Technical Information
To ensure autorun and distribution
Sets the following service settings
- [<HKLM>\System\CurrentControlSet\Services\bvni.dll] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\bvni.dll] 'ImagePath' = '<SYSTEM32>\regsvr32.exe "<SYSTEM32>\KxNWl\bvni.dll"'
Creates the following services
- 'bvni.dll' <SYSTEM32>\regsvr32.exe "<SYSTEM32>\KxNWl\bvni.dll"
Malicious functions
Executes the following (exploit)
- '<SYSTEM32>\regsvr32.exe' /S ..\uxevr1.ocx
- '<SYSTEM32>\regsvr32.exe' /S ..\uxevr2.ocx
- '<SYSTEM32>\regsvr32.exe' /S ..\uxevr3.ocx
- '<SYSTEM32>\regsvr32.exe' /S ..\uxevr4.ocx
Modifies file system
Creates the following files
- %HOMEPATH%\uxevr2.ocx
- %HOMEPATH%\uxevr4.ocx
- <Current directory>\54361000
Moves the following files
- from %HOMEPATH%\uxevr4.ocx to <SYSTEM32>\kxnwl\bvni.dll
Substitutes the following files
- <PATH_SAMPLE>.xls
Network activity
Connects to
- 'me#####otoaksesuar.com':443
- '16#.68.99.3':8080
- '10#.#0.28.102':8080
- '82.##5.152.127':8080
- '20#.#7.163.214':443
- '10#.#3.75.120':443
- '51.##4.140.238':7080
- '77.##.247.144':8080
- '11#.#93.124.41':7080
- '19#.#18.30.83':443
- '45.##8.115.99':8080
- '15#.#5.140.115':443
- '89.#9.244.7':443
- '17#.#39.37.178':8080
- '15#.#9.202.34':443
- '17#.#2.82.196':8080
- 'jr####tware-web.net':80
- 'ma##uk.com':80
- 'el###rray.com':80
- 'r3.#.lencr.org':80
- 'x1.#.lencr.org':80
- '15#.#5.66.124':8080
- '20#.#14.109.124':443
TCP
HTTP GET requests
- http://x1.#.lencr.org/
- http://r3.#.lencr.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBRI2smg%2ByvTLU%2Fw3mjS9We3NfmzxAQUFC6zF7dYVsuuUAlA5h%2BvnYsUwsYCEgMxQiuAWfA1ifg5o13uklyO8w%3D%3D
- http://el###rray.com/athletics-carnival-2018/3UTZYr9D9f/
- http://jr####tware-web.net/aaabackupsqldb/11hYk3bHJ/
Other
- 'me#####otoaksesuar.com':443
- '17#.#2.82.196':8080
- '15#.#9.202.34':443
- '15#.#5.66.124':8080
- '11#.#93.124.41':7080
- '51.##4.140.238':7080
UDP
- DNS ASK me#####otoaksesuar.com
- DNS ASK x1.#.lencr.org
- DNS ASK r3.#.lencr.org
- DNS ASK el###rray.com
- DNS ASK ma##uk.com
- DNS ASK jr####tware-web.net
- DNS ASK st####.rapidssl.com
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\regsvr32.exe' /S ..\uxevr1.ocx' (with hidden window)
- '<SYSTEM32>\regsvr32.exe' /S ..\uxevr2.ocx' (with hidden window)
- '<SYSTEM32>\regsvr32.exe' /S ..\uxevr3.ocx' (with hidden window)
- '<SYSTEM32>\regsvr32.exe' /S ..\uxevr4.ocx' (with hidden window)
Executes the following
- '<SYSTEM32>\regsvr32.exe' "<SYSTEM32>\KxNWl\bvni.dll"
