Technical Information
Malicious functions:
To complicate detection of its presence in the operating system,
blocks execution of the following system utilities:
- Windows Update
Executes the following:
- '<SYSTEM32>\net.exe' stop wuauserv
Modifies file system:
Creates the following files:
- %TEMP%\is-26C0G.tmp\<File name>.tmp
- %APPDATA%\Windows Backup\is-O7LII.tmp
- %APPDATA%\Windows Backup\is-1T32M.tmp
- %APPDATA%\Windows Backup\is-J97JM.tmp
- %APPDATA%\Windows Backup\is-KJB9T.tmp
- %APPDATA%\Windows Backup\is-HI6V8.tmp
- %APPDATA%\Windows Backup\is-5O796.tmp
- %APPDATA%\Windows Backup\is-4NUN2.tmp
- %APPDATA%\Windows Backup\is-O399N.tmp
- %APPDATA%\Windows Backup\is-9GH97.tmp
- %APPDATA%\Windows Backup\is-D40HV.tmp
- %APPDATA%\Windows Backup\is-4EPM2.tmp
Deletes the following files:
- %TEMP%\is-26C0G.tmp\<File name>.tmp
Moves the following files:
- from %APPDATA%\Windows Backup\is-O7LII.tmp to %APPDATA%\Windows Backup\config.json
- from %APPDATA%\Windows Backup\is-1T32M.tmp to %APPDATA%\Windows Backup\i9PkdE7007NMqfNb9Ng2GMp5Id85yJ.7z
- from %APPDATA%\Windows Backup\is-J97JM.tmp to %APPDATA%\Windows Backup\7z.dll
- from %APPDATA%\Windows Backup\is-KJB9T.tmp to %APPDATA%\Windows Backup\7z.exe
- from %APPDATA%\Windows Backup\is-HI6V8.tmp to %APPDATA%\Windows Backup\7z.sfx
- from %APPDATA%\Windows Backup\is-5O796.tmp to %APPDATA%\Windows Backup\7zCon.sfx
- from %APPDATA%\Windows Backup\is-4NUN2.tmp to %APPDATA%\Windows Backup\7-zip.dll
- from %APPDATA%\Windows Backup\is-O399N.tmp to %APPDATA%\Windows Backup\7-zip32.dll
- from %APPDATA%\Windows Backup\is-9GH97.tmp to %APPDATA%\Windows Backup\8d4q695MuOhBNIL57V5N6gjzUwaOr3.bat
- from %APPDATA%\Windows Backup\is-D40HV.tmp to %APPDATA%\Windows Backup\8d4q695MuOhBNIL57V5N6gjzUwaOr3.vbs
- from %APPDATA%\Windows Backup\is-4EPM2.tmp to %APPDATA%\Windows Backup\00uQtaZ9eP5nK53Xj2Yi4DncNQ0k6A.bat
Miscellaneous:
Creates and executes the following:
- '%TEMP%\is-26C0G.tmp\<File name>.tmp' /SL5="$30092,1962982,57856,<Full path to file>"
Executes the following:
- '<SYSTEM32>\cmd.exe' /C ""%APPDATA%\Windows Backup\00uQtaZ9eP5nK53Xj2Yi4DncNQ0k6A.bat""
- '<SYSTEM32>\wscript.exe' "%APPDATA%\Windows Backup\8d4q695MuOhBNIL57V5N6gjzUwaOr3.vbs"
- '<SYSTEM32>\cmd.exe' /c "%APPDATA%\Windows Backup\8d4q695MuOhBNIL57V5N6gjzUwaOr3.bat"
- '<SYSTEM32>\net1.exe' stop wuauserv
- '<SYSTEM32>\sc.exe' config wuauserv start= disabled
