Technical Information
To ensure autorun and distribution
Creates the following services
- [<HKLM>\System\CurrentControlSet\Services\bcqnyeox] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\bcqnyeox] 'ImagePath' = '<SYSTEM32>\bcqnyeox\cpdgiigt.exe /d"<Full path to file>"'
- [<HKLM>\SYSTEM\CurrentControlSet\services\bcqnyeox] 'ImagePath' = '<SYSTEM32>\bcqnyeox\cpdgiigt.exe'
Malicious functions
Injects code into
the following system processes:
- <SYSTEM32>\svchost.exe
Modifies file system
Creates the following files
- %TEMP%\cpdgiigt.exe
- C:\documents and settings\localservice:.repos
Moves the following files
- from %TEMP%\cpdgiigt.exe to <SYSTEM32>\bcqnyeox\cpdgiigt.exe
Deletes itself.
Network activity
Connects to
- 'mi##########m.mail.protection.outlook.com':25
- 'dc#########c4d2.tecnocombrasil.com.br':25
- 'mx.#p.pl':25
- 'cx#.##.#.cloudfilter.net':25
- 'ma##.#ercy.com.au':25
- 'mx#.#tlantis.sk':25
- 'mx#.###oul.tpg.com.au':25
- 'mx#######601.gslb.pphosted.com':25
- 'mx.####.thomsonreuters.com':25
- 'ms#####p-mx2.hinet.net':25
- 'sm###.#afesystems.com':25
- 'vi#####br-mx.terra.com':25
- 'cl#######.us.messagelabs.com':25
- 'mx#######a04.gslb.pphosted.com':25
- 'mx#.#aver.com':25
- 'hf######n02.thehartford.com':25
- 'sm##.##b.shawcable.net':25
- 'aspmx.l.google.com':25
- 'et###.#ail.tiscali.it':25
- 'mx#######d03.gslb.pphosted.com':25
- 'bl######n03.thehartford.com':25
- 'mx.#.#ocaweb.com.br':25
- 'pr#####2.mail.hol.gr':25
- 'mx#.#mr.gm.com':25
- 'pr####.oneas1a.com':25
- 'mx#######201.gslb.pphosted.com':25
- 'ma##.tula.net':25
- 'mx######6dd01.pphosted.com':25
- 'sm###.state.or.us':25
- 'mx#######403.gslb.pphosted.com':25
- 'mx######91d01.pphosted.com':25
- '46.#.52.109':419
- '14#.#6.108.92':483
- 'ALT1.ASPMX.L.GOOGLE.COM':25
- 'mx#.#eznam.cz':25
- 'gmail-smtp-in.l.google.com':25
- 'mt##.##0.yahoodns.net':25
- 'mx.########.net.cust.b.hostedemail.com':25
- 'mx#######703.gslb.pphosted.com':25
- 'ma###.#arafiq.com.sa':25
- 'ms#####p-mx1.hinet.net':25
- 'ma##.###yofportsmouth.com':25
- 'ho#########.olc.protection.outlook.com':25
- 'mx#.#harter.net':25
- 'tw##ean.com':25
- 'ma##.##rwin.nt.gov.au':25
- 'mx#######401.gslb.pphosted.com':25
- 'vi####s.deranet.ph':25
- 'mx#######e01.gslb.pphosted.com':25
- '16#####.mxmail.netease.com':25
- 'mx#######c01.gslb.pphosted.com':25
- 'ma##.##edit-suisse.com':25
- 'mx#######002.gslb.pphosted.com':25
- 'mx####.##il.gm0.yahoodns.net':25
- 'mx#######c02.gslb.pphosted.com':25
- '14#.#6.199.43':419
- '14#.#6.199.2':419
- '85.##.119.25':419
- '17#.#11.49.43':419
- '43.#31.4.7':443
- 'mx#.##upm.edu.sa':25
- 'mx.#len.pl':25
UDP
- DNS ASK mi##########m.mail.protection.outlook.com
- DNS ASK ma##.##rwin.nt.gov.au
- DNS ASK da####.nt.gov.au
- DNS ASK mx#.#aver.com
- DNS ASK na##r.com
- DNS ASK cl#######.us.messagelabs.com
- DNS ASK jp###ase.com
- DNS ASK vi#####br-mx.terra.com
- DNS ASK te###.com.br
- DNS ASK sm###.#afesystems.com
- DNS ASK sa###ystems.com
- DNS ASK ms#####p-mx2.hinet.net
- DNS ASK mx.####.thomsonreuters.com
- DNS ASK te#####mbrasil.com.br
- DNS ASK th##son.com
- DNS ASK mx#######601.gslb.pphosted.com
- DNS ASK dp##.com
- DNS ASK mx#.###oul.tpg.com.au
- DNS ASK ko###.com.au
- DNS ASK mx#.#tlantis.sk
- DNS ASK ku##mi.eu
- DNS ASK ma##.#ercy.com.au
- DNS ASK me###.com.au
- DNS ASK cx#.##.#.cloudfilter.net
- DNS ASK co#.net
- DNS ASK mx.#p.pl
- DNS ASK wp.pl
- DNS ASK ao#.com
- DNS ASK dc#########c4d2.tecnocombrasil.com.br
- DNS ASK ha####rdlife.com
- DNS ASK ms#.#inet.net
- DNS ASK o2.pl
- DNS ASK ma##.tula.net
- DNS ASK tu##.net
- DNS ASK tw##ean.com
- DNS ASK mx#######201.gslb.pphosted.com
- DNS ASK wa###art.com
- DNS ASK ce####anpress.com
- DNS ASK mx#.#mr.gm.com
- DNS ASK gm.com
- DNS ASK pr#####2.mail.hol.gr
- DNS ASK ho#.gr
- DNS ASK pr####.oneas1a.com
- DNS ASK sh#w.ca
- DNS ASK hf######n02.thehartford.com
- DNS ASK mx.#.#ocaweb.com.br
- DNS ASK bo#####studio.com.br
- DNS ASK jj#c.nl
- DNS ASK bl######n03.thehartford.com
- DNS ASK th###rtford.com
- DNS ASK mx#######d03.gslb.pphosted.com
- DNS ASK st###ord.edu
- DNS ASK et###.#ail.tiscali.it
- DNS ASK ti###linet.it
- DNS ASK aspmx.l.google.com
- DNS ASK jj###dens.com
- DNS ASK sm##.##b.shawcable.net
- DNS ASK pr##k.com
- DNS ASK da####ones.com.au
- DNS ASK sm###.state.or.us
- DNS ASK hc#.#tate.or.us
- DNS ASK ma##.###yofportsmouth.com
- DNS ASK ci#####ortsmouth.com
- DNS ASK ms#####p-mx1.hinet.net
- DNS ASK ms##.hinet.net
- DNS ASK kp.org
- DNS ASK ma###.#arafiq.com.sa
- DNS ASK ma###iq.com.sa
- DNS ASK mx#######703.gslb.pphosted.com
- DNS ASK gh#.org
- DNS ASK mt##.##0.yahoodns.net
- DNS ASK ya##o.com
- DNS ASK ho#########.olc.protection.outlook.com
- DNS ASK mx.########.net.cust.b.hostedemail.com
- DNS ASK gmail-smtp-in.l.google.com
- DNS ASK gm##l.com
- DNS ASK mx#.#eznam.cz
- DNS ASK se##am.cz
- DNS ASK ALT1.ASPMX.L.GOOGLE.COM
- DNS ASK ma###il.com.sa
- DNS ASK 19#.###.#11.95.cbl.abuseat.org
- DNS ASK 19#.###.##1.95.sbl-xbl.spamhaus.org
- DNS ASK 19#.###.#11.95.zen.spamhaus.org
- DNS ASK 19#.###.#11.95.bl.spamcop.net
- DNS ASK 19#.###.#11.95.dnsbl.sorbs.net
- DNS ASK 19#.###.211.95.in-addr.arpa
- DNS ASK fc###lus.net
- DNS ASK ch##ter.net
- DNS ASK ho##ail.com
- DNS ASK bc##ri.org
- DNS ASK mx######6dd01.pphosted.com
- DNS ASK cs###onnect.com
- DNS ASK la##co.com
- DNS ASK mx#######403.gslb.pphosted.com
- DNS ASK og##vy.com
- DNS ASK mx######91d01.pphosted.com
- DNS ASK be###outh.com
- DNS ASK mx####.##il.gm0.yahoodns.net
- DNS ASK co###serve.com
- DNS ASK mx#######c02.gslb.pphosted.com
- DNS ASK ro##ch.com
- DNS ASK mx#######002.gslb.pphosted.com
- DNS ASK ni##.com
- DNS ASK ma##.##edit-suisse.com
- DNS ASK 16#####.mxmail.netease.com
- DNS ASK mx#.#harter.net
- DNS ASK 16#.com
- DNS ASK mx#######c01.gslb.pphosted.com
- DNS ASK wa###nwyatt.com
- DNS ASK vi####s.deranet.ph
- DNS ASK ac####ducciones.com
- DNS ASK mx#######e01.gslb.pphosted.com
- DNS ASK an##em.com
- DNS ASK mx#.##upm.edu.sa
- DNS ASK kf###.edu.sa
- DNS ASK mx#######a04.gslb.pphosted.com
- DNS ASK un###udios.com
- DNS ASK mx#######401.gslb.pphosted.com
- DNS ASK mx.#len.pl
- DNS ASK ba##on.edu
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\bcqnyeox\cpdgiigt.exe' /d"<Full path to file>"
- '<SYSTEM32>\cmd.exe' /C mkdir <SYSTEM32>\bcqnyeox\' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C move /Y "%TEMP%\cpdgiigt.exe" <SYSTEM32>\bcqnyeox\' (with hidden window)
- '<SYSTEM32>\sc.exe' create bcqnyeox binPath= "<SYSTEM32>\bcqnyeox\cpdgiigt.exe /d\"<Full path to file>\"" type= own start= auto DisplayName= "wifi support"' (with hidden window)
- '<SYSTEM32>\sc.exe' description bcqnyeox "wifi internet conection"' (with hidden window)
- '<SYSTEM32>\sc.exe' start bcqnyeox' (with hidden window)
Executes the following
- '<SYSTEM32>\cmd.exe' /C mkdir <SYSTEM32>\bcqnyeox\
- '<SYSTEM32>\cmd.exe' /C move /Y "%TEMP%\cpdgiigt.exe" <SYSTEM32>\bcqnyeox\
- '<SYSTEM32>\sc.exe' create bcqnyeox binPath= "<SYSTEM32>\bcqnyeox\cpdgiigt.exe /d\"<Full path to file>\"" type= own start= auto DisplayName= "wifi support"
- '<SYSTEM32>\sc.exe' description bcqnyeox "wifi internet conection"
- '<SYSTEM32>\sc.exe' start bcqnyeox
- '<SYSTEM32>\svchost.exe'
