Technical Information
Malicious functions
Executes the following (exploit)
- '<SYSTEM32>\regsvr32.exe' /s calc
- '<SYSTEM32>\regsvr32.exe' C:\Flopers\Gorl\Vertu.OCX
- '<SYSTEM32>\regsvr32.exe' C:\Flopers\Gorl\Vertua.OCX
- '<SYSTEM32>\regsvr32.exe' C:\Flopers\Gorl\Vertub.OCX
Modifies file system
Creates the following files
- %TEMP%\error011480_01.xml
Network activity
Connects to
- '5.###.118.241':80
- '13#.#9.133.171':80
- '18#.#44.149.152':80
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\regsvr32.exe' /s calc' (with hidden window)
- '<SYSTEM32>\regsvr32.exe' C:\Flopers\Gorl\Vertu.OCX' (with hidden window)
- '<SYSTEM32>\regsvr32.exe' C:\Flopers\Gorl\Vertua.OCX' (with hidden window)
- '<SYSTEM32>\regsvr32.exe' C:\Flopers\Gorl\Vertub.OCX' (with hidden window)
