Technical Information
To ensure autorun and distribution
Creates the following services
- [<HKLM>\System\CurrentControlSet\Services\fisgylxx] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\fisgylxx] 'ImagePath' = '<SYSTEM32>\fisgylxx\jiwymjkc.exe /d"<Full path to file>"'
- [<HKLM>\SYSTEM\CurrentControlSet\services\fisgylxx] 'ImagePath' = '<SYSTEM32>\fisgylxx\jiwymjkc.exe'
Malicious functions
Injects code into
the following system processes:
- <SYSTEM32>\svchost.exe
Modifies file system
Creates the following files
- %TEMP%\jiwymjkc.exe
- C:\documents and settings\localservice:.repos
Moves the following files
- from %TEMP%\jiwymjkc.exe to <SYSTEM32>\fisgylxx\jiwymjkc.exe
Deletes itself.
Network activity
UDP
- DNS ASK mi##########m.mail.protection.outlook.com
- DNS ASK pr###dence.org
- DNS ASK mx#######201.gslb.pphosted.com
- DNS ASK ka#####al-madina.com
- DNS ASK alt2.aspmx.l.google.com
- DNS ASK me####center.org
- DNS ASK co###cship.com
- DNS ASK gd###ada.com
- DNS ASK ve###latech.com
- DNS ASK k9####rprises.com
- DNS ASK sk#.com
- DNS ASK mx###.##il.am0.yahoodns.net
- DNS ASK in.#bm.com
- DNS ASK gm#.de
- DNS ASK mx##.#mig.gmx.net
- DNS ASK ho##ail.es
- DNS ASK eu#.###.#rotection.outlook.com
- DNS ASK ao#.com
- DNS ASK mx####.##il.gm0.yahoodns.net
- DNS ASK di####vice.com.pl
- DNS ASK bi#e.pl
- DNS ASK mx#.####.#omie.mail.dreamhost.com
- DNS ASK mx######b2d01.pphosted.com
- DNS ASK br####nhurst.com
- DNS ASK mx#.##rthlink.net
- DNS ASK ea###link.net
- DNS ASK ASPMX.L.GOOGLE.COM
- DNS ASK 19#.###.#11.95.dnsbl.sorbs.net
- DNS ASK ma#l.ru
- DNS ASK 19#.###.#11.95.bl.spamcop.net
- DNS ASK mx#.mail.ru
- DNS ASK ho##ail.com
- DNS ASK 19#.###.#11.95.zen.spamhaus.org
- DNS ASK ho#########.olc.protection.outlook.com
- DNS ASK et#.net
- DNS ASK 19#.###.##1.95.sbl-xbl.spamhaus.org
- DNS ASK in.###.mailhostbox.com
- DNS ASK 19#.###.211.95.in-addr.arpa
- DNS ASK 19#.###.#11.95.cbl.abuseat.org
- DNS ASK gl##ind.com
- DNS ASK rs##d.org
- DNS ASK mx#.###675-7.iphmx.com
- DNS ASK fr###iernet.net
- DNS ASK mt##.##0.yahoodns.net
- DNS ASK eu#.##todesk.com
- DNS ASK mx######a5201.pphosted.com
- DNS ASK kp.org
- DNS ASK mx#######703.gslb.pphosted.com
- DNS ASK ta####community.org
- DNS ASK google.com
- DNS ASK fa##ag.com
- DNS ASK li#e.dk
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\fisgylxx\jiwymjkc.exe' /d"<Full path to file>"
- '<SYSTEM32>\cmd.exe' /C mkdir <SYSTEM32>\fisgylxx\' (with hidden window)
- '<SYSTEM32>\cmd.exe' /C move /Y "%TEMP%\jiwymjkc.exe" <SYSTEM32>\fisgylxx\' (with hidden window)
- '<SYSTEM32>\sc.exe' create fisgylxx binPath= "<SYSTEM32>\fisgylxx\jiwymjkc.exe /d\"<Full path to file>\"" type= own start= auto DisplayName= "wifi support"' (with hidden window)
- '<SYSTEM32>\sc.exe' description fisgylxx "wifi internet conection"' (with hidden window)
- '<SYSTEM32>\sc.exe' start fisgylxx' (with hidden window)
Executes the following
- '<SYSTEM32>\cmd.exe' /C mkdir <SYSTEM32>\fisgylxx\
- '<SYSTEM32>\cmd.exe' /C move /Y "%TEMP%\jiwymjkc.exe" <SYSTEM32>\fisgylxx\
- '<SYSTEM32>\sc.exe' create fisgylxx binPath= "<SYSTEM32>\fisgylxx\jiwymjkc.exe /d\"<Full path to file>\"" type= own start= auto DisplayName= "wifi support"
- '<SYSTEM32>\sc.exe' description fisgylxx "wifi internet conection"
- '<SYSTEM32>\sc.exe' start fisgylxx
- '<SYSTEM32>\svchost.exe'
