Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'MSTime' = '"%APPDATA%\svchost.exe"'
Malicious functions
Searches for windows to
detect programs and games:
- ClassName: 'Tibiaclient', WindowName: ''
Modifies file system
Creates the following files
- %TEMP%\is-eab2m.tmp\<File name>.tmp
- %TEMP%\is-0ad77.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-0ad77.tmp\_isetup\_iscrypt.dll
- %TEMP%\is-afj9s.tmp\<File name>.tmp
- %TEMP%\is-fbjj5.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-fbjj5.tmp\_isetup\_iscrypt.dll
- %APPDATA%\is-dv0pp.tmp
Sets the 'hidden' attribute to the following files
- %APPDATA%\svchost.exe
Deletes the following files
- %TEMP%\is-0ad77.tmp\_isetup\_iscrypt.dll
- %TEMP%\is-0ad77.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-eab2m.tmp\<File name>.tmp
Moves the following files
- from %APPDATA%\is-dv0pp.tmp to %APPDATA%\svchost.exe
Network activity
UDP
- DNS ASK ul#####e-recovery.pl
Miscellaneous
Creates and executes the following
- '%TEMP%\is-eab2m.tmp\<File name>.tmp' /SL5="$4100C4,343877,56832,<Full path to file>"
- '%TEMP%\is-afj9s.tmp\<File name>.tmp' /SL5="$110126,343877,56832,<Full path to file>" /VERYSILENT /PASSWORD=13821
- '%APPDATA%\svchost.exe'
