DDoS.Win32.NITOL.MKH

This DDoS malware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Arrival Details

This DDoS malware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This DDoS malware adds the following folders:

• %User Temp%\IR{Random Characters}.tmp\

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

It drops the following files:

• %User Temp%\hrl{Random Characters}.tmp
• %System%\hyfzag.exe
• %User Temp%\SOFTWARE.LOG
• {Infected Directory}\lpk.dll → copy of itself

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).. %System% is the Windows system folder, where it usually is C:\Windows\System32 on all Windows operating system versions.)

It adds the following processes:

• %User Temp%\hrl{Random Characters}.tmp
• %System%\hyfzag.exe
• %System%\sc.exe start w32time task_started
• %System%\svchost.exe -k netsvcs
• find /i "lpk.dll"
• "%ProgramFiles%\WinRAR\rar.exe" x "{Fullpath of zip/rar file}" *.exe "%User Temp%\IR{Random Characters}.tmp\"
• cmd /c RD /s /q "%User Temp%\IR{Random Characters}.tmp"
• cmd /c %ProgramFiles%\WinRAR\rar.exe vb "{Fullpath of zip/rar file}" lpk.dll|find /i "lpk.dll"
• "%Program Files%\WinRAR\rar.exe" a -r -ep1"%User Temp%\IRA740.tmp" "{Fullpath of zip/rar file}" "%User Temp%\IRA740.tmp\lpk.dll"

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).. %System% is the Windows system folder, where it usually is C:\Windows\System32 on all Windows operating system versions.. %Program Files% is the default Program Files folder, usually C:\Program Files in Windows 2000(32-bit), Server 2003(32-bit), XP, Vista(64-bit), 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit) , or C:\Program Files (x86) in Windows XP(64-bit), Vista(64-bit), 7(64-bit), 8(64-bit), 8.1(64-bit), 2008(64-bit), 2012(64-bit) and 10(64-bit).)

Other System Modifications

This DDoS malware deletes the following files:

• %User Temp%\hrl{Random Characters}.tmp
• %User Temp%\SOFTWARE.LOG

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)

Adware Routine

This DDoS malware adds and runs the following services:

• Service Name: Distribulfs
  Display Name: Distribulhq Transaction Coordinator Service
  Start Type: SERVICE_AUTO_START
  Binary Pathname: %System%\hyfzag.exe

(Note: %System% is the Windows system folder, where it usually is C:\Windows\System32 on all Windows operating system versions.)

Other Details

This DDoS malware does the following:

• Drops copy of itself to all directories in all drives except system drives.
• Finds zip or rar files then finds .exe files inside the compressed file, if found, does the following:
  
  • copy the .exe file to %User Temp%\IR{Random Characters}.tmp\ directory.
  • insert copy of itself(lpk.dll) in the compressed file.

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000(32-bit), XP, and Server 2003(32-bit), or C:\Users\{user name}\AppData\Local\Temp on Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) and 10(64-bit).)