Technical Information
To ensure autorun and distribution
Sets the following service settings
- [<HKLM>\System\CurrentControlSet\Services\RfzDgUsIDYX.dll] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\RfzDgUsIDYX.dll] 'ImagePath' = '<SYSTEM32>\regsvr32.exe "<SYSTEM32>\BsBgrPIY\RfzDgUsIDYX.dll"'
Creates the following services
- 'RfzDgUsIDYX.dll' <SYSTEM32>\regsvr32.exe "<SYSTEM32>\BsBgrPIY\RfzDgUsIDYX.dll"
Malicious functions
Executes the following (exploit)
- '<SYSTEM32>\regsvr32.exe' /S ..\uxevr1.ocx
- '<SYSTEM32>\regsvr32.exe' /S ..\uxevr2.ocx
Modifies file system
Creates the following files
- %HOMEPATH%\uxevr2.ocx
Moves the following files
- from %HOMEPATH%\uxevr2.ocx to <SYSTEM32>\bsbgrpiy\rfzdgusidyx.dll
Network activity
Connects to
- 'me#####otoaksesuar.com':443
- 'el###rray.com':80
- 'ma##uk.com':80
TCP
HTTP GET requests
- http://el###rray.com/athletics-carnival-2018/3UTZYr9D9f/
Other
- 'me#####otoaksesuar.com':443
UDP
- DNS ASK me#####otoaksesuar.com
- DNS ASK el###rray.com
- DNS ASK ma##uk.com
Miscellaneous
Creates and executes the following
- '<SYSTEM32>\regsvr32.exe' /S ..\uxevr1.ocx' (with hidden window)
- '<SYSTEM32>\regsvr32.exe' /S ..\uxevr2.ocx' (with hidden window)
Executes the following
- '<SYSTEM32>\regsvr32.exe' "<SYSTEM32>\BsBgrPIY\RfzDgUsIDYX.dll"
