Technical Information
Malicious functions
Executes the following (exploit)
- '<SYSTEM32>\regsvr32.exe' /s calc
- '<SYSTEM32>\regsvr32.exe' C:\Flopers\Gorl\Vertu.OCX
- '<SYSTEM32>\regsvr32.exe' C:\Flopers\Gorl\Vertua.OCX
- '<SYSTEM32>\regsvr32.exe' C:\Flopers\Gorl\Vertub.OCX
Modifies file system
Creates the following files
- %TEMP%\mz_etilqs_osznb6ysdi0iwpe
- %TEMP%\error017360_01.xml
- %TEMP%\mz_etilqs_x7xb4swhojxaf2j
- %TEMP%\mz_etilqs_ambgsqku5rdpwsi
- %TEMP%\mz_etilqs_eifdj6u8k3m3kny
- <Current directory>\f4821000
Modifies the following files
- %TEMP%\mz_etilqs_6yewfniamrdnd6w
Substitutes the following files
- <PATH_SAMPLE>.xlsb
Network activity
Connects to
- '5.###.118.241':80
- '13#.#9.133.171':80
- '18#.#44.149.152':80
TCP
HTTP GET requests
- http://13#.#9.133.171/1150156.dat
UDP
- DNS ASK fe########alog-cdn.prod.mozaws.net
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\regsvr32.exe' /s calc' (with hidden window)
- '<SYSTEM32>\regsvr32.exe' C:\Flopers\Gorl\Vertu.OCX' (with hidden window)
- '<SYSTEM32>\regsvr32.exe' C:\Flopers\Gorl\Vertua.OCX' (with hidden window)
- '<SYSTEM32>\regsvr32.exe' C:\Flopers\Gorl\Vertub.OCX' (with hidden window)
