Technical Information
To ensure autorun and distribution
Creates the following services
- [<HKLM>\System\CurrentControlSet\Services\sfaogecn] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\sfaogecn] 'ImagePath' = '<SYSTEM32>\sfaogecn\zpvopxnw.exe /d"<Full path to file>"'
- [<HKLM>\SYSTEM\CurrentControlSet\services\sfaogecn] 'ImagePath' = '<SYSTEM32>\sfaogecn\zpvopxnw.exe'
Malicious functions
Injects code into
the following system processes:
- <SYSTEM32>\svchost.exe
Modifies file system
Creates the following files
- %TEMP%\zpvopxnw.exe
- C:\documents and settings\localservice:.repos
Moves the following files
- from %TEMP%\zpvopxnw.exe to <SYSTEM32>\sfaogecn\zpvopxnw.exe
Deletes itself.
Network activity
Connects to
- 'mx.##a.untd.com':25
- 'ad#####mx402.alcoa.com':25
- 'mx.##ra.co.nz':25
- 'ma##.acsvic.com':25
- 'ma###.ssica.com':25
- 'fm##.####diocmi2013.glauco.it':25
- 'es######101.exeloncorp.com':25
- 'ma##.ssibr.ro':25
- 'mx##.#mig.gmx.net':25
- 'mx#######801.gslb.pphosted.com':25
- 'mx.##finito.it':25
- 'ma##.#randsmile.net':25
- 'mx##.schlund.de':25
- 'ne####.eecs.umich.edu':25
- 'ALT2.ASPMX.L.GOOGLE.COM':25
- '14#.#6.108.92':483
- 'et###.#ail.tiscali.it':25
- 're#######s241.francetelecom.com':25
- 'mx#.##.smxemail.com':25
- 'mx####.##il.gm0.yahoodns.net':25
- 'ma######er1.execulink.com':25
- 'gmail-smtp-in.l.google.com':25
- 'ho#########.olc.protection.outlook.com':25
- 'ma##.##uinsurance.com':25
- 'mx#.##antel.net.om':25
- 'mx######91d01.pphosted.com':25
- 'ma##.#tago.ac.nz':25
- 'ASPMX.L.GOOGLE.COM':25
- 'cl######n-03.mbs.boeing.net':25
- 'sm##.##b.shawcable.net':25
- 'mt##.##0.yahoodns.net':25
- 'mx#.##curemx.biz':25
- 'alt1.aspmx.l.google.com':25
- 'mx#.##lton.co.nz':25
- 'mx#######d01.gslb.pphosted.com':25
- 'mx#######601.gslb.pphosted.com':25
TCP
HTTP GET requests
- http://www.google.com/
UDP
- DNS ASK mi##########m.mail.protection.outlook.com
- DNS ASK ac##ic.com
- DNS ASK mx.##ra.co.nz
- DNS ASK xt##.co.nz
- DNS ASK re###ards.co.nz
- DNS ASK ad#####mx402.alcoa.com
- DNS ASK al##a.com
- DNS ASK es######101.exeloncorp.com
- DNS ASK co####llation.com
- DNS ASK et###.#ail.tiscali.it
- DNS ASK ti###linet.it
- DNS ASK re#######s241.francetelecom.com
- DNS ASK fr####telecom.com
- DNS ASK mx#.##.smxemail.com
- DNS ASK rb##.govt.nz
- DNS ASK alt1.aspmx.l.google.com
- DNS ASK ss#.bz
- DNS ASK mx#.##curemx.biz
- DNS ASK ma##.acsvic.com
- DNS ASK ma###.ssica.com
- DNS ASK cr####l.cirrus.com
- DNS ASK di####i.milano.it
- DNS ASK mx#######d01.gslb.pphosted.com
- DNS ASK co####vision.com
- DNS ASK ne####.eecs.umich.edu
- DNS ASK ee##.umich.edu
- DNS ASK mx##.schlund.de
- DNS ASK ar#####commercial.co.uk
- DNS ASK ma##.#randsmile.net
- DNS ASK br###smile.net
- DNS ASK mx.##finito.it
- DNS ASK in##nito.it
- DNS ASK mx#######801.gslb.pphosted.com
- DNS ASK at#.msu.edu
- DNS ASK ALT2.ASPMX.L.GOOGLE.COM
- DNS ASK ce###ville.edu
- DNS ASK mx##.#mig.gmx.net
- DNS ASK gm#.de
- DNS ASK fm##.####diocmi2013.glauco.it
- DNS ASK bu##h.co.nz
- DNS ASK ss##a.com
- DNS ASK ma##.ssibr.ro
- DNS ASK tr###l.co.nz
- DNS ASK ho##ail.com
- DNS ASK gmail-smtp-in.l.google.com
- DNS ASK gm##l.com
- DNS ASK mx####.##il.gm0.yahoodns.net
- DNS ASK ao#.com
- DNS ASK mx.##a.untd.com
- DNS ASK ju##.com
- DNS ASK ma##.##uinsurance.com
- DNS ASK ef####urance.com
- DNS ASK ef#.bms.dk
- DNS ASK kr###ingen.dk
- DNS ASK 19#.###.#11.95.cbl.abuseat.org
- DNS ASK 19#.###.##1.95.sbl-xbl.spamhaus.org
- DNS ASK 19#.###.#11.95.zen.spamhaus.org
- DNS ASK 19#.###.#11.95.bl.spamcop.net
- DNS ASK 19#.###.#11.95.dnsbl.sorbs.net
- DNS ASK 19#.###.211.95.in-addr.arpa
- DNS ASK ho#########.olc.protection.outlook.com
- DNS ASK google.com
- DNS ASK mt##.##0.yahoodns.net
- DNS ASK me###wise.co.nz
- DNS ASK ya##o.ca
- DNS ASK sm##.##b.shawcable.net
- DNS ASK sh#w.ca
- DNS ASK cl######n-03.mbs.boeing.net
- DNS ASK ps#.#oeing.com
- DNS ASK ASPMX.L.GOOGLE.COM
- DNS ASK pa####mache.co.uk
- DNS ASK mx#.##lton.co.nz
- DNS ASK to###sm.ac.nz
- DNS ASK ma##.#tago.ac.nz
- DNS ASK ma###.otago.ac.nz
- DNS ASK mx#.##antel.net.om
- DNS ASK om###el.net.om
- DNS ASK ma######er1.execulink.com
- DNS ASK ex###link.com
- DNS ASK mx######91d01.pphosted.com
- DNS ASK be###outh.com
- DNS ASK ss##r.ro
- DNS ASK mx#######601.gslb.pphosted.com
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\sfaogecn\zpvopxnw.exe' /d"<Full path to file>"
- '<SYSTEM32>\cmd.exe' /C mkdir <SYSTEM32>\sfaogecn\' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C move /Y "%TEMP%\zpvopxnw.exe" <SYSTEM32>\sfaogecn\' (with hidden window)
- '<SYSTEM32>\sc.exe' create sfaogecn binPath= "<SYSTEM32>\sfaogecn\zpvopxnw.exe /d\"<Full path to file>\"" type= own start= auto DisplayName= "wifi support"' (with hidden window)
- '<SYSTEM32>\sc.exe' description sfaogecn "wifi internet conection"' (with hidden window)
- '<SYSTEM32>\sc.exe' start sfaogecn' (with hidden window)
Executes the following
- '<SYSTEM32>\cmd.exe' /C mkdir <SYSTEM32>\sfaogecn\
- '<SYSTEM32>\cmd.exe' /C move /Y "%TEMP%\zpvopxnw.exe" <SYSTEM32>\sfaogecn\
- '<SYSTEM32>\sc.exe' create sfaogecn binPath= "<SYSTEM32>\sfaogecn\zpvopxnw.exe /d\"<Full path to file>\"" type= own start= auto DisplayName= "wifi support"
- '<SYSTEM32>\sc.exe' description sfaogecn "wifi internet conection"
- '<SYSTEM32>\sc.exe' start sfaogecn
- '<SYSTEM32>\svchost.exe'
