Technical Information
To ensure autorun and distribution
Creates the following services
- [<HKLM>\System\CurrentControlSet\Services\ckjebbyq] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\ckjebbyq] 'ImagePath' = '<SYSTEM32>\ckjebbyq\kjvrwgqd.exe /d"<Full path to file>"'
- [<HKLM>\SYSTEM\CurrentControlSet\services\ckjebbyq] 'ImagePath' = '<SYSTEM32>\ckjebbyq\kjvrwgqd.exe'
Malicious functions
Injects code into
the following system processes:
- <SYSTEM32>\svchost.exe
Modifies file system
Creates the following files
- %TEMP%\kjvrwgqd.exe
- C:\documents and settings\localservice:.repos
Moves the following files
- from %TEMP%\kjvrwgqd.exe to <SYSTEM32>\ckjebbyq\kjvrwgqd.exe
Deletes itself.
Network activity
Connects to
- 'mx#.#harter.net':25
- 'a3#####03.direcpc.com':25
- 'eu#.###.#rotection.outlook.com':25
- 'cl######j.mailcontrol.com':25
- 'mx###.##il.am0.yahoodns.net':25
- 'mt##.##0.yahoodns.net':25
- 'sm#####sp.securence.com':25
- 'ho#########.olc.protection.outlook.com':25
- 'ca#########.mail.protection.outlook.com':25
- 'cl######.us.messagelabs.com':25
- 'mx##.#mig.gmx.net':25
- 'al######x-vip1.prodigy.net':25
- 'ma#####.chollian.net':25
- 'aspmx.l.google.com':25
TCP
HTTP GET requests
- http://www.google.com/
UDP
- DNS ASK mi##########m.mail.protection.outlook.com
- DNS ASK wi###wcsn.com
- DNS ASK hr##s.com
- DNS ASK hh##.com
- DNS ASK hy####ive-group.com
- DNS ASK aspmx.l.google.com
- DNS ASK me##rini.it
- DNS ASK tr####foruminc.com
- DNS ASK ma##.#et-bizz.com
- DNS ASK pr###rre.com
- DNS ASK mt##.##0.yahoodns.net
- DNS ASK ge###ties.com
- DNS ASK mx#.###phintelecom.com
- DNS ASK do###cess.com
- DNS ASK ch######.mail.eo.outlook.com
- DNS ASK ch##.com
- DNS ASK fr.#bm.com
- DNS ASK gm#.de
- DNS ASK mx##.#mig.gmx.net
- DNS ASK wk###ster.com
- DNS ASK fi####outhnc.com
- DNS ASK ca#########.mail.protection.outlook.com
- DNS ASK ca##son.com
- DNS ASK sm#####sp.securence.com
- DNS ASK us###ernet.com
- DNS ASK li###law.com
- DNS ASK mx###.##il.am0.yahoodns.net
- DNS ASK cl######j.mailcontrol.com
- DNS ASK ya##o.it
- DNS ASK hl##.com
- DNS ASK eu#.###.#rotection.outlook.com
- DNS ASK li#e.fr
- DNS ASK a3#####03.direcpc.com
- DNS ASK di###way.com
- DNS ASK eu#######nbound-1.mimecast.com
- DNS ASK google.com
- DNS ASK ma#####.chollian.net
- DNS ASK re####worksusa.com
- DNS ASK re###.#a.foxconn.com
- DNS ASK fo##onn.com
- DNS ASK mx######b2d01.pphosted.com
- DNS ASK ib#.com
- DNS ASK al######x-vip1.prodigy.net
- DNS ASK be###outh.net
- DNS ASK de###.ubid.com
- DNS ASK ho#########.olc.protection.outlook.com
- DNS ASK ho##ail.com
- DNS ASK mx####.##il.gm0.yahoodns.net
- DNS ASK ao#.com
- DNS ASK cu#######-2.in.mailcontrol.com
- DNS ASK 19#.###.#11.95.bl.spamcop.net
- DNS ASK nu##eco.com
- DNS ASK cb####ourdais.com
- DNS ASK 19#.###.#11.95.dnsbl.sorbs.net
- DNS ASK 19#.###.211.95.in-addr.arpa
- DNS ASK gm##l.com
- DNS ASK alt1.gmail-smtp-in.l.google.com
- DNS ASK 19#.###.#11.95.zen.spamhaus.org
- DNS ASK ch##ter.net
- DNS ASK sa####group.com.bd
- DNS ASK cl######.us.messagelabs.com
- DNS ASK te###mutual.com
- DNS ASK va####abound.com
- DNS ASK ag###uality.com
- DNS ASK mx.#p.pl
- DNS ASK wp.pl
- DNS ASK ce####lautonj.com
- DNS ASK eb######.optninmailrus.com
- DNS ASK mx#######602.gslb.pphosted.com
- DNS ASK gr###-ellis.com
- DNS ASK sm##.##cureserver.net
- DNS ASK 19#.###.#11.95.cbl.abuseat.org
- DNS ASK gr#####ngrumblings.com
- DNS ASK mx#.#harter.net
- DNS ASK 19#.###.##1.95.sbl-xbl.spamhaus.org
- DNS ASK mx#.##ilplus.cloud
- DNS ASK su###est.com
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\ckjebbyq\kjvrwgqd.exe' /d"<Full path to file>"
- '<SYSTEM32>\cmd.exe' /C mkdir <SYSTEM32>\ckjebbyq\' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C move /Y "%TEMP%\kjvrwgqd.exe" <SYSTEM32>\ckjebbyq\' (with hidden window)
- '<SYSTEM32>\sc.exe' create ckjebbyq binPath= "<SYSTEM32>\ckjebbyq\kjvrwgqd.exe /d\"<Full path to file>\"" type= own start= auto DisplayName= "wifi support"' (with hidden window)
- '<SYSTEM32>\sc.exe' description ckjebbyq "wifi internet conection"' (with hidden window)
- '<SYSTEM32>\sc.exe' start ckjebbyq' (with hidden window)
Executes the following
- '<SYSTEM32>\cmd.exe' /C mkdir <SYSTEM32>\ckjebbyq\
- '<SYSTEM32>\cmd.exe' /C move /Y "%TEMP%\kjvrwgqd.exe" <SYSTEM32>\ckjebbyq\
- '<SYSTEM32>\sc.exe' create ckjebbyq binPath= "<SYSTEM32>\ckjebbyq\kjvrwgqd.exe /d\"<Full path to file>\"" type= own start= auto DisplayName= "wifi support"
- '<SYSTEM32>\sc.exe' description ckjebbyq "wifi internet conection"
- '<SYSTEM32>\sc.exe' start ckjebbyq
- '<SYSTEM32>\svchost.exe'
