Technical Information
To ensure autorun and distribution
Sets the following service settings
- [<HKLM>\System\CurrentControlSet\Services\lmwampgb] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\lmwampgb] 'ImagePath' = '%WINDIR%\SysWOW64\lmwampgb\hjnjtkqd.exe /d"<Full path to file>"'
- [<HKLM>\SYSTEM\CurrentControlSet\services\lmwampgb] 'ImagePath' = '%WINDIR%\SysWOW64\lmwampgb\hjnjtkqd.exe'
Creates the following services
- 'lmwampgb' %WINDIR%\SysWOW64\lmwampgb\hjnjtkqd.exe /d"<Full path to file>"
- 'lmwampgb' %WINDIR%\SysWOW64\lmwampgb\hjnjtkqd.exe
Malicious functions
To complicate detection of its presence in the operating system,
adds antivirus exclusion with following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths] '%WINDIR%\SysWOW64\lmwampgb' = '00000000'
Executes the following
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="%WINDIR%\SysWOW64\svchost.exe" enable=yes>nul
Injects code into
the following system processes:
- %WINDIR%\syswow64\svchost.exe
Modifies file system
Creates the following files
- %TEMP%\hjnjtkqd.exe
- %WINDIR%\syswow64\config\systemprofile:.repos
Moves the following files
- from %TEMP%\hjnjtkqd.exe to %WINDIR%\syswow64\lmwampgb\hjnjtkqd.exe
Deletes itself.
Network activity
Connects to
- 'mi##########m.mail.protection.outlook.com':25
- 'sm##.#opmail.com':25
- 'mx.##csrl.net':25
- 'in.###babusiness.it':25
- 'mx#.####o.locaweb.com.br':25
- 'ma######er.copservir.com':25
- 'mx#######a01.gslb.pphosted.com':25
- 'mx##.#lackberry.com':25
- 'ra######ake5.caregroup.org':25
- 'mx#######701.gslb.pphosted.com':25
- 'mx#.##ailsrvr.com':25
- '18#.#7.255.58':443
- 'mx#######e01.gslb.pphosted.com':25
- 'fa###ool.xyz':10060
- 'co######m-net.mx.av-mx.com':25
- 'mx.####owlarkfarm.com':25
- 'mx.###card.email':25
- 'mx#.#xstorm.com':25
- 'mx###.comcast.net':25
- 'gm###.##m.1.0001.arsmtp.com':25
- 'EM####20.saic.com':25
- 'mx#.#ate.com':25
- 'ma##.#axmail.net':25
- 'mx####.##il.gm0.yahoodns.net':25
- 'no########.net.mx1.nstel.rcimx.net':25
- 'mx#######d01.gslb.pphosted.com':25
- 'mx.##tplus.ch':25
- 'cx#.##.#.cloudfilter.net':25
- 'mx##.mb5p.com':25
- 'li##ed.com':25
- 'ci##ch.net':25
- 'ma##.brembo.it':25
- 'mx##.##a.mailcore.net':25
- 'mx.######mail.rediff.akadns.net':25
- 'mx.##nkiinc.net':25
- 'mx#######601.gslb.pphosted.com':25
- 'xm####a.excite.com':25
- '17#.#13.115.155':428
- 'mx#######801.gslb.pphosted.com':25
- 'sm##.##cureserver.net':25
- 'my####.brinkster.com':25
- 'mx#######401.gslb.pphosted.com':25
- 'ASPMX.L.GOOGLE.COM':25
- 'alt1.aspmx.l.google.com':25
- 'mx##.mail.com':25
- 'mx.########e.prod.cloud.synchronoss.net':25
- 'mx.#####zeitalianemed.com':25
- 'ma##.gtmail.com':25
- 'mx.##s.untd.com':25
- 'in###gram.com':443
- 'al######x-vip1.prodigy.net':25
- 'so####2.sohu.com':25
- 'mx.#####.#om.cust.b.hostedemail.com':25
- 'co####x01.arbee.net':25
- 'mx##.#-online.de':25
- 'mx.##a.untd.com':25
- 'pa####x.above.com':25
- 'mx##.###g.kundenserver.de':25
- 'mx##.##il.icloud.com':25
- 'mx.##teria.pl':25
- 'mx#.#anmail.net':25
- 'mx##.##ilinblack.com':25
- 'ma####ee.aruba.it':25
- 'fm######01.emirates.net.ae':25
- 'mx.###eric-isp.com':25
- 'mx######91d01.pphosted.com':25
- 'mx.##ilo.com':25
- 'ba####.beta-inter.net':25
- 'mt##.##0.yahoodns.net':25
- '17#.#13.115.158':484
- 'sv####lfheim.top':443
- 'mx#######501.gslb.pphosted.com':25
- 'alt2.aspmx.l.google.com':25
- 'cu####.cscdns.net':25
- 'ma##.#rermail.com':25
- 'ff######x-vip1.prodigy.net':25
- 'mx###.m2bp.com':25
- 'al######x-vip2.prodigy.net':25
- 'sm#####.hosting.orange.pl':25
- 'mx.#len.pl':25
- 'av###.une.net.co':25
- 'ma##.#-email.net':25
- 'mx#######f02.gslb.pphosted.com':25
- 'google.com':80
- '17#.#13.115.157':428
- '17#.#13.115.156':428
- 'mx#######f01.gslb.pphosted.com':25
- 'mx#######005.gslb.pphosted.com':25
- '17#.#13.115.154':428
- '17#.#13.115.153':428
- 'ma######.hauts-de-seine.fr':25
- 'mx.##archi.it':25
- 'ma####.#uchananinbox.com':25
- 'mx#.#aver.com':25
- 'mx#######201.gslb.pphosted.com':25
- 'ma##.#ailerhost.net':25
- 'uu##rv.org':25
- 'AS####.GOOGLEMAIL.COM':25
- '80.#6.75.4':428
- 'mx##.###us-vadesecure.net':25
TCP
HTTP GET requests
- http://www.google.com/
Other
- 'sv####lfheim.top':443
- 'av###.une.net.co':25
- 'al######x-vip2.prodigy.net':25
- 'ff######x-vip1.prodigy.net':25
- 'al######x-vip1.prodigy.net':25
- 'in###gram.com':443
- 'mx####.##il.gm0.yahoodns.net':25
- 'gm###.##m.1.0001.arsmtp.com':25
- '17#.#13.115.156':428
- '17#.#13.115.155':428
- 'mx#.#xstorm.com':25
- 'fa###ool.xyz':10060
- '18#.#7.255.58':443
- 'ra######ake5.caregroup.org':25
- 'sm##.#opmail.com':25
- 'no########.net.mx1.nstel.rcimx.net':25
- 'ASPMX.L.GOOGLE.COM':25
- 'my####.brinkster.com':25
- 'mx.###card.email':25
- 'co######m-net.mx.av-mx.com':25
- '17#.#13.115.154':428
- '17#.#13.115.153':428
- '17#.#13.115.157':428
- 'mt##.##0.yahoodns.net':25
- 'ba####.beta-inter.net':25
- 'mx##.##ilinblack.com':25
- 'mx.###eric-isp.com':25
- 'mx.##teria.pl':25
- 'mx#.#anmail.net':25
- 'pa####x.above.com':25
- 'alt2.aspmx.l.google.com':25
- '17#.#13.115.158':484
- 'cu####.cscdns.net':25
- 'mx###.m2bp.com':25
- 'AS####.GOOGLEMAIL.COM':25
- 'co####x01.arbee.net':25
- 'ma##.#ailerhost.net':25
- 'mx#######201.gslb.pphosted.com':25
- 'mx#.#aver.com':25
- 'ma####.#uchananinbox.com':25
- '80.#6.75.4':428
- 'ma##.#rermail.com':25
- 'mx.######mail.rediff.akadns.net':25
- 'mx##.##a.mailcore.net':25
UDP
- DNS ASK mi##########m.mail.protection.outlook.com
- DNS ASK in.###babusiness.it
- DNS ASK cs##rl.net
- DNS ASK mx.##csrl.net
- DNS ASK yo##ail.com
- DNS ASK sm##.#opmail.com
- DNS ASK no###state.net
- DNS ASK no########.net.mx1.nstel.rcimx.net
- DNS ASK pe##air.com
- DNS ASK mx#######d01.gslb.pphosted.com
- DNS ASK ma######er.copservir.com
- DNS ASK gt##il.com
- DNS ASK va#####italianemed.com
- DNS ASK mx.#####zeitalianemed.com
- DNS ASK op###line.net
- DNS ASK mx.########e.prod.cloud.synchronoss.net
- DNS ASK ma##.com
- DNS ASK mx##.mail.com
- DNS ASK we###oint.com
- DNS ASK ig####learning.com
- DNS ASK alt1.aspmx.l.google.com
- DNS ASK mx#.####o.locaweb.com.br
- DNS ASK ba####ellecase.com
- DNS ASK gl##o.com
- DNS ASK co###rvir.com
- DNS ASK ka##omm.in
- DNS ASK me####larkfarm.com
- DNS ASK mx.####owlarkfarm.com
- DNS ASK co###rium.net
- DNS ASK co######m-net.mx.av-mx.com
- DNS ASK ca###ronics.com
- DNS ASK fa###ool.xyz
- DNS ASK mx#######e01.gslb.pphosted.com
- DNS ASK fi##et.com
- DNS ASK ih#.com
- DNS ASK di###rdmail.com
- DNS ASK ma##.gtmail.com
- DNS ASK mx#.##ailsrvr.com
- DNS ASK ra######ake5.caregroup.org
- DNS ASK sc##pps.com
- DNS ASK ri#.net
- DNS ASK mx##.#lackberry.com
- DNS ASK ex####iveboard.com
- DNS ASK mx#######a01.gslb.pphosted.com
- DNS ASK ve##zon.net
- DNS ASK di###phone.com
- DNS ASK li###intl.com
- DNS ASK mx#######701.gslb.pphosted.com
- DNS ASK ca#####up.harvard.edu
- DNS ASK bu####aninbox.com
- DNS ASK ASPMX.L.GOOGLE.COM
- DNS ASK to####utomotive.com
- DNS ASK pr####iumonline.com
- DNS ASK st#####ghospitals.com
- DNS ASK ho##ial.com
- DNS ASK wa##.com
- DNS ASK lu##ku.com
- DNS ASK mx##.##a.mailcore.net
- DNS ASK dm##itd.org
- DNS ASK bi###ch.ac.in
- DNS ASK ci##ch.net
- DNS ASK sj##om.in
- DNS ASK mx#.#xstorm.com
- DNS ASK ho###olar.com
- DNS ASK am##rve.net
- DNS ASK mx##.mb5p.com
- DNS ASK co#.net
- DNS ASK cx#.##.#.cloudfilter.net
- DNS ASK fl##h.net
- DNS ASK ne##lus.ch
- DNS ASK mx.##tplus.ch
- DNS ASK al###ate.com
- DNS ASK mx#######005.gslb.pphosted.com
- DNS ASK ma##.brembo.it
- DNS ASK br##bo.it
- DNS ASK mx.###card.email
- DNS ASK tg##il.com
- DNS ASK ae###usa.com
- DNS ASK qa#.com
- DNS ASK mx#######401.gslb.pphosted.com
- DNS ASK av####echnology.net
- DNS ASK my####.brinkster.com
- DNS ASK fp###ton.com
- DNS ASK sm##.##cureserver.net
- DNS ASK wy##ham.com
- DNS ASK em###tus.com
- DNS ASK mx#######801.gslb.pphosted.com
- DNS ASK vi#.ac.in
- DNS ASK ag###ytes.com
- DNS ASK my###ati.com
- DNS ASK mx#######f01.gslb.pphosted.com
- DNS ASK bl###berry.net
- DNS ASK bo###ores.com
- DNS ASK mx#######601.gslb.pphosted.com
- DNS ASK ge###inc.net
- DNS ASK mx.##nkiinc.net
- DNS ASK co###serve.com
- DNS ASK re###fmail.com
- DNS ASK mx.######mail.rediff.akadns.net
- DNS ASK xm####a.excite.com
- DNS ASK ma###xcite.com
- DNS ASK pa####irmails.com
- DNS ASK mx###.comcast.net
- DNS ASK co##ast.net
- DNS ASK ma#.com
- DNS ASK mx##.##il.icloud.com
- DNS ASK on##ne.de
- DNS ASK mx##.###g.kundenserver.de
- DNS ASK ad##sa.com
- DNS ASK pa####x.above.com
- DNS ASK ju##.com
- DNS ASK mx.##a.untd.com
- DNS ASK mx#.#anmail.net
- DNS ASK mx.##ilo.com
- DNS ASK mx.##teria.pl
- DNS ASK t-##line.de
- DNS ASK ly##s.com
- DNS ASK mx.#####.#om.cust.b.hostedemail.com
- DNS ASK so##.com
- DNS ASK so####2.sohu.com
- DNS ASK pr####inblog.com
- DNS ASK cu####.cscdns.net
- DNS ASK am###trade.com
- DNS ASK mx#######501.gslb.pphosted.com
- DNS ASK mx##.#-online.de
- DNS ASK ar##e.net
- DNS ASK co####x01.arbee.net
- DNS ASK ea###link.net
- DNS ASK my##te.com
- DNS ASK mx##.##ilinblack.com
- DNS ASK 23#.###.#12.82.dnsbl.sorbs.net
- DNS ASK 23#.###.#12.82.bl.spamcop.net
- DNS ASK fr###ier.com
- DNS ASK mt##.##0.yahoodns.net
- DNS ASK 23#.###.#12.82.zen.spamhaus.org
- DNS ASK ri##ail.se
- DNS ASK 23#.###.##2.82.sbl-xbl.spamhaus.org
- DNS ASK ba####.beta-inter.net
- DNS ASK ne###urrier.com
- DNS ASK at#.com
- DNS ASK ha##ail.net
- DNS ASK 23#.###.#12.82.cbl.abuseat.org
- DNS ASK mx######91d01.pphosted.com
- DNS ASK ro####eltmail.com
- DNS ASK mx.###eric-isp.com
- DNS ASK em###tes.net.ae
- DNS ASK fm######01.emirates.net.ae
- DNS ASK ar##a.it
- DNS ASK ma####ee.aruba.it
- DNS ASK 23#.###.112.82.in-addr.arpa
- DNS ASK te####caviation.com
- DNS ASK sv####lfheim.top
- DNS ASK be###outh.com
- DNS ASK li##ed.com
- DNS ASK alt2.aspmx.l.google.com
- DNS ASK ch###enza.com
- DNS ASK sm#####.hosting.orange.pl
- DNS ASK be###outh.net
- DNS ASK al######x-vip2.prodigy.net
- DNS ASK at#.net
- DNS ASK ff######x-vip1.prodigy.net
- DNS ASK me.com
- DNS ASK sb###obal.net
- DNS ASK al######x-vip1.prodigy.net
- DNS ASK in###gram.com
- DNS ASK er###ail.com
- DNS ASK or##ge.pl
- DNS ASK mx.#len.pl
- DNS ASK mx.##s.untd.com
- DNS ASK cs.com
- DNS ASK mx####.##il.gm0.yahoodns.net
- DNS ASK na##.com
- DNS ASK mx#.#ate.com
- DNS ASK sa##.com
- DNS ASK EM####20.saic.com
- DNS ASK gm##l.com
- DNS ASK gm###.##m.1.0001.arsmtp.com
- DNS ASK ho##il.com
- DNS ASK ne##ero.net
- DNS ASK ma##.#rermail.com
- DNS ASK ma##.#axmail.net
- DNS ASK in##ria.pl
- DNS ASK mx###.m2bp.com
- DNS ASK cc##.org
- DNS ASK AS####.GOOGLEMAIL.COM
- DNS ASK uu##rv.org
- DNS ASK ht##il.com
- DNS ASK ma##.#ailerhost.net
- DNS ASK ka###lani.org
- DNS ASK mx#######201.gslb.pphosted.com
- DNS ASK na##r.com
- DNS ASK un#.net.co
- DNS ASK o2.pl
- DNS ASK av###.une.net.co
- DNS ASK om##chi.it
- DNS ASK mx.##archi.it
- DNS ASK en#.###ts-de-seine.fr
- DNS ASK ma######.hauts-de-seine.fr
- DNS ASK google.com
- DNS ASK fl####etworks.com
- DNS ASK mx#######f02.gslb.pphosted.com
- DNS ASK ic##und.com
- DNS ASK ma##.#-email.net
- DNS ASK mx#.#aver.com
- DNS ASK ma####.#uchananinbox.com
- DNS ASK mx##.###us-vadesecure.net
Miscellaneous
Creates and executes the following
- '%WINDIR%\syswow64\lmwampgb\hjnjtkqd.exe' /d"<Full path to file>"
- '%WINDIR%\syswow64\cmd.exe' /C mkdir %WINDIR%\SysWOW64\lmwampgb\' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C move /Y "%TEMP%\hjnjtkqd.exe" %WINDIR%\SysWOW64\lmwampgb\' (with hidden window)
- '%WINDIR%\syswow64\sc.exe' create lmwampgb binPath= "%WINDIR%\SysWOW64\lmwampgb\hjnjtkqd.exe /d\"<Full path to file>\"" type= own start= auto DisplayName= "wifi support"' (with hidden window)
- '%WINDIR%\syswow64\sc.exe' description lmwampgb "wifi internet conection"' (with hidden window)
- '%WINDIR%\syswow64\sc.exe' start lmwampgb' (with hidden window)
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="%WINDIR%\SysWOW64\svchost.exe" enable=yes>nul' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /C mkdir %WINDIR%\SysWOW64\lmwampgb\
- '%WINDIR%\syswow64\cmd.exe' /C move /Y "%TEMP%\hjnjtkqd.exe" %WINDIR%\SysWOW64\lmwampgb\
- '%WINDIR%\syswow64\sc.exe' create lmwampgb binPath= "%WINDIR%\SysWOW64\lmwampgb\hjnjtkqd.exe /d\"<Full path to file>\"" type= own start= auto DisplayName= "wifi support"
- '%WINDIR%\syswow64\sc.exe' description lmwampgb "wifi internet conection"
- '%WINDIR%\syswow64\sc.exe' start lmwampgb
- '%WINDIR%\syswow64\svchost.exe'
- '%WINDIR%\syswow64\svchost.exe' -o fastpool.xyz:10060 -u 9mLwUkiK8Yp89zQQYodWKN29jVVVz1cWDFZctWxge16Zi3TpHnSBnnVcCDhSRXdesnMBdVjtDwh1N71KD9z37EzgKSM1tmS.60000 -p x -k -a cn/half
