Technical Information
To ensure autorun and distribution
Sets the following service settings
- [<HKLM>\System\CurrentControlSet\Services\pyWfcQgJuN.dll] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\pyWfcQgJuN.dll] 'ImagePath' = '<SYSTEM32>\regsvr32.exe "<SYSTEM32>\QRlVxtpwDycxT\pyWfcQgJuN.dll"'
Creates the following services
- 'pyWfcQgJuN.dll' <SYSTEM32>\regsvr32.exe "<SYSTEM32>\QRlVxtpwDycxT\pyWfcQgJuN.dll"
Malicious functions
Executes the following (exploit)
- '<SYSTEM32>\regsvr32.exe' ..\wurod.ocx
Modifies file system
Creates the following files
- %HOMEPATH%\wurod.ocx
- <Current directory>\c1631000
Moves the following files
- from %HOMEPATH%\wurod.ocx to <SYSTEM32>\qrlvxtpwdycxt\pywfcqgjun.dll
Substitutes the following files
- <PATH_SAMPLE>.xls
Network activity
Connects to
- 'im###ilgolfo.it':443
- '45.#35.8.30':8080
- '15#.#06.112.196':8080
- '58.##7.42.236':80
- '20#.#50.246.206':443
- '17#.#04.251.154':8080
- '72.##.201.15':8080
- '45.##8.115.99':8080
- '12#.#32.188.93':443
- 'oc##.#tartssl.com':80
- '16#.#6.142.56':8080
- '21#.#41.20.155':443
- '77.##.247.144':8080
- '18#.#26.111.200':7080
- '94.#3.45.86':4143
- '20#.#89.28.199':8080
- '11#.#93.124.41':7080
- '21#.#58.226.206':443
- '1.##4.21.73':7080
- '15#.#5.66.124':8080
- '23.#39.0.12':443
- 'il##welp.nl':80
- 'r3.#.lencr.org':80
- 'x1.#.lencr.org':80
- '17#.#12.193.249':8080
- '27.#4.89.58':8080
TCP
HTTP GET requests
- http://x1.#.lencr.org/
- http://r3.#.lencr.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBRI2smg%2ByvTLU%2Fw3mjS9We3NfmzxAQUFC6zF7dYVsuuUAlA5h%2BvnYsUwsYCEgRKUsjIB%2FsZSDWCRmu3JUZLBg%3D%3D
- http://il##welp.nl/templates/c9B59jP7zs/
- http://oc##.#tartssl.com/sub/class2/code/ca/MEMwQTA%2FMD0wOzAJBgUrDgMCGgUABBQSOgrhRCSnWfKxoWTjWxhk8hga9AQU0E4PQJlsuEsZbzsouODjiAc0qrcCAhAV
Other
- 'im###ilgolfo.it':443
- '23.#39.0.12':443
- '15#.#5.66.124':8080
- '11#.#93.124.41':7080
- '94.#3.45.86':4143
- '58.##7.42.236':80
UDP
- DNS ASK im###ilgolfo.it
- DNS ASK x1.#.lencr.org
- DNS ASK r3.#.lencr.org
- DNS ASK il##welp.nl
- DNS ASK oc##.#tartssl.com
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\regsvr32.exe' ..\wurod.ocx' (with hidden window)
Executes the following
- '<SYSTEM32>\regsvr32.exe' "<SYSTEM32>\QRlVxtpwDycxT\pyWfcQgJuN.dll"
