Technical Information
Modifies file system
Creates the following files
- %TEMP%\is-b1udo.tmp\<File name>.tmp
- %ProgramFiles(x86)%\sed\voluptas\is-fahpi.tmp
- %ProgramFiles(x86)%\sed\voluptas\is-gd8r9.tmp
- %ProgramFiles(x86)%\sed\similique\is-s70e2.tmp
- %ProgramFiles(x86)%\sed\similique\is-isdo2.tmp
- %ProgramFiles(x86)%\sed\similique\is-bu8ra.tmp
- %ProgramFiles(x86)%\sed\est\is-em3fe.tmp
- %ProgramFiles(x86)%\sed\blanditiis\is-jv7jg.tmp
- %ProgramFiles(x86)%\sed\blanditiis\is-8nsbc.tmp
- %ProgramFiles(x86)%\sed\blanditiis\is-7rgv0.tmp
- %ProgramFiles(x86)%\sed\blanditiis\is-s7k75.tmp
- %ProgramFiles(x86)%\sed\autem\is-4ecme.tmp
- %ProgramFiles(x86)%\sed\autem\is-hnm1b.tmp
- %ProgramFiles(x86)%\sed\is-r8acp.tmp
- %ProgramFiles(x86)%\sed\is-prvtn.tmp
- %ProgramFiles(x86)%\sed\is-ie295.tmp
- %ProgramFiles(x86)%\sed\is-l69n9.tmp
- %ProgramFiles(x86)%\sed\is-42mgv.tmp
- %ProgramFiles(x86)%\sed\is-aki2b.tmp
- %TEMP%\is-p591s.tmp\_isetup\_iscrypt.dll
- %TEMP%\is-p591s.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-p591s.tmp\_isetup\_setup64.tmp
- %ProgramFiles(x86)%\sed\voluptas\is-an0u8.tmp
- %ProgramFiles(x86)%\sed\unins000.dat
Moves the following files
- from %ProgramFiles(x86)%\sed\is-aki2b.tmp to %ProgramFiles(x86)%\sed\unins000.exe
- from %ProgramFiles(x86)%\sed\voluptas\is-gd8r9.tmp to %ProgramFiles(x86)%\sed\voluptas\commodi.bat
- from %ProgramFiles(x86)%\sed\similique\is-s70e2.tmp to %ProgramFiles(x86)%\sed\similique\officia.msi
- from %ProgramFiles(x86)%\sed\similique\is-isdo2.tmp to %ProgramFiles(x86)%\sed\similique\ipsa.pps
- from %ProgramFiles(x86)%\sed\similique\is-bu8ra.tmp to %ProgramFiles(x86)%\sed\similique\consequatur.html
- from %ProgramFiles(x86)%\sed\est\is-em3fe.tmp to %ProgramFiles(x86)%\sed\est\in.bin
- from %ProgramFiles(x86)%\sed\blanditiis\is-jv7jg.tmp to %ProgramFiles(x86)%\sed\blanditiis\sqlite3.dll
- from %ProgramFiles(x86)%\sed\blanditiis\is-8nsbc.tmp to %ProgramFiles(x86)%\sed\blanditiis\voluptatem.exe
- from %ProgramFiles(x86)%\sed\voluptas\is-fahpi.tmp to %ProgramFiles(x86)%\sed\voluptas\eos.wav
- from %ProgramFiles(x86)%\sed\blanditiis\is-7rgv0.tmp to %ProgramFiles(x86)%\sed\blanditiis\fugit.pps
- from %ProgramFiles(x86)%\sed\autem\is-4ecme.tmp to %ProgramFiles(x86)%\sed\autem\quidem.rar
- from %ProgramFiles(x86)%\sed\autem\is-hnm1b.tmp to %ProgramFiles(x86)%\sed\autem\enim.dat
- from %ProgramFiles(x86)%\sed\is-r8acp.tmp to %ProgramFiles(x86)%\sed\quia.7z
- from %ProgramFiles(x86)%\sed\is-prvtn.tmp to %ProgramFiles(x86)%\sed\modi.png
- from %ProgramFiles(x86)%\sed\is-ie295.tmp to %ProgramFiles(x86)%\sed\ipsam.mp4
- from %ProgramFiles(x86)%\sed\is-l69n9.tmp to %ProgramFiles(x86)%\sed\exercitationem.dat
- from %ProgramFiles(x86)%\sed\is-42mgv.tmp to %ProgramFiles(x86)%\sed\dicta.zip
- from %ProgramFiles(x86)%\sed\blanditiis\is-s7k75.tmp to %ProgramFiles(x86)%\sed\blanditiis\fugiat.avi
- from %ProgramFiles(x86)%\sed\voluptas\is-an0u8.tmp to %ProgramFiles(x86)%\sed\voluptas\omnis.sdf
Network activity
TCP
HTTP POST requests
- http://cl###etapi.com/v2/events
UDP
- DNS ASK cl###etapi.com
Miscellaneous
Searches for the following windows
- ClassName: 'DD4666AA-0EFA-46C9-923A-8F26B49D3A3B' WindowName: ''
Creates and executes the following
- '%TEMP%\is-b1udo.tmp\<File name>.tmp' /SL5="$100232,2687332,114176,<Full path to file>"
- '%ProgramFiles(x86)%\sed\blanditiis\voluptatem.exe' eab193d31e94d4dfa1700fe14eeea441
