Technical Information
To ensure autorun and distribution
Creates the following services
- [<HKLM>\System\CurrentControlSet\Services\whsdkvxo] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\whsdkvxo] 'ImagePath' = '<SYSTEM32>\whsdkvxo\gfrnscmz.exe /d"<Full path to file>"'
- [<HKLM>\SYSTEM\CurrentControlSet\services\whsdkvxo] 'ImagePath' = '<SYSTEM32>\whsdkvxo\gfrnscmz.exe'
Malicious functions
Injects code into
the following system processes:
- <SYSTEM32>\svchost.exe
Modifies file system
Creates the following files
- %TEMP%\gfrnscmz.exe
- C:\documents and settings\localservice:.repos
Moves the following files
- from %TEMP%\gfrnscmz.exe to <SYSTEM32>\whsdkvxo\gfrnscmz.exe
Deletes itself.
Network activity
Connects to
- 'ma##.b-io.co':25
- 'mx#######d01.gslb.pphosted.com':25
- 'in#.#anadoo.es':25
- '14#.#6.108.92':481
- 'ma######rde2.xh1.lilly.com':25
- 'mx###1.qq.com':25
- 'ma##.jccm.es':25
- 'mx#.#aver.com':25
- 'alt1.gmail-smtp-in.l.google.com':25
- 'sm##.##boelectronic.com':25
- 'ab###a.com.br':25
- 'ma####4.sonova.com':25
- 'eu#.###.#rotection.outlook.com':25
- 'ma##.##nscriptcorp.com':25
- 'mx####.##il.gm0.yahoodns.net':25
- 'mx#.##.ru.job.ru':25
- 'al######x-vip2.prodigy.net':25
- 'mx.#len.pl':25
- 'mx#.##dhosting.com':25
- 'mx#.#uukku.com':25
- 'mx#######f02.gslb.pphosted.com':25
- 'mx#.##ailsrvr.com':25
- 'Sd#####01.tbpenick.com':25
- 'ms#####p-mx2.hinet.net':25
- 'sm#####.d-teknoloji.com.tr':25
- 'cx#.##.#.cloudfilter.net':25
- 'mx#.##ye.aliyun.com':25
- 'mx#.hot.ee':25
- 'mx.####ngtheatre.org':25
- 'ma####.samsung.com':25
- 'mx#######802.gslb.pphosted.com':25
- 'ma##.#cngear.com':25
- 'p.####om.ctmail.com':25
- 'ma##.4dnet.nl':25
- 'mx#.##rketgraph.nl':25
- 'mt##.##0.yahoodns.net':25
- '11#.#39.151.8':25
- 'ms#####.##c.protection.outlook.com':25
- 'sm####.eastlink.ca':25
- 'mx###.##il.am0.yahoodns.net':25
- 'li######.#lc.protection.outlook.com':25
- 'mx.####iciodecorreo.es':25
- 'mx#######f01.gslb.pphosted.com':25
- 'sm##.##cureserver.net':25
- 'sm##.#ljtele.com':25
- 'mx#.qq.com':25
- 'mx.##.#tinternet.com':25
- 'mx######91d01.pphosted.com':25
- 'aspmx.l.google.com':25
- 'ALT1.ASPMX.L.GOOGLE.com':25
- 'd4#####.##s.barracudanetworks.com':25
- 'cl######.us.messagelabs.com':25
- 'ma##.##huschelmubser.de':25
- 'we##.####.exch026.serverdata.net':25
- 'us#####20.oracle.com':25
- 'mx######b2d01.pphosted.com':25
- 'ho#########.olc.protection.outlook.com':25
- 'cl######.eu.messagelabs.com':25
- 'mx#.####255.c3s2.iphmx.com':25
- 'sm####.rilinfo.net':25
- 'mx###.in-mx.net':25
- 'as#####e6.bechtel.com':25
- 'localhost':25
TCP
HTTP GET requests
- http://www.google.com/
UDP
- DNS ASK mi##########m.mail.protection.outlook.com
- DNS ASK da####g-elec.com
- DNS ASK wa###via.com
- DNS ASK im####tchina.com
- DNS ASK ma####.samsung.com
- DNS ASK fi###dakota.com
- DNS ASK mx#######d01.gslb.pphosted.com
- DNS ASK zz##de.com
- DNS ASK mx###1.qq.com
- DNS ASK ja###ree.com
- DNS ASK in#.#anadoo.es
- DNS ASK ma######rde2.xh1.lilly.com
- DNS ASK ma####4.sonova.com
- DNS ASK jc#m.es
- DNS ASK ma##.jccm.es
- DNS ASK na##r.com
- DNS ASK mx#.#aver.com
- DNS ASK gm##l.com
- DNS ASK alt1.gmail-smtp-in.l.google.com
- DNS ASK ab###a.com.br
- DNS ASK on####ectronic.com
- DNS ASK sm##.##boelectronic.com
- DNS ASK ab##nics.fr
- DNS ASK yy##.com
- DNS ASK li##y.com
- DNS ASK we##.com
- DNS ASK cl######.eu.messagelabs.com
- DNS ASK ma##.##huschelmubser.de
- DNS ASK hi##sal.com
- DNS ASK we##.####.exch026.serverdata.net
- DNS ASK su#.com
- DNS ASK us#####20.oracle.com
- DNS ASK st###lumber.com
- DNS ASK su####treasure.com
- DNS ASK uk.#bm.com
- DNS ASK mx######b2d01.pphosted.com
- DNS ASK ba##ap.com
- DNS ASK ar##nd.com
- DNS ASK be##tel.com
- DNS ASK sa##en.com
- DNS ASK sm####.rilinfo.net
- DNS ASK he#.#tindia.com
- DNS ASK mx#.####255.c3s2.iphmx.com
- DNS ASK us####llness.com
- DNS ASK mx###.in-mx.net
- DNS ASK ci###lar.com
- DNS ASK mx######91d01.pphosted.com
- DNS ASK mc##ear.com
- DNS ASK ma##.#cngear.com
- DNS ASK as#####e6.bechtel.com
- DNS ASK om##ero.org
- DNS ASK fl####utauqua.com
- DNS ASK mx#######802.gslb.pphosted.com
- DNS ASK is####uldoors.com
- DNS ASK sm#####.d-teknoloji.com.tr
- DNS ASK co#.net
- DNS ASK cx#.##.#.cloudfilter.net
- DNS ASK he#####armingdale.com
- DNS ASK at#.###bridge-net.com
- DNS ASK sz###hong.com
- DNS ASK mx#.##ye.aliyun.com
- DNS ASK so##.com
- DNS ASK ms#####p-mx2.hinet.net
- DNS ASK ne#####-maritime-ng.com
- DNS ASK cw#####ct.cingular.com
- DNS ASK mx.####ngtheatre.org
- DNS ASK ho#.ee
- DNS ASK mx#.hot.ee
- DNS ASK fr###ier.com
- DNS ASK mx##.job.ru
- DNS ASK mx#.##.ru.job.ru
- DNS ASK oa#.##rtiger.com
- DNS ASK po##ail.com
- DNS ASK mx#.#opmail.com
- DNS ASK ec###stibas.com
- DNS ASK sp####theatre.org
- DNS ASK ms##.hinet.net
- DNS ASK mx#.##ailsrvr.com
- DNS ASK ac####iscount.com
- DNS ASK ma##.##nscriptcorp.com
- DNS ASK ao#.com
- DNS ASK mx####.##il.gm0.yahoodns.net
- DNS ASK mo##s.com
- DNS ASK be###outh.net
- DNS ASK al######x-vip2.prodigy.net
- DNS ASK o2.pl
- DNS ASK mx.#len.pl
- DNS ASK 28##.com
- DNS ASK cn##g.com
- DNS ASK ge####iptcorp.com
- DNS ASK mx#.##dhosting.com
- DNS ASK lu##ku.com
- DNS ASK mx#.#uukku.com
- DNS ASK ak###lroad.com
- DNS ASK mx#######f02.gslb.pphosted.com
- DNS ASK wa###ern.com
- DNS ASK nt##co.com
- DNS ASK at#.###-savings-web.com
- DNS ASK tb###ick.com
- DNS ASK Sd#####01.tbpenick.com
- DNS ASK dw#.com
- DNS ASK ya##o.es
- DNS ASK sc####helmubser.de
- DNS ASK cs##ow.edu
- DNS ASK cl######.us.messagelabs.com
- DNS ASK sa####rudence.com
- DNS ASK us######eingnewcentral.com
- DNS ASK e-#####outbuyers.com
- DNS ASK si###harm.com
- DNS ASK ma##.#inopharm.com
- DNS ASK he##s.fi
- DNS ASK mh##.elkdata.ee
- DNS ASK ya##o.com
- DNS ASK mt##.##0.yahoodns.net
- DNS ASK ch#####tshopping.com
- DNS ASK cn###anbao.com
- DNS ASK mc##.com
- DNS ASK mx#####.#ail.gm0.yahoodns.net
- DNS ASK h.##fa.com
- DNS ASK ms#.com
- DNS ASK ms#####.##c.protection.outlook.com
- DNS ASK br###dove.com
- DNS ASK mx.###wndove.com
- DNS ASK ne###rada.pl
- DNS ASK sm##.#osting.tp.pl
- DNS ASK ft.com
- DNS ASK ALT1.ASPMX.L.GOOGLE.com
- DNS ASK ya##o.co.in
- DNS ASK ma##.b-io.co
- DNS ASK cd#.##rpemail.net
- DNS ASK no##ail.com
- DNS ASK mu##.#ull-bow.com
- DNS ASK 19#.###.211.95.in-addr.arpa
- DNS ASK 19#.###.#11.95.dnsbl.sorbs.net
- DNS ASK ss###rine.com
- DNS ASK mx#######101.gslb.pphosted.com
- DNS ASK 19#.###.#11.95.bl.spamcop.net
- DNS ASK 19#.###.#11.95.zen.spamhaus.org
- DNS ASK 19#.###.##1.95.sbl-xbl.spamhaus.org
- DNS ASK 19#.###.#11.95.cbl.abuseat.org
- DNS ASK i-####koutshops.com
- DNS ASK ch#####tshoppers.com
- DNS ASK ib##inc.com
- DNS ASK ph#s.fi
- DNS ASK mx##.bagpad.com
- DNS ASK e-####unkingdom.com
- DNS ASK vi#####shoppe.chtah.com
- DNS ASK in##.#uicken.com
- DNS ASK si##a.com
- DNS ASK in######.messagingengine.com
- DNS ASK st###ord.edu
- DNS ASK mx#######d03.gslb.pphosted.com
- DNS ASK ho##ail.com
- DNS ASK ho#########.olc.protection.outlook.com
- DNS ASK m1.##nmail.fi
- DNS ASK me##ca.com
- DNS ASK li#e.fr
- DNS ASK se#####.williams-sonoma.com
- DNS ASK di####lknowshow.com
- DNS ASK in###hes.com
- DNS ASK e-####toshout.com
- DNS ASK j.###quan.com
- DNS ASK hu###india.com
- DNS ASK sm##.##cureserver.net
- DNS ASK hl##ele.com
- DNS ASK sm##.#ljtele.com
- DNS ASK qq.com
- DNS ASK ha###burton.com
- DNS ASK mx#######f01.gslb.pphosted.com
- DNS ASK ya##o.ca
- DNS ASK p.####om.ctmail.com
- DNS ASK bt###ernet.com
- DNS ASK mx.##.#tinternet.com
- DNS ASK rr#.com
- DNS ASK aspmx.l.google.com
- DNS ASK sa###prize.com
- DNS ASK sa####rospects.com
- DNS ASK sa####rogress.com
- DNS ASK d4#####.##s.barracudanetworks.com
- DNS ASK mx#.qq.com
- DNS ASK ad##.com
- DNS ASK eu#.###.#rotection.outlook.com
- DNS ASK mx.####iciodecorreo.es
- DNS ASK li######.#lc.protection.outlook.com
- DNS ASK zi####packing.com
- DNS ASK li#e.it
- DNS ASK so###obile.com
- DNS ASK mx#######702.gslb.pphosted.com
- DNS ASK so###usic.co.jp
- DNS ASK mx.##curemx.jp
- DNS ASK qo.##utr.com
- DNS ASK e-####hhumor.com
- DNS ASK am####gnetics.com
- DNS ASK mx.####magnetics.com
- DNS ASK em###.wshome.com
- DNS ASK ma###tgraph.nl
- DNS ASK google.com
- DNS ASK 4d##t.nl
- DNS ASK ma##.4dnet.nl
- DNS ASK so#####npowerap.co.in
- DNS ASK pe####ainternet.com
- DNS ASK sm####.eastlink.ca
- DNS ASK ya##o.sk
- DNS ASK mx###.##il.am0.yahoodns.net
- DNS ASK li##.com
- DNS ASK em##n.com
- DNS ASK mx#.##rketgraph.nl
- DNS ASK ab###nline.de
- '<DNS_SERVER>':53
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\whsdkvxo\gfrnscmz.exe' /d"<Full path to file>"
- '<SYSTEM32>\cmd.exe' /C mkdir <SYSTEM32>\whsdkvxo\' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C move /Y "%TEMP%\gfrnscmz.exe" <SYSTEM32>\whsdkvxo\' (with hidden window)
- '<SYSTEM32>\sc.exe' create whsdkvxo binPath= "<SYSTEM32>\whsdkvxo\gfrnscmz.exe /d\"<Full path to file>\"" type= own start= auto DisplayName= "wifi support"' (with hidden window)
- '<SYSTEM32>\sc.exe' description whsdkvxo "wifi internet conection"' (with hidden window)
- '<SYSTEM32>\sc.exe' start whsdkvxo' (with hidden window)
Executes the following
- '<SYSTEM32>\cmd.exe' /C mkdir <SYSTEM32>\whsdkvxo\
- '<SYSTEM32>\cmd.exe' /C move /Y "%TEMP%\gfrnscmz.exe" <SYSTEM32>\whsdkvxo\
- '<SYSTEM32>\sc.exe' create whsdkvxo binPath= "<SYSTEM32>\whsdkvxo\gfrnscmz.exe /d\"<Full path to file>\"" type= own start= auto DisplayName= "wifi support"
- '<SYSTEM32>\sc.exe' description whsdkvxo "wifi internet conection"
- '<SYSTEM32>\sc.exe' start whsdkvxo
- '<SYSTEM32>\svchost.exe'