Technical Information
Malicious functions
Executes the following (exploit)
- '<SYSTEM32>\regsvr32.exe' /s calc
- '<SYSTEM32>\regsvr32.exe' C:\Rujiky\Ubada\Vertu.ooccxx
- '<SYSTEM32>\regsvr32.exe' C:\Rujiky\Ubada\Vertua.ooccxx
- '<SYSTEM32>\regsvr32.exe' C:\Rujiky\Ubada\Vertub.ooccxx
Modifies file system
Creates the following files
- %TEMP%\error016760_01.xml
- <Current directory>\13761000
Substitutes the following files
- <PATH_SAMPLE>.xlsb
Network activity
Connects to
- '10#.#55.93.53':80
- '87.##6.146.69':80
- '94.##0.114.172':80
TCP
HTTP GET requests
- http://10#.#55.93.53/954097552.dat
- http://87.##6.146.69/954097552.dat
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\regsvr32.exe' /s calc' (with hidden window)
- '<SYSTEM32>\regsvr32.exe' C:\Rujiky\Ubada\Vertu.ooccxx' (with hidden window)
- '<SYSTEM32>\regsvr32.exe' C:\Rujiky\Ubada\Vertua.ooccxx' (with hidden window)
- '<SYSTEM32>\regsvr32.exe' C:\Rujiky\Ubada\Vertub.ooccxx' (with hidden window)
