Technical Information
To ensure autorun and distribution
Creates the following services
- [<HKLM>\System\CurrentControlSet\Services\frtalagb] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\frtalagb] 'ImagePath' = '<SYSTEM32>\frtalagb\younowmv.exe /d"<Full path to file>"'
- [<HKLM>\SYSTEM\CurrentControlSet\services\frtalagb] 'ImagePath' = '<SYSTEM32>\frtalagb\younowmv.exe'
Malicious functions
Injects code into
the following system processes:
- <SYSTEM32>\svchost.exe
Modifies file system
Creates the following files
- %TEMP%\younowmv.exe
- C:\documents and settings\localservice:.repos
Moves the following files
- from %TEMP%\younowmv.exe to <SYSTEM32>\frtalagb\younowmv.exe
Deletes itself.
Network activity
TCP
HTTP GET requests
- http://www.google.com/
- http://ap#.##-cy.ru:35000/
UDP
- DNS ASK mi##########m.mail.protection.outlook.com
- DNS ASK mx.#####rong.synacor.com
- DNS ASK za###eek.com
- DNS ASK as##.#ostlinq.nl
- DNS ASK 3i###ant.com
- DNS ASK ag###ilenio.com
- DNS ASK sm##.##cureserver.net
- DNS ASK un##oma1.it
- DNS ASK an###mgroup.com
- DNS ASK ya##o.co.kr
- DNS ASK cr#####eplaythings.com
- DNS ASK bk#.com
- DNS ASK de###tte.com
- DNS ASK mx#.###oitte.iphmx.com
- DNS ASK ep###-mag.com
- DNS ASK jm##p.com
- DNS ASK lb##.com
- DNS ASK le##isa.com
- DNS ASK mx.##onisa.com
- DNS ASK ef##sa.net
- DNS ASK zo####ternet.net
- DNS ASK mx#####.#ail.gm0.yahoodns.net
- DNS ASK ma##.#nibetonrm.com
- DNS ASK mx#######d01.gslb.pphosted.com
- DNS ASK vo###nberg.nl
- DNS ASK mx##.###computercompany.nl
- DNS ASK st##ker.com
- DNS ASK mx#######c01.gslb.pphosted.com
- DNS ASK fa####hnologies.net
- DNS ASK ea###link.net
- DNS ASK mx#.##rthlink.net
- DNS ASK ne####npharm.com
- DNS ASK vo#####ergfotografie.nl
- DNS ASK cl######.us.messagelabs.com
- DNS ASK vo##en.com
- DNS ASK ma##re.com
- DNS ASK cu#######-1.in.mailcontrol.com
- DNS ASK sy##et.it
- DNS ASK rs#.#ysnet.it
- DNS ASK pe##y.net
- DNS ASK ma##.gpu.no
- DNS ASK un###tonrm.com
- DNS ASK wa##.vossen.com
- DNS ASK si##et.it
- DNS ASK mx.###.tiscali.com
- DNS ASK go##le.ca
- DNS ASK za###erg.co.il
- DNS ASK ny##sa.com
- DNS ASK ny##dr.com
- DNS ASK ce##ir.com
- DNS ASK ab##t.com
- DNS ASK jo###ihtex.com
- DNS ASK mo###e-med.com
- DNS ASK ma##.#obile-med.com
- DNS ASK da##.net
- DNS ASK co####.venezia.it
- DNS ASK alt2.aspmx.l.google.com
- DNS ASK mx#.#mpal.com
- DNS ASK ym##l.com
- DNS ASK ol####titecnost.com
- DNS ASK yc##.com
- DNS ASK un###ecci.it
- DNS ASK in.###estore.net
- DNS ASK do###eclick.net
- DNS ASK ap#.#r-cy.ru
- DNS ASK ti###linet.it
- DNS ASK gr##om.com
- DNS ASK na####rinegrp.com
- DNS ASK ma###.#omune.venezia.it
- DNS ASK ma##.####enbergfotografie.nl
- DNS ASK cy##p.com
- DNS ASK ma#####.freelotto.com
- DNS ASK sm####n.orange.fr
- DNS ASK jo##ma.com
- DNS ASK vi###aker.com
- DNS ASK ki###aff.com
- DNS ASK ma##.#imstaff.com
- DNS ASK gr#####recional.com.br
- DNS ASK mx.####.locaweb.com.br
- DNS ASK di##ctv.com
- DNS ASK mx.##.163.com
- DNS ASK sm##.#ncloud.co.il
- DNS ASK wa##doo.fr
- DNS ASK av#####espeedway.com
- DNS ASK mx.##########eedway.com.cust.a.hostedemail.com
- DNS ASK gr###roup.com
- DNS ASK mo####inzone.com
- DNS ASK es##r.com
- DNS ASK ma###.essar.com
- DNS ASK gu####rsonnel.com
- DNS ASK go####ecrossing.com
- DNS ASK fr###otto.com
- DNS ASK mx######91d01.pphosted.com
- DNS ASK em##l.com
- DNS ASK ma##.comfox.nl
- DNS ASK vo###nadvies.nl
- DNS ASK ha##ail.net
- DNS ASK mx#.#anmail.net
- DNS ASK co###e.fi.it
- DNS ASK sm###.comune.fi.it
- DNS ASK at###ticbb.net
- DNS ASK ma##.#tlanticbb.net
- DNS ASK uw###mni.com
- DNS ASK cw###ama.net
- DNS ASK ma##.grucom.com
- DNS ASK sm##.tin.it
- DNS ASK ho##ail.fr
- DNS ASK ca###one.net
- DNS ASK mx.##bleone.net
- DNS ASK te####project.it
- DNS ASK vi##ilio.it
- DNS ASK sm####n.virgilio.it
- DNS ASK sr#.com
- DNS ASK mx.###.#ail.iss.as9143.net
- DNS ASK zi##o.nl
- DNS ASK mx##.#pcmail.net
- DNS ASK eu#.###.#rotection.outlook.com
- DNS ASK ma###xcite.com
- DNS ASK mt##.##0.yahoodns.net
- DNS ASK 19#.###.211.95.in-addr.arpa
- DNS ASK hm#.#000net.it
- DNS ASK 19#.###.#11.95.dnsbl.sorbs.net
- DNS ASK 19#.###.#11.95.bl.spamcop.net
- DNS ASK d1##c.com
- DNS ASK 19#.###.#11.95.zen.spamhaus.org
- DNS ASK ma##.d1plc.com
- DNS ASK ny#.edu
- DNS ASK sr#.###.mx2.srt.rcimx.net
- DNS ASK mx#######a01.gslb.pphosted.com
- DNS ASK ya##o.com
- DNS ASK fu###eway.com
- DNS ASK sm#####.futureway.com
- DNS ASK he###-smith.com
- DNS ASK ASPMX.L.GOOGLE.com
- DNS ASK na####snetwork.net
- DNS ASK ma##.##tionsnetwork.net
- DNS ASK gm##l.com
- DNS ASK alt3.gmail-smtp-in.l.google.com
- DNS ASK 19#.###.##1.95.sbl-xbl.spamhaus.org
- DNS ASK ma####equasimodo.it
- DNS ASK 19#.###.#11.95.cbl.abuseat.org
- DNS ASK vu###splay.com
- DNS ASK ya##o.it
- DNS ASK in##nd.it
- DNS ASK google.com
- DNS ASK v3##te.com
- DNS ASK si##a.edu
- DNS ASK tr##e.com
- DNS ASK mx#######e01.gslb.pphosted.com
- DNS ASK ho##ail.com
- DNS ASK ho#########.olc.protection.outlook.com
- DNS ASK ad##ess.com
- DNS ASK mx#.ovh.net
- DNS ASK ca###ommerce.it
- DNS ASK ya##o.de
- DNS ASK se####.loswebos.de
- DNS ASK vo###burcht.com
- DNS ASK ma##.##sseburcht.com
- DNS ASK ya##o.co.uk
- DNS ASK vo####liasson.dk
- DNS ASK mx#.###.#ailpod2-cph3.one.com
- DNS ASK ya###.com.br
- DNS ASK in##nie.fr
- DNS ASK mx#.free.fr
- DNS ASK vo##bau.de
- DNS ASK ma####.mailtwo.com
- DNS ASK xm####a.excite.com
- DNS ASK ti#.it
- DNS ASK sm####n.inwind.it
- DNS ASK mb##.thunder.it
- DNS ASK vo##fone.it
- DNS ASK mx.#####one.arubamail.it
- DNS ASK ro##et-x.de
- DNS ASK ma##.#ocket-x.de
- DNS ASK pl##et.net
- DNS ASK vu###esson.com
- DNS ASK mx###.##il.am0.yahoodns.net
- DNS ASK sm###in.iol.it
- DNS ASK as####.googlemail.com
- DNS ASK sm##.##b.shawcable.net
- DNS ASK ya###.com.au
- DNS ASK ro####ndtrust.com
- DNS ASK mx#######401.gslb.pphosted.com
- DNS ASK ti##ali.it
- DNS ASK et###.#ail.tiscali.it
- DNS ASK io#.it
- DNS ASK li##ro.it
- DNS ASK sm####n.libero.it
- DNS ASK sh#w.ca
- '<DNS_SERVER>':53
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\frtalagb\younowmv.exe' /d"<Full path to file>"
- '<SYSTEM32>\cmd.exe' /C mkdir <SYSTEM32>\frtalagb\' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C move /Y "%TEMP%\younowmv.exe" <SYSTEM32>\frtalagb\' (with hidden window)
- '<SYSTEM32>\sc.exe' create frtalagb binPath= "<SYSTEM32>\frtalagb\younowmv.exe /d\"<Full path to file>\"" type= own start= auto DisplayName= "wifi support"' (with hidden window)
- '<SYSTEM32>\sc.exe' description frtalagb "wifi internet conection"' (with hidden window)
- '<SYSTEM32>\sc.exe' start frtalagb' (with hidden window)
Executes the following
- '<SYSTEM32>\cmd.exe' /C mkdir <SYSTEM32>\frtalagb\
- '<SYSTEM32>\cmd.exe' /C move /Y "%TEMP%\younowmv.exe" <SYSTEM32>\frtalagb\
- '<SYSTEM32>\sc.exe' create frtalagb binPath= "<SYSTEM32>\frtalagb\younowmv.exe /d\"<Full path to file>\"" type= own start= auto DisplayName= "wifi support"
- '<SYSTEM32>\sc.exe' description frtalagb "wifi internet conection"
- '<SYSTEM32>\sc.exe' start frtalagb
- '<SYSTEM32>\svchost.exe'