Technical Information
Modifies file system
Creates the following files
- %TEMP%\is-qh2o9.tmp\<File name>.tmp
- %TEMP%\is-q5j27.tmp\_isetup\_setup64.tmp
- %TEMP%\is-q5j27.tmp\_isetup\_iscrypt.dll
- %TEMP%\is-q5j27.tmp\fhbxarx.dll
- %TEMP%\is-b5s1b.tmp\<File name>.tmp
- %TEMP%\is-0b4oe.tmp\_isetup\_setup64.tmp
- %TEMP%\is-0b4oe.tmp\_isetup\_iscrypt.dll
- %TEMP%\is-0b4oe.tmp\fhbxarx.dll
- %ProgramFiles(x86)%\fastdatax\is-5hd23.tmp
- %ProgramFiles(x86)%\fastdatax\is-cvfqk.tmp
- %ProgramFiles(x86)%\fastdatax\unins000.dat
- %TEMP%\_iu14d2n.tmp
- %TEMP%\is-opcr5.tmp\_isetup\_setup64.tmp
- %TEMP%\is-opcr5.tmp\fhbxarx.dll
Deletes the following files
- %TEMP%\is-opcr5.tmp\fhbxarx.dll
- %TEMP%\is-opcr5.tmp\_isetup\_setup64.tmp
- %TEMP%\is-b5s1b.tmp\<File name>.tmp
- %TEMP%\is-qh2o9.tmp\<File name>.tmp
- %TEMP%\is-0b4oe.tmp\fhbxarx.dll
- %TEMP%\is-0b4oe.tmp\_isetup\_iscrypt.dll
- %TEMP%\is-0b4oe.tmp\_isetup\_setup64.tmp
- %TEMP%\is-q5j27.tmp\fhbxarx.dll
- %TEMP%\is-q5j27.tmp\_isetup\_iscrypt.dll
- %TEMP%\is-q5j27.tmp\_isetup\_setup64.tmp
Moves the following files
- from %ProgramFiles(x86)%\fastdatax\is-5hd23.tmp to %ProgramFiles(x86)%\fastdatax\unins000.exe
- from %ProgramFiles(x86)%\fastdatax\is-cvfqk.tmp to %ProgramFiles(x86)%\fastdatax\fhbxarx.dll
Deletes itself.
Network activity
Connects to
- 'tm#.###tdataxew.info':80
- 'in##.##stdataxew.info':80
- 've####eshabi.info':80
TCP
HTTP POST requests
- http://tm#.###tdataxew.info/
- http://in##.##stdataxew.info/
UDP
- DNS ASK tm#.###tdataxew.info
- DNS ASK in##.##stdataxew.info
- DNS ASK ut####ketto.info
- DNS ASK ve####eshabi.info
Miscellaneous
Creates and executes the following
- '%TEMP%\is-qh2o9.tmp\<File name>.tmp' /SL5="$90246,1070983,121344,<Full path to file>"
- '%TEMP%\is-b5s1b.tmp\<File name>.tmp' /SL5="$12021E,1070983,121344,<Full path to file>" /VERYSILENT /SL5="$90246,1070983,121344,<Full path to file>"
- '%ProgramFiles(x86)%\fastdatax\unins000.exe' /sn=Korjiipy6u74DaG6VWTUIJ1JA4zZAAm2rpihq-8hJbIwvaqFWiD7n2FT_NIUwTejye6uMEE_ZI0BWkGlRlAor1MCceaHpDZAo7jU8jVoLZm0frB76IwM6-h2Wd7ZXouAa4UkN_DffceiHSFAM1XaSBhnf4oh5Hi7YoOW96YGlXSn7-ulmKpHsos9jNnc_...
- '%TEMP%\_iu14d2n.tmp' /SECONDPHASE="%ProgramFiles(x86)%\FastDataX\unins000.exe" /FIRSTPHASEWND=$10262 /sn=Korjiipy6u74DaG6VWTUIJ1JA4zZAAm2rpihq-8hJbIwvaqFWiD7n2FT_NIUwTejye6uMEE_ZI0BWkGlRlAor1MCceaHpDZAo7jU8jVoLZm0f...
Executes the following
- '%WINDIR%\syswow64\regsvr32.exe' "%TEMP%\is-Q5J27.tmp\fhbxarx.dll" /i /n /s:"$$d0XWfVToitjBt3Gols1Ww-i3liK66mOBrWRXhJ5NnGkNwuzMfo_LpiBgdQIXBs-wb1kXZFCwIOnKJDz8d0dxWd9_e33nYR-dT9Tdjh6MuMtXNmFU_ab51Lzgvwv37bEltVUfO8I_a0IvJvkW2nj...
- '%WINDIR%\syswow64\regsvr32.exe' "%TEMP%\is-0B4OE.tmp\fhbxarx.dll" /i /n /s:"$$_wkDZJfLjyizRh9eMAvYMhGxQK9iOppL7-acAG5Opja5n4pfBUTnyGa8zghFXAvwEZzL0D7EUJgvRTwyHEi0bzk13LOERaAKmYp0jCXzrWfbOt0OA00rdrCbjISaCpz5MK_XS-LBGzuLH027p8x...
- '%WINDIR%\syswow64\cmd.exe' /c for /l %x in (1, 1, 2) do del /Q "<Full path to file>" & timeout /t 5
- '%WINDIR%\syswow64\cmd.exe' /c for /l %x in (1, 1, 2) do rmdir /S /Q "%TEMP%\is-0B4OE.tmp" & timeout /t 5
- '%WINDIR%\syswow64\cmd.exe' /c for /l %x in (1, 1, 2) do rmdir /S /Q "%TEMP%\is-Q5J27.tmp" & timeout /t 5
- '%WINDIR%\syswow64\timeout.exe' /t 5
