Technical Information
Malicious functions
Executes the following
- '%WINDIR%\syswow64\taskkill.exe' /f /im QwestTouchPointAgent.exe /im CenturyLinkTouchPointAgent.exe /im QwestInstaller.exe /im QwestInstallerApp.exe /im CenturyLinkInstaller.exe /im CenturyLinkInstallerApp.exe
Modifies file system
Creates the following files
- %TEMP%\rarsfx0\centurylinkinstallersetup.exe
- %TEMP%\{87da15c5-59cf-4668-8b18-79bc79cb3fe1}\{c96ff998-45bd-411e-9253-b7f2660fe280}\_is5dc3.tmp
- %TEMP%\{87da15c5-59cf-4668-8b18-79bc79cb3fe1}\{c96ff998-45bd-411e-9253-b7f2660fe280}\def5db2.tmp
- %TEMP%\{87da15c5-59cf-4668-8b18-79bc79cb3fe1}\{c96ff998-45bd-411e-9253-b7f2660fe280}\isr5da2.tmp
- %TEMP%\{87da15c5-59cf-4668-8b18-79bc79cb3fe1}\{c96ff998-45bd-411e-9253-b7f2660fe280}\str5d81.tmp
- %TEMP%\{87da15c5-59cf-4668-8b18-79bc79cb3fe1}\isb5d71.tmp
- %TEMP%\{87da15c5-59cf-4668-8b18-79bc79cb3fe1}\dot5d70.tmp
- %TEMP%\{87da15c5-59cf-4668-8b18-79bc79cb3fe1}\cor5d5f.tmp
- %TEMP%\{87da15c5-59cf-4668-8b18-79bc79cb3fe1}\{c96ff998-45bd-411e-9253-b7f2660fe280}\dif5d5e.tmp
- %TEMP%\{87da15c5-59cf-4668-8b18-79bc79cb3fe1}\{c96ff998-45bd-411e-9253-b7f2660fe280}\fon5d4e.tmp
- %TEMP%\{87da15c5-59cf-4668-8b18-79bc79cb3fe1}\{c96ff998-45bd-411e-9253-b7f2660fe280}\set5d3d.tmp
- %TEMP%\5cfe.tmp
- %TEMP%\{c10aad7a-089f-494c-aa9d-f08bf60f4b22}\0x0409.ini
- %TEMP%\{c10aad7a-089f-494c-aa9d-f08bf60f4b22}\setup.ini
- %TEMP%\{c10aad7a-089f-494c-aa9d-f08bf60f4b22}\disk1\setup.iss
- %TEMP%\{c10aad7a-089f-494c-aa9d-f08bf60f4b22}\disk1\setup.inx
- %TEMP%\{c10aad7a-089f-494c-aa9d-f08bf60f4b22}\disk1\setup.ini
- %TEMP%\{c10aad7a-089f-494c-aa9d-f08bf60f4b22}\disk1\setup.exe
- %TEMP%\{c10aad7a-089f-494c-aa9d-f08bf60f4b22}\disk1\md5sum.exe
- %TEMP%\{c10aad7a-089f-494c-aa9d-f08bf60f4b22}\disk1\license.rtf
- %TEMP%\{c10aad7a-089f-494c-aa9d-f08bf60f4b22}\disk1\layout.bin
- %TEMP%\{c10aad7a-089f-494c-aa9d-f08bf60f4b22}\disk1\issetup.dll
- %TEMP%\{c10aad7a-089f-494c-aa9d-f08bf60f4b22}\disk1\data1.hdr
- %TEMP%\{c10aad7a-089f-494c-aa9d-f08bf60f4b22}\disk1\data1.cab
- %TEMP%\{c10aad7a-089f-494c-aa9d-f08bf60f4b22}\disk1\0x0409.ini
- %TEMP%\rarsfx0\config.ini
- %TEMP%\{87da15c5-59cf-4668-8b18-79bc79cb3fe1}\{c96ff998-45bd-411e-9253-b7f2660fe280}\_is5dc4.tmp
- %WINDIR%\centurylinkinstallersetup.log
Moves the following files
- from %TEMP%\{87da15c5-59cf-4668-8b18-79bc79cb3fe1}\{c96ff998-45bd-411e-9253-b7f2660fe280}\set5d3d.tmp to %TEMP%\{87da15c5-59cf-4668-8b18-79bc79cb3fe1}\{c96ff998-45bd-411e-9253-b7f2660fe280}\setup.inx
- from %TEMP%\{87da15c5-59cf-4668-8b18-79bc79cb3fe1}\{c96ff998-45bd-411e-9253-b7f2660fe280}\fon5d4e.tmp to %TEMP%\{87da15c5-59cf-4668-8b18-79bc79cb3fe1}\{c96ff998-45bd-411e-9253-b7f2660fe280}\fontdata.ini
- from %TEMP%\{87da15c5-59cf-4668-8b18-79bc79cb3fe1}\{c96ff998-45bd-411e-9253-b7f2660fe280}\dif5d5e.tmp to %TEMP%\{87da15c5-59cf-4668-8b18-79bc79cb3fe1}\{c96ff998-45bd-411e-9253-b7f2660fe280}\difxdata.ini
- from %TEMP%\{87da15c5-59cf-4668-8b18-79bc79cb3fe1}\cor5d5f.tmp to %TEMP%\{87da15c5-59cf-4668-8b18-79bc79cb3fe1}\corecomp.ini
- from %TEMP%\{87da15c5-59cf-4668-8b18-79bc79cb3fe1}\dot5d70.tmp to %TEMP%\{87da15c5-59cf-4668-8b18-79bc79cb3fe1}\dotnetinstaller.exe
- from %TEMP%\{87da15c5-59cf-4668-8b18-79bc79cb3fe1}\isb5d71.tmp to %TEMP%\{87da15c5-59cf-4668-8b18-79bc79cb3fe1}\isbew64.exe
- from %TEMP%\{87da15c5-59cf-4668-8b18-79bc79cb3fe1}\{c96ff998-45bd-411e-9253-b7f2660fe280}\str5d81.tmp to %TEMP%\{87da15c5-59cf-4668-8b18-79bc79cb3fe1}\{c96ff998-45bd-411e-9253-b7f2660fe280}\stringtable_0x0409.ips
- from %TEMP%\{87da15c5-59cf-4668-8b18-79bc79cb3fe1}\{c96ff998-45bd-411e-9253-b7f2660fe280}\isr5da2.tmp to %TEMP%\{87da15c5-59cf-4668-8b18-79bc79cb3fe1}\{c96ff998-45bd-411e-9253-b7f2660fe280}\isrt.dll
- from %TEMP%\{87da15c5-59cf-4668-8b18-79bc79cb3fe1}\{c96ff998-45bd-411e-9253-b7f2660fe280}\def5db2.tmp to %TEMP%\{87da15c5-59cf-4668-8b18-79bc79cb3fe1}\{c96ff998-45bd-411e-9253-b7f2660fe280}\default.pal
- from %TEMP%\{87da15c5-59cf-4668-8b18-79bc79cb3fe1}\{c96ff998-45bd-411e-9253-b7f2660fe280}\_is5dc3.tmp to %TEMP%\{87da15c5-59cf-4668-8b18-79bc79cb3fe1}\{c96ff998-45bd-411e-9253-b7f2660fe280}\_isuser_0x0409.dll
- from %TEMP%\{87da15c5-59cf-4668-8b18-79bc79cb3fe1}\{c96ff998-45bd-411e-9253-b7f2660fe280}\_is5dc4.tmp to %TEMP%\{87da15c5-59cf-4668-8b18-79bc79cb3fe1}\{c96ff998-45bd-411e-9253-b7f2660fe280}\_isres_0x0409.dll
Miscellaneous
Searches for the following windows
- ClassName: 'EDIT' WindowName: ''
- ClassName: '' WindowName: ''
Creates and executes the following
- '%TEMP%\rarsfx0\centurylinkinstallersetup.exe'
- '%TEMP%\{87da15c5-59cf-4668-8b18-79bc79cb3fe1}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{1DB0158C-EE6F-4257-903B-7E64242A428A}
- '%TEMP%\{87da15c5-59cf-4668-8b18-79bc79cb3fe1}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{035FA5EC-1A60-4EA4-AFA5-42A0C2480ECC}
- '%TEMP%\{87da15c5-59cf-4668-8b18-79bc79cb3fe1}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{2C1CFA3E-5984-45E5-9A34-A32793A715D8}
- '%TEMP%\{87da15c5-59cf-4668-8b18-79bc79cb3fe1}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{1504E791-D127-4D21-8479-286459769ECB}
- '%TEMP%\{87da15c5-59cf-4668-8b18-79bc79cb3fe1}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{B84C1BB7-F008-4E32-A1F3-D91AF70F4717}
- '%TEMP%\{87da15c5-59cf-4668-8b18-79bc79cb3fe1}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{0CC65A4E-A107-4299-A8CA-6E0E5FC04302}
- '%TEMP%\{87da15c5-59cf-4668-8b18-79bc79cb3fe1}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{1D4FE3D0-694A-4E4B-8E68-3941BCC1A97F}
- '%TEMP%\{87da15c5-59cf-4668-8b18-79bc79cb3fe1}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{EF80E461-3653-4636-AAAC-0C349B70F581}
- '%TEMP%\{87da15c5-59cf-4668-8b18-79bc79cb3fe1}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{D8DA1277-F189-4A00-9132-8985CE4BE2EA}
- '%TEMP%\{87da15c5-59cf-4668-8b18-79bc79cb3fe1}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{3DCA4086-5E54-4C01-A4FB-3ED2C5D0D461}
- '%TEMP%\{87da15c5-59cf-4668-8b18-79bc79cb3fe1}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{E05022BA-BA3D-49BD-A4D2-3B3BD4279489}
- '%TEMP%\{87da15c5-59cf-4668-8b18-79bc79cb3fe1}\isbew64.exe' {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{AB2E761C-EFBF-4500-97EF-F665902959E1}
- '%WINDIR%\syswow64\taskkill.exe' /f /im QwestTouchPointAgent.exe /im CenturyLinkTouchPointAgent.exe /im QwestInstaller.exe /im QwestInstallerApp.exe /im CenturyLinkInstaller.exe /im CenturyLinkInstallerApp.exe' (with hidden window)
