Story of the Cutwail/Pushdo hidden C&C server By Threat Intelligence Team 25 Jun 2013 Archived: 2026-04-05 19:23:37 UTC Story of the Cutwail/Pushdo hidden C&C server This is a loose sequel to the Cutwail botnet analysis blogpost published on the malwaremustdie.blogspot.com. In this blogpost I will primarily focus on the downloaded PE executable itself (SHA256: 5F8FCC9C56BF959041B28E97BFB5DB9659B20A6E6076CFBA8CB2D591184C9164) and the network traffic that it generates. I will also reveal a hidden C&C server. But first let's quickly go through the things it does at the beginning: - It registers an exception handler that will only start the process again using CreateProcess(). - It performs a check whether it has admin privileges. - It checks or creates a mutex named "xoxkycomvoly" (hardcoded identifier used on multiple occasions). - It checks or creates couple of registry entries under HKCU\Software\Microsoft\Windows\CurrentVersion. - It checks if the process image filename is "xoxkycomvoly.exe" (it restarts for the first time). - It nests into the system by creating autorun entry in registry under HKCU\Software\Microsoft\Windows\CurrentVersion\Run. - It copies itself to the user's profile directory named as "xoxkycomvoly.exe". Then on the first time an exception occurs and the sample is restarted from the user's profile location named as "xoxkycomvoly.exe". https://blog.avast.com/2013/06/25/15507/ Page 1 of 9 Initial startup activities After these initial steps, the sample starts communicating heavily over the network. The sample contains number of hardcoded hostnames in a plain text form, making a little bit of an impression that it is a simple program, but those are rather only decoys. Let's go chronologicaly and see what it does exactly. The first group of hardcoded hostnames that takes place is the following list of 6 SMTP servers: smtp.live.com smtp.mail.yahoo.com smtp.sbcglobal.yahoo.com smtp.directcon.net mail.airmail.net smtp.compuserve.com These SMTP servers are only used to try outgoing TCP connection on port 25, to see if it is filtered in any way (to see if it's gonna be able to send spam). Then there is another list of plain text hostnames, which look somewhat suspiciously: 4darabians.nl 4dbenelux.be accords-bilateraux.ch 4e-energiezentrale.de 4effect.ca 4egolifestyle.de 4elementos.cl https://blog.avast.com/2013/06/25/15507/ Page 2 of 9 4-elements.ch 4elements.de 4elements.hu 4-elements.se 4emails.de 8wellesley.ca 8zsmost.cz 4enerchi.nl 4entertainmentgroup.tv 4ernila.de 4e-solutions.ch accounting.ee 0daymusic.biz 0handicap.at 4dbabamozi.hu accords-bilateraux.ch 0kommanix.de 4effect.ca 4egolifestyle.de 4elementos.cl 4-elements.ch 4elements.gr 4elements.pl Almost all of these hostnames listen on port 25, giving a premature idea that they may be the SMTP relays through which it sends spam, but the sample doesn't really do anything much with these, they are only supposed to distract us from the real business! The interesting thing that comes next is that the sample also contains several enxored data blobs, each one enxored with different xor key, and these blobs contain some very interesting things, hidden from the plain sight. The first data blob that gets dexored is this list of hostnames: 1st group of hidden hostnames https://blog.avast.com/2013/06/25/15507/ Page 3 of 9 4dmobil.at 4eternity.ch 4everandever.de 4everflashlight.de 4ever-hosting.de 4evernet.de 4evernails.nl 4every1.cc 4everything.pl 9online.fr 9welten.de 4everweb.nl accountingtechs.biz These dexored hostnames look like a good candidates for C&C servers to me. Indeed as the next step the sample is trying to connect to one of these hostnames on port 443 (HTTPS) possibly to obtain a command (Cutwail/Pushdo uses custom binary executable modules). Usage of the HTTPS protocol prevents the actual content to be inspectable in the network capture records, but through reverse engineering we can see that it requests GET /. If the server responds with a reasonable reply (at least 1024 bytes long), it proceeds to check whether the response contains the familiar HTML mark (which is also enxored btw):