Technical Information
Malicious functions
Executes the following (exploit)
- '<SYSTEM32>\regsvr32.exe' /S ..\soci1.ocx
- '<SYSTEM32>\regsvr32.exe' /S ..\soci2.ocx
- '<SYSTEM32>\regsvr32.exe' /S ..\soci3.ocx
- '<SYSTEM32>\regsvr32.exe' /S ..\soci4.ocx
Modifies file system
Creates the following files
- <Current directory>\f1cc0000
Substitutes the following files
- <PATH_SAMPLE>.xls
Network activity
Connects to
- 'fi####.mipa.uns.ac.id':80
- 'gr###oconut.com':80
- 'zo####formatica.es':80
- 'ba####magazine.ro':80
TCP
HTTP GET requests
- http://fi####.mipa.uns.ac.id/reseller/img/nRAvAgoY8Y/
- http://gr###oconut.com/edm/71qUA/
- http://www.gr###oconut.com/
- http://zo####formatica.es/tienda/XCHJmidSYTkE/
- http://ba####magazine.ro/wp-content/9VrMPV/
UDP
- DNS ASK fi####.mipa.uns.ac.id
- DNS ASK gr###oconut.com
- DNS ASK zo####formatica.es
- DNS ASK ba####magazine.ro
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\regsvr32.exe' /S ..\soci1.ocx' (with hidden window)
- '<SYSTEM32>\regsvr32.exe' /S ..\soci2.ocx' (with hidden window)
- '<SYSTEM32>\regsvr32.exe' /S ..\soci3.ocx' (with hidden window)
- '<SYSTEM32>\regsvr32.exe' /S ..\soci4.ocx' (with hidden window)
