Different extensions, same DLL in recorded regsvr32 commands
Two files with different names have identical reported hashes, and sandbox commands invoke regsvr32.exe against both. Three reports also record requests to the same IP address, but they do not establish a complete installation sequence or a successful command-and-control exchange.
A file named auctbv.bcb in a Windows system directory appears in a sandbox report as the target of a regsvr32.exe command. A second command references a Desktop file ending in .dll.ocx. The names suggest different components, but the reported SHA-256 values are identical. Is this evidence of an additional payload, or of the same DLL being used under different names?
Members-only article
This story is members-only. Sign in to read the full body, indicators of compromise, and VirusTotal context.
Sign in to read