Technical Information
To ensure autorun and distribution
Sets the following service settings
- [<HKLM>\System\CurrentControlSet\Services\CxsEaWlmI.dll] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\CxsEaWlmI.dll] 'ImagePath' = '<SYSTEM32>\regsvr32.exe "<SYSTEM32>\VFKKgCNouEQh\CxsEaWlmI.dll"'
- [<HKLM>\System\CurrentControlSet\Services\pwZyIRSuML.dll] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\pwZyIRSuML.dll] 'ImagePath' = '<SYSTEM32>\regsvr32.exe "<SYSTEM32>\HrtSpwJj\pwZyIRSuML.dll"'
Creates the following services
- 'CxsEaWlmI.dll' <SYSTEM32>\regsvr32.exe "<SYSTEM32>\VFKKgCNouEQh\CxsEaWlmI.dll"
- 'pwZyIRSuML.dll' <SYSTEM32>\regsvr32.exe "<SYSTEM32>\HrtSpwJj\pwZyIRSuML.dll"
Malicious functions
Executes the following (exploit)
- '<SYSTEM32>\regsvr32.exe' /S ..\cui1.ocx
- '<SYSTEM32>\regsvr32.exe' /S ..\cui2.ocx
- '<SYSTEM32>\regsvr32.exe' /S ..\cui3.ocx
- '<SYSTEM32>\regsvr32.exe' /S ..\cui4.ocx
Modifies file system
Creates the following files
- %HOMEPATH%\cui2.ocx
- %HOMEPATH%\cui3.ocx
- <Current directory>\30a21000
Moves the following files
- from %HOMEPATH%\cui2.ocx to <SYSTEM32>\vfkkgcnoueqh\cxseawlmi.dll
- from %HOMEPATH%\cui3.ocx to <SYSTEM32>\hrtspwjj\pwzyirsuml.dll
Substitutes the following files
- <PATH_SAMPLE>.xls
Network activity
Connects to
- 'bd##n.com':80
- '51.##4.140.238':7080
- '14#.#9.226.45':443
- '64.##7.100.222':8080
- '11#.#93.124.41':7080
- '10#.#32.242.26':8080
- '11#.#32.117.186':8080
- '15#.#5.140.115':443
- '82.##3.21.224':8080
- '20#.#26.98.206':8080
- '5.#.116.246':8080
- '45.#35.8.30':8080
- '13#.#00.24.231':80
- '14#.#6.131.28':8080
- '10#.#0.28.102':8080
- '17#.#05.226.75':8080
- '14#.#1.78.55':443
- '13#.#48.6.80':443
- '13#.#62.113.169':8080
- '45.##.181.158':443
- 'ba###tbd.com':80
- 'ba####sonido.com.ar':80
- '13#.#22.66.193':8080
- '18#.#11.227.137':8080
TCP
HTTP GET requests
- http://bd##n.com/cache/4G8pl/
- http://ba####sonido.com.ar/cgi-bin/AmUUPhWK6oTKLzHpl7zm/
- http://ba###tbd.com/ckfinder/K0a/
Other
- '13#.#62.113.169':8080
- '17#.#05.226.75':8080
- '14#.#6.131.28':8080
- '13#.#00.24.231':80
- '20#.#26.98.206':8080
- '11#.#93.124.41':7080
- '14#.#9.226.45':443
- '51.##4.140.238':7080
UDP
- DNS ASK bd##n.com
- DNS ASK ba####sonido.com.ar
- DNS ASK ba###tbd.com
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\regsvr32.exe' /S ..\cui1.ocx' (with hidden window)
- '<SYSTEM32>\regsvr32.exe' /S ..\cui2.ocx' (with hidden window)
- '<SYSTEM32>\regsvr32.exe' /S ..\cui3.ocx' (with hidden window)
- '<SYSTEM32>\regsvr32.exe' /S ..\cui4.ocx' (with hidden window)
Executes the following
- '<SYSTEM32>\regsvr32.exe' "<SYSTEM32>\VFKKgCNouEQh\CxsEaWlmI.dll"
- '<SYSTEM32>\regsvr32.exe' "<SYSTEM32>\HrtSpwJj\pwZyIRSuML.dll"
