Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKLM>\Software\Microsoft\Windows\CurrentVersion\RunOnce] 'system recover' = '"%ProgramFiles(x86)%\Uninstall Information\Sudyzhetoga.exe"'
Modifies file system
Creates the following files
- %TEMP%\is-khsai.tmp\<File name>.tmp
- %ProgramFiles(x86)%\i-record\is-8g6uf.tmp
- %ProgramFiles(x86)%\i-record\is-h0veo.tmp
- %ProgramFiles(x86)%\i-record\is-hr12c.tmp
- %ProgramFiles(x86)%\i-record\is-i6kfo.tmp
- %ProgramFiles(x86)%\i-record\is-c2mav.tmp
- %ProgramFiles(x86)%\i-record\is-2pbc7.tmp
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\i-record.lnk
- %TEMP%\is-1bmd3.tmp\_isetup\_setup64.tmp
- %ProgramFiles(x86)%\i-record\unins000.dat
- %TEMP%\bd-0278e-fcb-6afbe-3db001630a21e\govomesuhe.exe
- %TEMP%\bd-0278e-fcb-6afbe-3db001630a21e\govomesuhe.exe.config
- %TEMP%\e5-b2e49-7df-7b5be-20a0c3e8db5c3\kenessey.txt
- %TEMP%\e5-b2e49-7df-7b5be-20a0c3e8db5c3\hyvidodumi.exe
- %TEMP%\e5-b2e49-7df-7b5be-20a0c3e8db5c3\hyvidodumi.exe.config
- %ProgramFiles(x86)%\i-record\is-420nf.tmp
- %ProgramFiles(x86)%\i-record\is-3g1et.tmp
- %ProgramFiles(x86)%\i-record\is-2tjje.tmp
- %ProgramFiles(x86)%\i-record\is-pemlj.tmp
- %ProgramFiles(x86)%\i-record\is-8kk9f.tmp
- %ProgramFiles(x86)%\i-record\is-fbo0n.tmp
- %ProgramFiles(x86)%\i-record\is-sicfj.tmp
- %ProgramFiles(x86)%\i-record\is-8fhkk.tmp
- %TEMP%\is-1bmd3.tmp\_isetup\_shfoldr.dll
- %ProgramFiles(x86)%\i-record\is-nvngr.tmp
- %TEMP%\is-rfhrh.tmp\irecord.tmp
- %ProgramFiles%\gcasserv\ttwxqwhzdh\irecord.exe.config
- %ProgramFiles%\gcasserv\ttwxqwhzdh\irecord.exe
- %TEMP%\is-4n2es.tmp\rec_12.exe
- %TEMP%\is-4n2es.tmp\idp.dll
- %TEMP%\is-4n2es.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-4n2es.tmp\_isetup\_setup64.tmp
- %ProgramFiles(x86)%\uninstall information\sudyzhetoga.exe
- %ProgramFiles(x86)%\uninstall information\sudyzhetoga.exe.config
Deletes the following files
- %TEMP%\is-1bmd3.tmp\_isetup\_setup64.tmp
- %TEMP%\is-1bmd3.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-rfhrh.tmp\irecord.tmp
- %TEMP%\is-4n2es.tmp\idp.dll
- %TEMP%\is-4n2es.tmp\rec_12.exe
- %TEMP%\is-4n2es.tmp\_isetup\_setup64.tmp
- %TEMP%\is-4n2es.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-khsai.tmp\<File name>.tmp
Moves the following files
- from %ProgramFiles(x86)%\i-record\is-8fhkk.tmp to %ProgramFiles(x86)%\i-record\unins000.exe
- from %ProgramFiles(x86)%\i-record\is-sicfj.tmp to %ProgramFiles(x86)%\i-record\i-record.exe
- from %ProgramFiles(x86)%\i-record\is-fbo0n.tmp to %ProgramFiles(x86)%\i-record\aforge.video.dll
- from %ProgramFiles(x86)%\i-record\is-8kk9f.tmp to %ProgramFiles(x86)%\i-record\aforge.video.ffmpeg.dll
- from %ProgramFiles(x86)%\i-record\is-pemlj.tmp to %ProgramFiles(x86)%\i-record\avcodec-53.dll
- from %ProgramFiles(x86)%\i-record\is-2tjje.tmp to %ProgramFiles(x86)%\i-record\avdevice-53.dll
- from %ProgramFiles(x86)%\i-record\is-3g1et.tmp to %ProgramFiles(x86)%\i-record\avfilter-2.dll
- from %ProgramFiles(x86)%\i-record\is-420nf.tmp to %ProgramFiles(x86)%\i-record\avformat-53.dll
- from %ProgramFiles(x86)%\i-record\is-8g6uf.tmp to %ProgramFiles(x86)%\i-record\avutil-51.dll
- from %ProgramFiles(x86)%\i-record\is-h0veo.tmp to %ProgramFiles(x86)%\i-record\bunifu_ui_v1.52.dll
- from %ProgramFiles(x86)%\i-record\is-hr12c.tmp to %ProgramFiles(x86)%\i-record\linqbridge.dll
- from %ProgramFiles(x86)%\i-record\is-i6kfo.tmp to %ProgramFiles(x86)%\i-record\postproc-52.dll
- from %ProgramFiles(x86)%\i-record\is-c2mav.tmp to %ProgramFiles(x86)%\i-record\i-record.exe.config
- from %ProgramFiles(x86)%\i-record\is-2pbc7.tmp to %ProgramFiles(x86)%\i-record\swresample-0.dll
- from %ProgramFiles(x86)%\i-record\is-nvngr.tmp to %ProgramFiles(x86)%\i-record\swscale-2.dll
Network activity
Connects to
- 'i-######.#3-eu-west-1.amazonaws.com':80
- 'co###ctini.net':443
- 'microsoft.com':80
- 'i-######.#3-eu-west-1.amazonaws.com':443
- 'la#########.s3.eu-north-1.amazonaws.com':443
- 'x.##2.us':80
- 'po####ack-url.com':80
- 'google.com':80
TCP
HTTP POST requests
- http://po####ack-url.com/temptrack/Store
UDP
- DNS ASK i-######.#3-eu-west-1.amazonaws.com
- DNS ASK co###ctini.net
- DNS ASK microsoft.com
- DNS ASK la#########.s3.eu-north-1.amazonaws.com
- DNS ASK x.##2.us
- DNS ASK po####ack-url.com
- DNS ASK google.com
Miscellaneous
Creates and executes the following
- '%TEMP%\is-khsai.tmp\<File name>.tmp' /SL5="$B021E,239334,155648,<Full path to file>"
- '%TEMP%\is-4n2es.tmp\rec_12.exe' /S /UID=lylal220
- '%ProgramFiles%\gcasserv\ttwxqwhzdh\irecord.exe' /VERYSILENT
- '%TEMP%\is-rfhrh.tmp\irecord.tmp' /SL5="$C0146,6265333,408064,%ProgramFiles%\gcasServ\TTWXQWHZDH\irecord.exe" /VERYSILENT
- '%TEMP%\bd-0278e-fcb-6afbe-3db001630a21e\govomesuhe.exe'
- '%TEMP%\e5-b2e49-7df-7b5be-20a0c3e8db5c3\hyvidodumi.exe'
- '%TEMP%\is-4n2es.tmp\rec_12.exe' /S /UID=lylal220' (with hidden window)
- '<SYSTEM32>\cmd.exe' /k %TEMP%\ybjl1glb.a2o\gaooo.exe & exit' (with hidden window)
- '%TEMP%\jfiag3g_gg.exe' /scookiestxt %TEMP%\fj4ghga23_fsa.txt' (with hidden window)
Executes the following
- '%ProgramFiles(x86)%\internet explorer\iexplore.exe' https://www.pr#######etrustednetwork.com/e2q8zu9hu?ke##################################
- '<SYSTEM32>\cmd.exe' /k %TEMP%\ybjl1glb.a2o\gaooo.exe & exit
