Technical Information
To ensure autorun and distribution
Creates the following services
- [<HKLM>\System\CurrentControlSet\Services\evinewgy] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\evinewgy] 'ImagePath' = '<SYSTEM32>\evinewgy\chuuxwmr.exe /d"<Full path to file>"'
- [<HKLM>\SYSTEM\CurrentControlSet\services\evinewgy] 'ImagePath' = '<SYSTEM32>\evinewgy\chuuxwmr.exe'
Malicious functions
Injects code into
the following system processes:
- <SYSTEM32>\svchost.exe
Modifies file system
Creates the following files
- %TEMP%\chuuxwmr.exe
- C:\documents and settings\localservice:.repos
Moves the following files
- from %TEMP%\chuuxwmr.exe to <SYSTEM32>\evinewgy\chuuxwmr.exe
Deletes itself.
Network activity
Connects to
- 'mt##.##0.yahoodns.net':25
- '69.#1.136.5':443
- 'sm#####.three.com.au':25
- 'ac###########c-service-prod.ol.epicgames.com':443
- '14#.#6.108.92':483
- 'to###.tom.com':25
- 'ma##.#-email.net':25
- 'mx#######e03.gslb.pphosted.com':25
- 'ye######.mxmail.netease.com':25
- 'sm###in.iol.it':25
- 'ma##.##tmusicitalia.it':25
- 'se#####s.sunmedia.tv':443
- 'mx###.##il.am0.yahoodns.net':25
- 'et###.#ail.tiscali.it':25
- 'dn##.#avarca.com':25
- 'ma##.#eteditor.it':25
- 'st####.addevweb.com':443
- 'cl######.ap.messagelabs.com':25
- 'mx##.mail.com':25
- 'js.#gkn.com':443
- 'mx.##.#tinternet.com':25
- 'tp#.####lesyndication.com':443
- 'ww##.##artadserver.com':443
- 'mx#.#aver.com':25
- 'fo###.#oogleapis.com':443
- 'ma##.#etworkaias.it':25
- 'mx#######501.gslb.pphosted.com':25
- 'd.##kn.com':443
- 'sm####n.virgilio.it':25
- 'ma##.mst.com.au':25
- 'se####.spotxchange.com':443
- 'cd###.#loudflare.com':443
- 'es#######ntent.videoplaza.tv':443
- 'ce#.#ascdn.com':443
- 'sb.#####cardresearch.com':443
- 'mx.##timum.net':25
- 'ma########jomaanrobv.netdna-ssl.com':443
- 'pl#####m.sunmedia.tv':443
- 'st####.sunmedia.tv':443
- 'ox.##vecash.com':443
- 'ad#.###moneytizer.com':443
- 'oa#.##cuweather.com':443
- 'alt1.gmail-smtp-in.l.google.com':25
- 'qu######t.mgr.consensu.org':443
- 'go#####agservices.com':443
- 'go#####agmanager.com':443
- 'au##.#iotgames.com':443
- 'alt2.gmail-smtp-in.l.google.com':25
- 'mx#.#omcast.net':25
- 'ho#########.olc.protection.outlook.com':25
- 'cl######.us.messagelabs.com':25
- 'google.com':443
- 'ch###ispano.com':443
- 'go#####analytics.com':443
- 'gmail-smtp-in.l.google.com':25
- 'ma#####.#umanservices.gov.au':25
- 'st####.###ntcast.mgr.consensu.org':443
- 'mx.###lserver.it':25
- 'vo####.accuweather.com':443
- 'im.######ecurity.trendmicro.com':25
- 'ec######lcehtraining.com':80
- 'sm##.tin.it':25
- 'mx#.#otmail.com':25
- 've#####ist.consensu.org':443
- 'alt4.gmail-smtp-in.l.google.com':25
- 'ww####.#martadserver.com':443
- 'ce####.sascdn.com':443
- 're####n.cantv.net':25
- 'au###.####tcast.mgr.consensu.org':443
- 'pr########i-gateway.quantcast.com':443
- 'sm####n.inwind.it':25
- 'alt3.gmail-smtp-in.l.google.com':25
- 'mx.##a.untd.com':25
- 'sm####n.libero.it':25
- 'ma###.#ujitsu.com.au':25
- 'mx.##tworld.it':25
TCP
HTTP GET requests
- http://www.google.com/
UDP
- DNS ASK mi##########m.mail.protection.outlook.com
- DNS ASK vi####blue.com.au
- DNS ASK ne###itor.it
- DNS ASK ma##.#eteditor.it
- DNS ASK gf##.com.au
- DNS ASK ne###alia.it
- DNS ASK ve#####ist.consensu.org
- DNS ASK dn##.#avarca.com
- DNS ASK mx###.##il.am0.yahoodns.net
- DNS ASK se#####s.sunmedia.tv
- DNS ASK ne####icitalia.it
- DNS ASK ma##.##tmusicitalia.it
- DNS ASK ma####rie.com.au
- DNS ASK io#.it
- DNS ASK ma########jomaanrobv.netdna-ssl.com
- DNS ASK ya##o.gr
- DNS ASK ya##o.com
- DNS ASK st####.addevweb.com
- DNS ASK bd#.com.au
- DNS ASK pl#####m.sunmedia.tv
- DNS ASK re####n.cantv.net
- DNS ASK ag###.nsw.gov.au
- DNS ASK vi##ilio.it
- DNS ASK sm####n.virgilio.it
- DNS ASK fu###su.com.au
- DNS ASK sm###in.iol.it
- DNS ASK ma###.#ujitsu.com.au
- DNS ASK au###.####tcast.mgr.consensu.org
- DNS ASK ti#.it
- DNS ASK ne####omantovano.it
- DNS ASK ma##.###altomantovano.it
- DNS ASK ec######lcehtraining.com
- DNS ASK ne##all.it
- DNS ASK mx.###lserver.it
- DNS ASK ac###eather.com
- DNS ASK st####.sunmedia.tv
- DNS ASK sm##.tin.it
- DNS ASK ca##v.net
- DNS ASK co######talspirits.com.au
- DNS ASK aa###.com.au
- DNS ASK d.##kn.com
- DNS ASK ww####.#martadserver.com
- DNS ASK ta##.com.au
- DNS ASK mx#######501.gslb.pphosted.com
- DNS ASK ne###rkaias.it
- DNS ASK ma##.#etworkaias.it
- DNS ASK ms#.com.au
- DNS ASK fo###.#oogleapis.com
- DNS ASK mx.##tworld.it
- DNS ASK ww##.##artadserver.com
- DNS ASK tp#.####lesyndication.com
- DNS ASK bt###ernet.com
- DNS ASK mx.##.#tinternet.com
- DNS ASK ce####.sascdn.com
- DNS ASK tm##l.com
- DNS ASK ne##ait.it
- DNS ASK ma##.mst.com.au
- DNS ASK se####.spotxchange.com
- DNS ASK mx#.#harter.net
- DNS ASK to#.com
- DNS ASK to###.tom.com
- DNS ASK ac###########c-service-prod.ol.epicgames.com
- DNS ASK th###.com.au
- DNS ASK sm#####.three.com.au
- DNS ASK ne##olis.it
- DNS ASK ma##.#-email.net
- DNS ASK mx#######e03.gslb.pphosted.com
- DNS ASK do##or.com
- DNS ASK mx.##timum.net
- DNS ASK sb.#####cardresearch.com
- DNS ASK ce#.#ascdn.com
- DNS ASK es#######ntent.videoplaza.tv
- DNS ASK cd###.#loudflare.com
- DNS ASK mx##.mail.com
- DNS ASK op###line.net
- DNS ASK js.#gkn.com
- DNS ASK pr########i-gateway.quantcast.com
- DNS ASK ed####.wa.edu.au
- DNS ASK sm####n.inwind.it
- DNS ASK ma##.#elkomsa.net
- DNS ASK da####angdon.com.au
- DNS ASK mx#######703.gslb.pphosted.com
- DNS ASK li##ro.it
- DNS ASK sm####n.libero.it
- DNS ASK la##ste.net
- DNS ASK ch##ter.net
- DNS ASK sm####.laposte.net
- DNS ASK sb###obal.net
- DNS ASK al######x-vip2.prodigy.net
- DNS ASK st#####.griffith.edu.au
- DNS ASK ti###linet.it
- DNS ASK ne###paco.it
- DNS ASK ho##ail.com
- DNS ASK et###.#ail.tiscali.it
- DNS ASK te###msa.net
- DNS ASK ti##ali.it
- DNS ASK ma##.#spdr.net.au
- DNS ASK 19#.###.211.95.in-addr.arpa
- DNS ASK 19#.###.#11.95.bl.spamcop.net
- DNS ASK 19#.###.#11.95.zen.spamhaus.org
- DNS ASK 19#.###.##1.95.sbl-xbl.spamhaus.org
- DNS ASK 19#.###.#11.95.cbl.abuseat.org
- DNS ASK ne##net.it
- DNS ASK ma##.#eroopaco.it
- DNS ASK alt2.gmail-smtp-in.l.google.com
- DNS ASK alt4.gmail-smtp-in.l.google.com
- DNS ASK ne##ipi.it
- DNS ASK mt##.##0.yahoodns.net
- DNS ASK mx.##otipi.it
- DNS ASK nw##ble.net
- DNS ASK mx.##cable.net
- DNS ASK is###.com.au
- DNS ASK mx.##nanet.it
- DNS ASK 19#.###.#11.95.dnsbl.sorbs.net
- DNS ASK mx#.#otmail.com
- DNS ASK ho#########.olc.protection.outlook.com
- DNS ASK na##r.com
- DNS ASK mx#.#omcast.net
- DNS ASK su#####metway.com.au
- DNS ASK go#####agmanager.com
- DNS ASK go#####agservices.com
- DNS ASK qu######t.mgr.consensu.org
- DNS ASK oa#.##cuweather.com
- DNS ASK co##ast.net
- DNS ASK nc###nt.com.au
- DNS ASK au##.#iotgames.com
- DNS ASK ad#.###moneytizer.com
- DNS ASK go#####analytics.com
- DNS ASK st####.###ntcast.mgr.consensu.org
- DNS ASK vo####.accuweather.com
- DNS ASK de####slaw.com.au
- DNS ASK in##nd.it
- DNS ASK ox.##vecash.com
- DNS ASK me######australia.gov.au
- DNS ASK ma#####.#umanservices.gov.au
- DNS ASK ne##orld.it
- DNS ASK mx#.#aver.com
- DNS ASK ch###ispano.com
- DNS ASK ye######.mxmail.netease.com
- DNS ASK gm##l.com
- DNS ASK gmail-smtp-in.l.google.com
- DNS ASK md###s.com.au
- DNS ASK ma##.#dslms.com.au
- DNS ASK su###rp.com.au
- DNS ASK alt1.gmail-smtp-in.l.google.com
- DNS ASK cl######.us.messagelabs.com
- DNS ASK cl######.ap.messagelabs.com
- DNS ASK im.######ecurity.trendmicro.com
- DNS ASK ne##ero.com
- DNS ASK mx.##a.untd.com
- DNS ASK alt3.gmail-smtp-in.l.google.com
- DNS ASK google.com
- DNS ASK hw#.com.au
- DNS ASK ye##.net
- DNS ASK he####.wa.gov.au
- '<DNS_SERVER>':53
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\evinewgy\chuuxwmr.exe' /d"<Full path to file>"
- '<SYSTEM32>\cmd.exe' /C mkdir <SYSTEM32>\evinewgy\' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C move /Y "%TEMP%\chuuxwmr.exe" <SYSTEM32>\evinewgy\' (with hidden window)
- '<SYSTEM32>\sc.exe' create evinewgy binPath= "<SYSTEM32>\evinewgy\chuuxwmr.exe /d\"<Full path to file>\"" type= own start= auto DisplayName= "wifi support"' (with hidden window)
- '<SYSTEM32>\sc.exe' description evinewgy "wifi internet conection"' (with hidden window)
- '<SYSTEM32>\sc.exe' start evinewgy' (with hidden window)
Executes the following
- '<SYSTEM32>\cmd.exe' /C mkdir <SYSTEM32>\evinewgy\
- '<SYSTEM32>\cmd.exe' /C move /Y "%TEMP%\chuuxwmr.exe" <SYSTEM32>\evinewgy\
- '<SYSTEM32>\sc.exe' create evinewgy binPath= "<SYSTEM32>\evinewgy\chuuxwmr.exe /d\"<Full path to file>\"" type= own start= auto DisplayName= "wifi support"
- '<SYSTEM32>\sc.exe' description evinewgy "wifi internet conection"
- '<SYSTEM32>\sc.exe' start evinewgy
- '<SYSTEM32>\svchost.exe'