Technical Information
To ensure autorun and distribution:
Creates the following services:
- [<HKCU>\Software\VOS\IObit Un<HKLM>\SYSTEM\CurrentControlSet\Services\IObitUnlocker] 'ImagePath' = '%ProgramFiles% (x86)\IObit\IObit Unlocker\IObitUnlocker.sys'
- [<HKCU>\Software\VOS\IObit Un<HKLM>\SYSTEM\ControlSet001\Services\IObitUnlocker] 'ImagePath' = '%ProgramFiles% (x86)\IObit\IObit Unlocker\IObitUnlocker.sys'
Malicious functions:
Injects code into
the following user processes:
Modifies file system:
Creates the following files:
- %APPDATA%\VOS\IObit Un\PROG\%Program Files (x86)%\IObit\IObit Unlocker\Language\Danish.lng
- %APPDATA%\VOS\IObit Un\PROG\%Program Files (x86)%\IObit\IObit Unlocker\Language\Czech.lng
- %APPDATA%\VOS\IObit Un\PROG\%Program Files (x86)%\IObit\IObit Unlocker\Language\ChineseTrad.lng
- %APPDATA%\VOS\IObit Un\PROG\%Program Files (x86)%\IObit\IObit Unlocker\Language\Dutch.lng
- %APPDATA%\VOS\IObit Un\PROG\%Program Files (x86)%\IObit\IObit Unlocker\Language\German.lng
- %APPDATA%\VOS\IObit Un\PROG\%Program Files (x86)%\IObit\IObit Unlocker\Language\Finnish.lng
- %APPDATA%\VOS\IObit Un\PROG\%Program Files (x86)%\IObit\IObit Unlocker\Language\English.lng
- %APPDATA%\VOS\IObit Un\PROG\%Program Files (x86)%\IObit\IObit Unlocker\IObitUnlocker.exe
- %APPDATA%\VOS\IObit Un\CHANGES\CryptCheck.dat
- %APPDATA%\VOS\IObit Un\EngineStamps\ZipCache.20150716-195604.406.stamp
- %APPDATA%\VOS\IObit Un\CHANGES\VirtFiles.db.2860.tmp
- %APPDATA%\VOS\IObit Un\PROG\%Program Files (x86)%\IObit\IObit Unlocker\Language\ChineseSimp.lng
- %APPDATA%\VOS\IObit Un\PROG\%Program Files (x86)%\IObit\IObit Unlocker\Language\Arabic.lng
- %APPDATA%\VOS\IObit Un\SandboxCfg.db.2860.tmp
- %APPDATA%\VOS\IObit Un\PROG\%Program Files (x86)%\IObit\IObit Unlocker\SpecialDir.ini
- %APPDATA%\VOS\IObit Un\PROG\%Common AppData%\IObit\IObit UnLocker\Main.ini
- %APPDATA%\VOS\IObit Un\PROG\%Program Files (x86)%\IObit\IObit Unlocker\Language\Turkish.lng
- %APPDATA%\VOS\IObit Un\PROG\%Program Files (x86)%\IObit\IObit Unlocker\update.ini
- %APPDATA%\VOS\IObit Un\CHANGES\%Common AppData%\IObit\IObit Unlocker\Main.ini
- %APPDATA%\VOS\IObit Un\CHANGES\%Common AppData%\IObit\IObit Unlocker\IObitUnlocker.ini
- %APPDATA%\VOS\IObit Un\PROG\%Common AppData%\IObit\IObit UnLocker\IObitUnlocker.ini
- %APPDATA%\VOS\IObit Un\PROG\%Program Files (x86)%\IObit\IObit Unlocker\Language\Japanese.lng
- %APPDATA%\VOS\IObit Un\PROG\%Program Files (x86)%\IObit\IObit Unlocker\Language\Italian.lng
- %APPDATA%\VOS\IObit Un\PROG\%Program Files (x86)%\IObit\IObit Unlocker\Language\Hungarian.lng
- %APPDATA%\VOS\IObit Un\PROG\%Program Files (x86)%\IObit\IObit Unlocker\Language\Polish.lng
- %APPDATA%\VOS\IObit Un\PROG\%Program Files (x86)%\IObit\IObit Unlocker\Language\Swedish.lng
- %APPDATA%\VOS\IObit Un\PROG\%Program Files (x86)%\IObit\IObit Unlocker\Language\Spanish.lng
- %APPDATA%\VOS\IObit Un\PROG\%Program Files (x86)%\IObit\IObit Unlocker\Language\Russian.lng
- %APPDATA%\VOS\IObit Un\ZipCache
- %APPDATA%\VOS\IObit Un\EngineStamps\IObit Un64.exe.20150716-195541.485.stamp
- %APPDATA%\VOS\IObit Un\IObit Un64.exe
- %APPDATA%\VOS\IObit Un\EngineStamps\IObit Un.exe.20150716-195541.485.stamp
- %APPDATA%\VOS\IObit Un\VirtFiles.Prog.db
- %APPDATA%\VOS\IObit Un\EngineStamps\SandboxCfg.db.20150716-195541.485.stamp
- %APPDATA%\VOS\IObit Un\SandboxCfg.db
- %APPDATA%\VOS\IObit Un\EngineStamps\VirtFiles.Prog.db.20150716-195604.406.stamp
- %APPDATA%\VOS\IObit Un\AppVirtDll_IObit Un.dll
- %APPDATA%\VOS\IObit Un\VirtApp.ini
- %TEMP%\~DF932A.tmp
- %APPDATA%\VOS\IObit Un\EngineStamps\AppVirtDll_IObit Un.dll.20150716-195541.376.stamp
- %APPDATA%\VOS\IObit Un\IObit Un.exe
- %APPDATA%\VOS\IObit Un\EngineStamps\AppVirtDll64_IObit Un.dll.20150716-195541.474.stamp
- %APPDATA%\VOS\IObit Un\AppVirtDll64_IObit Un.dll
- %APPDATA%\VOS\IObit Un\PROG\%Common Programs%\IObit Unlocker\Uninstall IObit Unlocker.lnk
- %APPDATA%\VOS\IObit Un\PROG\%Common Programs%\IObit Unlocker\IObit Unlocker.lnk
- %APPDATA%\VOS\IObit Un\PROG\%Program Files (x86)%\IObit\IObit Unlocker\IObitUnlocker.dll
- %APPDATA%\VOS\IObit Un\PROG\%Common Desktop%\IObit Unlocker.lnk
- %APPDATA%\VOS\IObit Un\EngineStamps\DiskModeDeploy.marker
- %APPDATA%\VOS\IObit Un\PROG\Icons\unins000.exe.ico
- %APPDATA%\VOS\IObit Un\PROG\Icons\IObitUnlocker.exe.ico
- %APPDATA%\VOS\IObit Un\CHANGES\VirtFiles.db
- %APPDATA%\VOS\IObit Un\EngineStamps\VirtReg.Prog.dat.20150716-195604.406.stamp
- %APPDATA%\VOS\IObit Un\VirtReg.Prog.dat
- %APPDATA%\VOS\IObit Un\CHANGES\VirtReg.dat
- %APPDATA%\VOS\IObit Un\SandboxCfg.db.2844.tmp
- %APPDATA%\VOS\IObit Un\CHANGES\VirtFiles.db.2844.tmp
- %APPDATA%\VOS\IObit Un\CHANGES\VirtReg.Base.dat
Deletes the following files:
- %TEMP%\~DF932A.tmp
- %APPDATA%\VOS\IObit Un\SandboxCfg.db
- %APPDATA%\VOS\IObit Un\CHANGES\VirtFiles.db
Substitutes the following files:
- %APPDATA%\VOS\IObit Un\CHANGES\VirtFiles.db.2844.tmp
- %APPDATA%\VOS\IObit Un\SandboxCfg.db.2860.tmp
- %APPDATA%\VOS\IObit Un\SandboxCfg.db.2844.tmp
- %APPDATA%\VOS\IObit Un\CHANGES\VirtFiles.db
- %APPDATA%\VOS\IObit Un\SandboxCfg.db
Network activity:
Connects to:
- 'up####.iobit.com':80
TCP:
HTTP POST requests:
- http://up####.iobit.com/infofiles/iobitunlocker.upt
UDP:
- DNS ASK up####.iobit.com
Miscellaneous:
Searches for the following windows:
- ClassName: '' WindowName: 'GFXSVR'
Creates and executes the following:
- '%APPDATA%\VOS\IObit Un\PROG\%Program Files (x86)%\IObit\IObit Unlocker\IObitUnlocker.exe'
