Technical Information
To ensure autorun and distribution
Creates the following services
- [<HKLM>\System\CurrentControlSet\Services\oztolfai] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\oztolfai] 'ImagePath' = '<SYSTEM32>\oztolfai\divvyxns.exe /d"<Full path to file>"'
- [<HKLM>\SYSTEM\CurrentControlSet\services\oztolfai] 'ImagePath' = '<SYSTEM32>\oztolfai\divvyxns.exe'
Malicious functions
Injects code into
the following system processes:
- <SYSTEM32>\svchost.exe
Modifies file system
Creates the following files
- %TEMP%\divvyxns.exe
- C:\documents and settings\localservice:.repos
Moves the following files
- from %TEMP%\divvyxns.exe to <SYSTEM32>\oztolfai\divvyxns.exe
Deletes itself.
Network activity
Connects to
- 'fr###oge.co.in':443
- 'vi########er.arn03.hls.ttvnw.net':443
- '10#.#8.79.236':443
- '14#.#6.108.92':482
TCP
HTTP GET requests
- http://www.google.com/
UDP
- DNS ASK mi##########m.mail.protection.outlook.com
- DNS ASK google.com
- DNS ASK ya##o.es
- DNS ASK sm####n.virgilio.it
- DNS ASK vi##ilio.it
- DNS ASK mx#.#anmail.net
- DNS ASK ha##ail.net
- DNS ASK mx###.##il.am0.yahoodns.net
- DNS ASK ya##o.de
- DNS ASK ti##ali.it
- DNS ASK mt##.##0.yahoodns.net
- DNS ASK ya##o.com
- DNS ASK mx#.####y.mail2world.com
- DNS ASK sp##y.se
- DNS ASK sm####n.libero.it
- DNS ASK fr###oge.co.in
- DNS ASK li##ro.it
- DNS ASK cb##.co.nz
- DNS ASK un###mail.co.nz
- DNS ASK mx#.#aver.com
- DNS ASK 19#.###.#11.95.cbl.abuseat.org
- DNS ASK na##r.com
- DNS ASK 19#.###.##1.95.sbl-xbl.spamhaus.org
- DNS ASK 19#.###.#11.95.zen.spamhaus.org
- DNS ASK to##a.co.nz
- DNS ASK et###.#ail.tiscali.it
- DNS ASK 19#.###.#11.95.bl.spamcop.net
- DNS ASK ti###linet.it
- DNS ASK 19#.###.#11.95.dnsbl.sorbs.net
- DNS ASK 19#.###.211.95.in-addr.arpa
- DNS ASK mx#######b01.gslb.pphosted.com
- DNS ASK vi########er.arn03.hls.ttvnw.net
- '<DNS_SERVER>':53
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\oztolfai\divvyxns.exe' /d"<Full path to file>"
- '<SYSTEM32>\cmd.exe' /C mkdir <SYSTEM32>\oztolfai\' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C move /Y "%TEMP%\divvyxns.exe" <SYSTEM32>\oztolfai\' (with hidden window)
- '<SYSTEM32>\sc.exe' create oztolfai binPath= "<SYSTEM32>\oztolfai\divvyxns.exe /d\"<Full path to file>\"" type= own start= auto DisplayName= "wifi support"' (with hidden window)
- '<SYSTEM32>\sc.exe' description oztolfai "wifi internet conection"' (with hidden window)
- '<SYSTEM32>\sc.exe' start oztolfai' (with hidden window)
Executes the following
- '<SYSTEM32>\cmd.exe' /C mkdir <SYSTEM32>\oztolfai\
- '<SYSTEM32>\cmd.exe' /C move /Y "%TEMP%\divvyxns.exe" <SYSTEM32>\oztolfai\
- '<SYSTEM32>\sc.exe' create oztolfai binPath= "<SYSTEM32>\oztolfai\divvyxns.exe /d\"<Full path to file>\"" type= own start= auto DisplayName= "wifi support"
- '<SYSTEM32>\sc.exe' description oztolfai "wifi internet conection"
- '<SYSTEM32>\sc.exe' start oztolfai
- '<SYSTEM32>\svchost.exe'
