Technical Information
To ensure autorun and distribution
Creates the following services
- [<HKLM>\System\CurrentControlSet\Services\apmtyeqs] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\apmtyeqs] 'ImagePath' = '<SYSTEM32>\apmtyeqs\rnhntvne.exe /d"<Full path to file>"'
- [<HKLM>\SYSTEM\CurrentControlSet\services\apmtyeqs] 'ImagePath' = '<SYSTEM32>\apmtyeqs\rnhntvne.exe'
Malicious functions
Injects code into
the following system processes:
- <SYSTEM32>\svchost.exe
Modifies file system
Creates the following files
- %TEMP%\rnhntvne.exe
- C:\documents and settings\localservice:.repos
Moves the following files
- from %TEMP%\rnhntvne.exe to <SYSTEM32>\apmtyeqs\rnhntvne.exe
Deletes itself.
Network activity
Connects to
- 'aspmx.l.google.com':25
- 'mx.##deotron.ca':25
- '69.#1.136.5':443
- 'mt#.bnet.cn':25
- 'op############-com01e.mail.protection.outlook.com':25
- 'in##.rambler.ru':25
- 'sm###in.sfr.fr':25
- 'ma####.exxonmobil.com':25
- 'alt1.aspmx.l.google.com':25
- 'ma##.#axwell.com.sg':25
- 're####.gd-ais.com':25
- 'cl######.us.messagelabs.com':25
- 'ma#####2.integra-ls.com':25
- 'mx.#m.hc.ru':25
- 'mx#######401.gslb.pphosted.com':25
- 'sm##.##b.shawcable.net':25
- 'ma##.####l-salzburgerhof.com':25
- 'ap#.###.#rotection.outlook.com':25
- 'mx#.##ailsrvr.com':25
- 'mx.####iciodecorreo.es':25
- 'mx###.ewetel.de':25
- '77.#8.55.77':443
- 'mx#######a03.gslb.pphosted.com':25
- 'mx#.#oair.com':25
- 'mx#######801.gslb.pphosted.com':25
- 'ca####maepobre.org':25
- 'ns##.###oralphlauren.com':25
- 'mu######.unicreditgroup.eu':25
- 'sm##.####pe.secureserver.net':25
- 'mx#.##aroutes.com':25
- 'ow###########-uk.mail.protection.outlook.com':25
- 'ma##.#appyisp.com':25
- 'ma###.#aint-gobain.com':25
- 'ma####-a.wnco.com':25
- 'an#####m.hosthane.com':25
- 'ma###.kccworld.net':25
- 'mx#######702.gslb.pphosted.com':25
- 'am####05.aig.com':25
- 'ar###########et-no.mail.protection.outlook.com':25
- 'mx##.#b.bluewin.ch':25
- 'mx#######301.gslb.pphosted.com':25
- 'mx#.##jorisp.net':25
- 'ma##.##hyrtlplatz.at':25
- 'ma##.#apperla.net':25
- 'mx#.##bertel.com.ar':25
- 'mx#.##il.aliyun.com':25
- 'mx######91d01.pphosted.com':25
- 'mx######b2d01.pphosted.com':25
- 'bs#####01.bsd405.org':25
- 'in###nd.gci.net':25
- 'ma##.igafa.de':25
- 'mx#.ovh.net':25
- 'ma##.#arykay.com':25
- 'fr#####.#inamail.sina.com.cn':25
- 'mx###.upcmail.net':25
- 'mx###.##il.am0.yahoodns.net':25
- 'ms#####p-mx1.hinet.net':25
- 'mx#.#harter.net':25
- 'se#####r.teleline.es':25
- 'er######.##il.protection.outlook.com':25
- 'ho#########.olc.protection.outlook.com':25
- 'na#.###.#rotection.outlook.com':25
- 'mt##.##0.yahoodns.net':25
- 'sm####n.orange.fr':25
- 'mx####.##il.gm0.yahoodns.net':25
- 'mx###.vip.qq.com':25
- 'mx#.##rthlink.net':25
- 'mx####.##il.am0.yahoodns.net':25
- 'sm##.##cureserver.net':25
- '14#.#6.108.92':484
- 'ls###.ezweb.ne.jp':25
- 'mx#.#anmail.net':25
- 'mx#.#igmir.net':25
- 'in#####.vetted.raytheon.com':25
- 'mx######3b701.pphosted.com':25
- 'ma##.b-io.co':25
- 'mx#.#mpal.com':25
- 'mx#.##il.icloud.com':25
- 'as###.daum.net':25
- 'ms#####.##c.protection.outlook.com':25
- 'mx.###.###.cust.b.hostedemail.com':25
- 'mi########o.net.mx1.arvig.rcimx.net':25
- 'mx.####o.locaweb.com.br':25
- 'mx#.##tech.com.au':25
- 'mx##.#indstream.net':25
- 'mx#.#ltibox.net':25
TCP
HTTP GET requests
- http://www.google.com/
- http://ip#####.#hatismyipaddress.com/
UDP
- DNS ASK mi##########m.mail.protection.outlook.com
- DNS ASK mx#.##ailsrvr.com
- DNS ASK co###serve.com
- DNS ASK ba###er.com.ar
- DNS ASK alt1.aspmx.l.google.com
- DNS ASK pa####esltd.com.ar
- DNS ASK fm##rs.com
- DNS ASK ce#####ashionstyle.com
- DNS ASK ct####lsupply.com
- DNS ASK ut##lke.com
- DNS ASK ex###mobil.com
- DNS ASK cl####nternet.fr
- DNS ASK my###dprint.com
- DNS ASK sm###in.sfr.fr
- DNS ASK op####-uredjaji.com
- DNS ASK op############-com01e.mail.protection.outlook.com
- DNS ASK ra##ler.ru
- DNS ASK in##.rambler.ru
- DNS ASK sh##3.net
- DNS ASK mt#.bnet.cn
- DNS ASK su###net.com.ar
- DNS ASK vi###tron.ca
- DNS ASK mx.##deotron.ca
- DNS ASK we###ert.com
- DNS ASK ma####.exxonmobil.com
- DNS ASK cl######.us.messagelabs.com
- DNS ASK ma##.####l-salzburgerhof.com
- DNS ASK vs###tlplatz.at
- DNS ASK ma##.##hyrtlplatz.at
- DNS ASK ma###isp.net
- DNS ASK mx#.##jorisp.net
- DNS ASK sm###equip.com
- DNS ASK mx#.##aroutes.com
- DNS ASK da###inkok.com
- DNS ASK li#e.jp
- DNS ASK ap#.###.#rotection.outlook.com
- DNS ASK ho#####alzburgerhof.com
- DNS ASK ty####.menatepspb.com
- DNS ASK ma#####2.integra-ls.com
- DNS ASK sh#w.ca
- DNS ASK sm##.##b.shawcable.net
- DNS ASK in####alintl.com
- DNS ASK mx#######401.gslb.pphosted.com
- DNS ASK ku##y.ru
- DNS ASK mx.#m.hc.ru
- DNS ASK ma###ll.com.sg
- DNS ASK ma##.#axwell.com.sg
- DNS ASK ev###eit.net
- DNS ASK ra###nics.com
- DNS ASK we##.com
- DNS ASK eu.#ony.com
- DNS ASK ly##.net
- DNS ASK ow####sign.co.uk
- DNS ASK wa##doo.fr
- DNS ASK sm####n.orange.fr
- DNS ASK ae##rea.net
- DNS ASK ya###.com.au
- DNS ASK gu####tygroup.com
- DNS ASK ca#####consultores.com
- DNS ASK sm##.####pe.secureserver.net
- DNS ASK cz.##b-cee.com
- DNS ASK mu######.unicreditgroup.eu
- DNS ASK po####lphlauren.com
- DNS ASK ca####maepobre.org
- DNS ASK re####.gd-ais.com
- DNS ASK qu###ilver.com
- DNS ASK mx#######801.gslb.pphosted.com
- DNS ASK re#.com
- DNS ASK mx#######a03.gslb.pphosted.com
- DNS ASK co##r.com
- DNS ASK mx#.#oair.com
- DNS ASK ve##zon.net
- DNS ASK ma##kay.com
- DNS ASK ma##.#arykay.com
- DNS ASK dr###homes.com
- DNS ASK mx##.#b.bluewin.ch
- DNS ASK ga####forestal.com
- DNS ASK bl##win.ch
- DNS ASK ma###.kccworld.net
- DNS ASK ow###########-uk.mail.protection.outlook.com
- DNS ASK ru####.neoroad.net
- DNS ASK no###com.net
- DNS ASK mx###.ewetel.de
- DNS ASK ma##.wsu.edu
- DNS ASK mx#######301.gslb.pphosted.com
- DNS ASK vk#v.hr
- DNS ASK ar####stilsynet.no
- DNS ASK ar###########et-no.mail.protection.outlook.com
- DNS ASK kc###rld.net
- DNS ASK ax##s.com
- DNS ASK dd##.net
- DNS ASK mx#######702.gslb.pphosted.com
- DNS ASK am####05.aig.com
- DNS ASK ma##usta.lt
- DNS ASK fa####indo-cp.co.id
- DNS ASK me###.com.tr
- DNS ASK an#####m.hosthane.com
- DNS ASK wn##.com
- DNS ASK ma####-a.wnco.com
- DNS ASK sa####gobain.com
- DNS ASK ma###.#aint-gobain.com
- DNS ASK ma##.#appyisp.com
- DNS ASK ns##.###oralphlauren.com
- DNS ASK mi###minet.com
- DNS ASK bi##ir.net
- DNS ASK ch##ter.net
- DNS ASK mx#.#harter.net
- DNS ASK ms##.hinet.net
- DNS ASK ms#####p-mx1.hinet.net
- DNS ASK fi###tel.com.ar
- DNS ASK mx#.##bertel.com.ar
- DNS ASK sw###online.ch
- DNS ASK mx###.upcmail.net
- DNS ASK ya##o.de
- DNS ASK ya##o.com
- DNS ASK fl####epommier.net
- DNS ASK mx######91d01.pphosted.com
- DNS ASK mx#.ovh.net
- DNS ASK ig##a.de
- DNS ASK ma##.igafa.de
- DNS ASK gc#.net
- DNS ASK in###nd.gci.net
- DNS ASK bs##05.org
- DNS ASK bs#####01.bsd405.org
- DNS ASK ms#.#inet.net
- DNS ASK in.#bm.com
- DNS ASK ci###lar.com
- DNS ASK se#####r.teleline.es
- DNS ASK mt##.##0.yahoodns.net
- DNS ASK te##line.es
- DNS ASK us.#bm.com
- DNS ASK 19#.###.211.95.in-addr.arpa
- DNS ASK 19#.###.#11.95.dnsbl.sorbs.net
- DNS ASK 19#.###.#11.95.bl.spamcop.net
- DNS ASK 19#.###.#11.95.zen.spamhaus.org
- DNS ASK 19#.###.##1.95.sbl-xbl.spamhaus.org
- DNS ASK 19#.###.#11.95.cbl.abuseat.org
- DNS ASK ya##o.es
- DNS ASK mx###.##il.am0.yahoodns.net
- DNS ASK ho##ail.com
- DNS ASK ho#########.olc.protection.outlook.com
- DNS ASK mx######b2d01.pphosted.com
- DNS ASK er##.edu
- DNS ASK gm##l.com
- DNS ASK gmail-smtp-in.l.google.com
- DNS ASK do###eclick.net
- DNS ASK aspmx.l.google.com
- DNS ASK kn###p.i-m.de
- DNS ASK mx.##omsys.de
- DNS ASK google.com
- DNS ASK wi###wslive.com
- DNS ASK na#.###.#rotection.outlook.com
- DNS ASK nj###.umdnj.edu
- DNS ASK er######.##il.protection.outlook.com
- DNS ASK mx###.vip.qq.com
- DNS ASK pa###rla.net
- DNS ASK mx#.##il.aliyun.com
- DNS ASK mx#.##il.icloud.com
- DNS ASK te##a.es
- DNS ASK an#t.es
- DNS ASK mx.####iciodecorreo.es
- DNS ASK de##zzd.com
- DNS ASK mx##.#indstream.net
- DNS ASK sy##t.net
- DNS ASK ma##.b-io.co
- DNS ASK ra###eon.com
- DNS ASK in#####.vetted.raytheon.com
- DNS ASK mx#.#igmir.net
- DNS ASK al##un.com
- DNS ASK ai#####unications.net
- DNS ASK ha##ail.net
- DNS ASK mx#.#anmail.net
- DNS ASK ko###rveen48.nl
- DNS ASK ez##b.ne.jp
- DNS ASK ls###.ezweb.ne.jp
- DNS ASK st####ndbarrys.com
- DNS ASK sm##.##cureserver.net
- DNS ASK po###-serv.com
- DNS ASK mx####.##il.am0.yahoodns.net
- DNS ASK ma#.com
- DNS ASK ma##.#apperla.net
- DNS ASK as###.daum.net
- DNS ASK he###tec.com
- DNS ASK si##.com
- DNS ASK fr#####.#inamail.sina.com.cn
- DNS ASK em##l.com
- DNS ASK mx#.#mpal.com
- DNS ASK ao#.com
- DNS ASK mx####.##il.gm0.yahoodns.net
- DNS ASK mi###pring.com
- DNS ASK mx#.##rthlink.net
- DNS ASK us##.com
- DNS ASK mx######3b701.pphosted.com
- DNS ASK jp#####tencao.com.br
- DNS ASK ms#####.##c.protection.outlook.com
- DNS ASK sm###bridge.net
- DNS ASK mx#.##tech.com.au
- DNS ASK gl##o.com
- DNS ASK mx.####o.locaweb.com.br
- DNS ASK mi###stinfo.net
- DNS ASK ai#.com
- DNS ASK mi########o.net.mx1.arvig.rcimx.net
- DNS ASK mx.###.###.cust.b.hostedemail.com
- DNS ASK ya##o.co.uk
- DNS ASK ms#.com
- DNS ASK pa##n.com
- DNS ASK mx#.#ltibox.net
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\apmtyeqs\rnhntvne.exe' /d"<Full path to file>"
- '<SYSTEM32>\cmd.exe' /C mkdir <SYSTEM32>\apmtyeqs\' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C move /Y "%TEMP%\rnhntvne.exe" <SYSTEM32>\apmtyeqs\' (with hidden window)
- '<SYSTEM32>\sc.exe' create apmtyeqs binPath= "<SYSTEM32>\apmtyeqs\rnhntvne.exe /d\"<Full path to file>\"" type= own start= auto DisplayName= "wifi support"' (with hidden window)
- '<SYSTEM32>\sc.exe' description apmtyeqs "wifi internet conection"' (with hidden window)
- '<SYSTEM32>\sc.exe' start apmtyeqs' (with hidden window)
Executes the following
- '<SYSTEM32>\cmd.exe' /C mkdir <SYSTEM32>\apmtyeqs\
- '<SYSTEM32>\cmd.exe' /C move /Y "%TEMP%\rnhntvne.exe" <SYSTEM32>\apmtyeqs\
- '<SYSTEM32>\sc.exe' create apmtyeqs binPath= "<SYSTEM32>\apmtyeqs\rnhntvne.exe /d\"<Full path to file>\"" type= own start= auto DisplayName= "wifi support"
- '<SYSTEM32>\sc.exe' description apmtyeqs "wifi internet conection"
- '<SYSTEM32>\sc.exe' start apmtyeqs
- '<SYSTEM32>\svchost.exe'