Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] 'IObit License Manager' = 'rundll32 "%ProgramFiles(x86)%\IObit\iobit.dll",DllEntry'
Modifies file system
Creates the following files
- %ProgramFiles(x86)%\iobit\iobit.dll
- %APPDATA%\tor\cached-certs.tmp
- %APPDATA%\tor\unverified-microdesc-consensus.tmp
- %APPDATA%\tor\state.tmp
- %TEMP%\tor\zlib1.dll
- %TEMP%\tor\torrc
- %TEMP%\tor\tor.exe
- %TEMP%\tor\tor-gencert.exe
- %TEMP%\tor\libwinpthread-1.dll
- %TEMP%\tor\libssp-0.dll
- %TEMP%\tor\libssl-1_1.dll
- %TEMP%\tor\libgcc_s_sjlj-1.dll
- %TEMP%\tor\libevent_extra-2-1-7.dll
- %TEMP%\tor\libevent_core-2-1-7.dll
- %TEMP%\tor\libevent-2-1-7.dll
- %TEMP%\tor\libcrypto-1_1.dll
- %APPDATA%\tor\cached-microdesc-consensus.tmp
- %APPDATA%\tor\cached-microdescs.new
Deletes the following files
- %APPDATA%\tor\unverified-microdesc-consensus
- %APPDATA%\tor\cached-certs
- %APPDATA%\tor\state
Moves the following files
- from %APPDATA%\tor\state.tmp to %APPDATA%\tor\state
- from %APPDATA%\tor\unverified-microdesc-consensus.tmp to %APPDATA%\tor\unverified-microdesc-consensus
- from %APPDATA%\tor\cached-certs.tmp to %APPDATA%\tor\cached-certs
- from %APPDATA%\tor\cached-microdesc-consensus.tmp to %APPDATA%\tor\cached-microdesc-consensus
Substitutes the following files
- %APPDATA%\tor\cached-certs.tmp
- %APPDATA%\tor\cached-certs
- %APPDATA%\tor\state.tmp
- %APPDATA%\tor\state
Network activity
Connects to
- 'localhost':49173
- '19#.#1.114.45':9002
- '17#.#12.254.192':31337
- '5.#.158.75':443
- '10#.#06.237.23':443
- '81.##9.140.160':9001
- 'localhost':9059
TCP
- '19#.#1.114.45':9002
- '17#.#12.254.192':31337
- '5.#.158.75':443
- '81.##9.140.160':9001
- '10#.#06.237.23':443
- 'localhost':9059
- 'localhost':49181
Miscellaneous
Creates and executes the following
- '%TEMP%\tor\tor.exe' -f %TEMP%\Tor\torrc
- '%TEMP%\tor\tor.exe' -f %TEMP%\Tor\torrc' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\wbem\wmic.exe' /Namespace:\\root\Microsoft\Windows\Defender class MSFT_MpPreference call Add ExclusionProcess=\"rundll32.exe\"
- '%WINDIR%\syswow64\wbem\wmic.exe' /Namespace:\\root\Microsoft\Windows\Defender class MSFT_MpPreference call Add ExclusionExtension=\".dll\"
- '%WINDIR%\syswow64\wbem\wmic.exe' /Namespace:\\root\Microsoft\Windows\Defender class MSFT_MpPreference call Add ExclusionPath=\"\Temp\\"
- '%WINDIR%\syswow64\wbem\wmic.exe' /Namespace:\\root\Microsoft\Windows\Defender class MSFT_MpPreference call Add ExclusionPath=\"%ProgramFiles(x86)%\IObit\iobit.dll\"
- '%WINDIR%\syswow64\reg.exe' ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "IObit License Manager" /t REG_SZ /F /D "rundll32 \"%ProgramFiles(x86)%\IObit\iobit.dll\",DllEntry
- '%WINDIR%\syswow64\rundll32.exe' "%ProgramFiles(x86)%\IObit\iobit.dll",DllEntry
