosted.com
- DNS ASK sa###x.co.za
- DNS ASK 1-####-mx01.co.za
- DNS ASK google.com
- DNS ASK gm##l.com
- DNS ASK pr##ec.com
- DNS ASK ma######2.prudential.com
- DNS ASK sa######nhealthregion.ca
- DNS ASK ma#######ay112.ehealthsask.ca
- DNS ASK ra##ler.ru
- DNS ASK in##.rambler.ru
- DNS ASK go##le.ca
- DNS ASK jo##ort.com
- DNS ASK mg##.ksc.co.th
- DNS ASK gmail-smtp-in.l.google.com
- DNS ASK al###ate.com
- '<DNS_SERVER>':53
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\kblahxux\brxqrzpy.exe' /d"<Full path to file>"
- '<SYSTEM32>\cmd.exe' /C mkdir <SYSTEM32>\kblahxux\' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C move /Y "%TEMP%\brxqrzpy.exe" <SYSTEM32>\kblahxux\' (with hidden window)
- '<SYSTEM32>\sc.exe' create kblahxux binPath= "<SYSTEM32>\kblahxux\brxqrzpy.exe /d\"<Full path to file>\"" type= own start= auto DisplayName= "wifi support"' (with hidden window)
- '<SYSTEM32>\sc.exe' description kblahxux "wifi internet conection"' (with hidden window)
- '<SYSTEM32>\sc.exe' start kblahxux' (with hidden window)
Executes the following
- '<SYSTEM32>\cmd.exe' /C mkdir <SYSTEM32>\kblahxux\
- '<SYSTEM32>\cmd.exe' /C move /Y "%TEMP%\brxqrzpy.exe" <SYSTEM32>\kblahxux\
- '<SYSTEM32>\sc.exe' create kblahxux binPath= "<SYSTEM32>\kblahxux\brxqrzpy.exe /d\"<Full path to file>\"" type= own start= auto DisplayName= "wifi support"
- '<SYSTEM32>\sc.exe' description kblahxux "wifi internet conection"
- '<SYSTEM32>\sc.exe' start kblahxux
- '<SYSTEM32>\svchost.exe'