Technical Information
To ensure autorun and distribution
Creates the following services
- [<HKLM>\System\CurrentControlSet\Services\rpsdogpm] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\rpsdogpm] 'ImagePath' = '<SYSTEM32>\rpsdogpm\ljqmlusj.exe /d"<Full path to file>"'
- [<HKLM>\SYSTEM\CurrentControlSet\services\rpsdogpm] 'ImagePath' = '<SYSTEM32>\rpsdogpm\ljqmlusj.exe'
Malicious functions
Injects code into
the following system processes:
- <SYSTEM32>\svchost.exe
Modifies file system
Creates the following files
- %TEMP%\ljqmlusj.exe
- C:\documents and settings\localservice:.repos
Moves the following files
- from %TEMP%\ljqmlusj.exe to <SYSTEM32>\rpsdogpm\ljqmlusj.exe
Deletes itself.
Network activity
TCP
HTTP GET requests
- http://www.google.com/
UDP
- DNS ASK mi##########m.mail.protection.outlook.com
- DNS ASK ya##o.co.id
- DNS ASK la###mail.com
- DNS ASK ta###andevu.org
- DNS ASK ca#####nspeakers.org
- DNS ASK no####dclinic.com
- DNS ASK ho####ahomes.org
- DNS ASK as####.googlemail.com
- DNS ASK ya##o.co.kr
- DNS ASK gr###era.com
- DNS ASK vi########er.fra02.hls.ttvnw.net
- DNS ASK ab##twe.com
- DNS ASK ha###burton.com
- DNS ASK mx#######f01.gslb.pphosted.com
- DNS ASK vf#.com
- DNS ASK mx#######801.gslb.pphosted.com
- DNS ASK hy###ong.co.kr
- DNS ASK ma##.#yoseong.co.kr
- DNS ASK op.pl
- DNS ASK 13###lonies.com
- DNS ASK mx.#skon.hr
- DNS ASK in#t.hr
- DNS ASK in####ourse.club
- DNS ASK ma##.#-email.net
- DNS ASK ma##.rdstm.ro
- DNS ASK be###outh.com
- DNS ASK mx######91d01.pphosted.com
- DNS ASK te##pac.com
- DNS ASK sp#####andenglish.co.uk
- DNS ASK mx#.lcn.com
- DNS ASK ot##et.gr
- DNS ASK ke####thalev.org
- DNS ASK mx.##enet.gr
- DNS ASK al##un.com
- DNS ASK mx#####.#ail.gm0.yahoodns.net
- DNS ASK he###lberg.com
- DNS ASK ma###.#eidelberg.com
- DNS ASK si##.com
- DNS ASK fr#####.#inamail.sina.com.cn
- DNS ASK su###kpcb.com
- DNS ASK hz####.#xmail.netease.com
- DNS ASK ym##l.com
- DNS ASK mx#.##il.aliyun.com
- DNS ASK pi##uae.com
- DNS ASK li##.com.pt
- DNS ASK rd##m.ro
- DNS ASK va####ninfosoft.com
- DNS ASK ed####.###l.protection.outlook.com
- DNS ASK mx#######802.gslb.pphosted.com
- DNS ASK c2##pg.com
- DNS ASK sm##.##cureserver.net
- DNS ASK ya###.com.mx
- DNS ASK kl###h.com.cn
- DNS ASK kl#####.kltech.com.cn
- DNS ASK ms#.com
- DNS ASK ms#####.##c.protection.outlook.com
- DNS ASK ma##.#icrostep.fi
- DNS ASK ow##eru.com
- DNS ASK gr####olanas.com
- DNS ASK ma##.##uposolanas.com
- DNS ASK ya###.com.ar
- DNS ASK op####dia.com.cn
- DNS ASK ch######.us.publicisgroupe.net
- DNS ASK qq.com
- DNS ASK mx#.qq.com
- DNS ASK sa###hi.com.cn
- DNS ASK mx###.##il.gm0.yahoodns.net
- DNS ASK ki###ton.com.cn
- DNS ASK ya###.com.tw
- DNS ASK mi###step.fi
- DNS ASK ts##b.com
- DNS ASK im##ilco.ru
- DNS ASK ba##ch.com
- DNS ASK mx#.###eant.iphmx.com
- DNS ASK wd###son.com
- DNS ASK d1#####.##s.barracudanetworks.com
- DNS ASK li#e.ca
- DNS ASK na#.###.#rotection.outlook.com
- DNS ASK ya##o.ca
- DNS ASK ed.gov
- DNS ASK wi###on.com.tw
- DNS ASK ya##o.fr
- DNS ASK oh#.##ympus.com.hk
- DNS ASK oh##.#lympus.com.hk
- DNS ASK ly#####ou.kyk.sch.gr
- DNS ASK mx.#ch.gr
- DNS ASK ra###eon.com
- DNS ASK in#####.vetted.raytheon.com
- DNS ASK ev#.net
- DNS ASK mx###.##il.am0.yahoodns.net
- DNS ASK ex##te.com
- DNS ASK ma#######xcite.roc2.bluetie.com
- DNS ASK mx#.###.#ailpod8-cph3.one.com
- DNS ASK si##oft.nl
- DNS ASK google.com
- DNS ASK pe###epc.com
- DNS ASK wm####oczach.com.pl
- DNS ASK mx#.ovh.net
- DNS ASK ya##o.com
- DNS ASK mt##.##0.yahoodns.net
- DNS ASK ve####systems.com
- DNS ASK mx#.###746-61.iphmx.com
- DNS ASK nh#.com.sg
- DNS ASK sa##########cn.mail.protection.outlook.com
- DNS ASK ma###1.hmail.sg
- DNS ASK d1######.#ss.barracudanetworks.com
- DNS ASK ar##day.com
- DNS ASK jo###day.com
- DNS ASK na#####i.jonesday.com
- DNS ASK na##man.com
- DNS ASK aspmx.l.google.com
- DNS ASK ba##r.edu
- DNS ASK ma###.northgrum.com
- DNS ASK ng#.com
- DNS ASK mx#.##rthlink.net
- DNS ASK dm###.kagoya.net
- DNS ASK hp##p.com
- DNS ASK 19#.###.211.95.in-addr.arpa
- DNS ASK 19#.###.#11.95.dnsbl.sorbs.net
- DNS ASK ma##.#ntility.com
- DNS ASK ze###hmedia.com
- DNS ASK 19#.###.#11.95.bl.spamcop.net
- DNS ASK 19#.###.#11.95.zen.spamhaus.org
- DNS ASK pa######.fr.publicisgroupe.net
- DNS ASK 88####lagefm.com
- DNS ASK ao#.com
- DNS ASK 19#.###.##1.95.sbl-xbl.spamhaus.org
- DNS ASK hi###oint.edu
- DNS ASK 19#.###.#11.95.cbl.abuseat.org
- DNS ASK di#.wa.gov
- DNS ASK wa###.wa.gov
- DNS ASK o2.pl
- DNS ASK mx.#len.pl
- DNS ASK al###oft.com
- DNS ASK az###mail.com
- DNS ASK tw####groups.com
- DNS ASK pg#.com
- DNS ASK bd#.no
- DNS ASK mx#.##ailsrvr.com
- DNS ASK ea###link.net
- DNS ASK mx####.##il.gm0.yahoodns.net
- DNS ASK ei##om.net
- DNS ASK kp.org
- DNS ASK mx#######703.gslb.pphosted.com
- DNS ASK my.com
- DNS ASK mx#.my.com
- DNS ASK cp#.gov.sg
- DNS ASK sm###.sgict.gov.sg
- DNS ASK co##ast.net
- DNS ASK mx#.###-us.iphmx.com
- DNS ASK mx.###zta.onet.pl
- DNS ASK ma###.eircom.net
- DNS ASK mx#.#omcast.net
- DNS ASK te####oadhouse.com
- DNS ASK pr#####.##.email.fireeyecloud.com
- DNS ASK gr###bros.co.uk
- DNS ASK mx.###sin.plus.net
- DNS ASK gr######thersantiques.ca
- DNS ASK 01#.net.il
- DNS ASK mx##.012.net.il
- DNS ASK au###ntic.co.jp
- DNS ASK mx##.##umuu-mail.com
- DNS ASK th##.net
- DNS ASK ip##fo.io
- DNS ASK vp.pl
- DNS ASK na##eq.com
- DNS ASK ho###iil.co.uk
- DNS ASK mx##.m1bp.com
- DNS ASK ap###bot.co.jp
- DNS ASK alt1.aspmx.l.google.com
- DNS ASK ho##ail.com
- DNS ASK ho#########.olc.protection.outlook.com
- DNS ASK ho##ail.it
- DNS ASK wa###via.com
- DNS ASK eu#.###.#rotection.outlook.com
- DNS ASK sc##us.com
- DNS ASK ft####1.viawest.net
- DNS ASK ge#########.mail.protection.outlook.com
- DNS ASK ci##z.net
- DNS ASK mt#.bnet.cn
- DNS ASK gm##l.com
- DNS ASK alt1.gmail-smtp-in.l.google.com
- DNS ASK gl##o.com
- DNS ASK mx.####o.locaweb.com.br
- DNS ASK vi##est.net
- DNS ASK ba##one.com
- DNS ASK ge##ler.com
- '<DNS_SERVER>':53
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\rpsdogpm\ljqmlusj.exe' /d"<Full path to file>"
- '<SYSTEM32>\cmd.exe' /C mkdir <SYSTEM32>\rpsdogpm\' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C move /Y "%TEMP%\ljqmlusj.exe" <SYSTEM32>\rpsdogpm\' (with hidden window)
- '<SYSTEM32>\sc.exe' create rpsdogpm binPath= "<SYSTEM32>\rpsdogpm\ljqmlusj.exe /d\"<Full path to file>\"" type= own start= auto DisplayName= "wifi support"' (with hidden window)
- '<SYSTEM32>\sc.exe' description rpsdogpm "wifi internet conection"' (with hidden window)
- '<SYSTEM32>\sc.exe' start rpsdogpm' (with hidden window)
Executes the following
- '<SYSTEM32>\cmd.exe' /C mkdir <SYSTEM32>\rpsdogpm\
- '<SYSTEM32>\cmd.exe' /C move /Y "%TEMP%\ljqmlusj.exe" <SYSTEM32>\rpsdogpm\
- '<SYSTEM32>\sc.exe' create rpsdogpm binPath= "<SYSTEM32>\rpsdogpm\ljqmlusj.exe /d\"<Full path to file>\"" type= own start= auto DisplayName= "wifi support"
- '<SYSTEM32>\sc.exe' description rpsdogpm "wifi internet conection"
- '<SYSTEM32>\sc.exe' start rpsdogpm
- '<SYSTEM32>\svchost.exe'