Technical Information
Modifies file system
Creates the following files
- %TEMP%\tsu-087c.dll
- %TEMP%\_tin0822.bat
- %TEMP%\{c4b5fa91-918d-5610-60e9-95b0c0990bec}\x64\regsvr32.exe
- %TEMP%\{c4b5fa91-918d-5610-60e9-95b0c0990bec}\x86\regsvr32.exe
- %ALLUSERSPROFILE%\installmate\{16782e9c-e344-47bd-a045-b9ba79870632}\tsudll.dll
- %ALLUSERSPROFILE%\installmate\{16782e9c-e344-47bd-a045-b9ba79870632}\setup.exe
- %ALLUSERSPROFILE%\installmate\{16782e9c-e344-47bd-a045-b9ba79870632}\_setupx.dll
- %ALLUSERSPROFILE%\installmate\{16782e9c-e344-47bd-a045-b9ba79870632}\setup.ico
- %ALLUSERSPROFILE%\installmate\{16782e9c-e344-47bd-a045-b9ba79870632}\_setup.dll
- %ALLUSERSPROFILE%\installmate\36024082\cfg\1.ini.tmp
- %TEMP%\{c4b5fa91-918d-5610-60e9-95b0c0990bec}\setup.exe
- %TEMP%\{c4b5fa91-918d-5610-60e9-95b0c0990bec}\_setupx.dll
- %TEMP%\{c4b5fa91-918d-5610-60e9-95b0c0990bec}\setup.ico
- %TEMP%\{c4b5fa91-918d-5610-60e9-95b0c0990bec}\_setup.dll
- %TEMP%\36024082.dat
- %TEMP%\<File name>.log
- %TEMP%\_tinf4e9.bat
- %ALLUSERSPROFILE%\installmate\{16782e9c-e344-47bd-a045-b9ba79870632}\setup.dat
Sets the 'hidden' attribute to the following files
- %TEMP%\tsu-087c.dll
- %TEMP%\36024082.dat
- %TEMP%\{c4b5fa91-918d-5610-60e9-95b0c0990bec}\_setup.dll
- %TEMP%\{c4b5fa91-918d-5610-60e9-95b0c0990bec}\setup.ico
- %TEMP%\{c4b5fa91-918d-5610-60e9-95b0c0990bec}\_setupx.dll
- %TEMP%\{c4b5fa91-918d-5610-60e9-95b0c0990bec}\setup.exe
- %ALLUSERSPROFILE%\installmate\{16782e9c-e344-47bd-a045-b9ba79870632}\setup.dat
Deletes the following files
- %TEMP%\36024082.dat
- %ALLUSERSPROFILE%\installmate\36024082\cfg\1.ini
- %TEMP%\_tin0822.bat
- %TEMP%\_tinf4e9.bat
- %TEMP%\{c4b5fa91-918d-5610-60e9-95b0c0990bec}\setup.ico
- %TEMP%\{c4b5fa91-918d-5610-60e9-95b0c0990bec}\setup.exe
- %TEMP%\{c4b5fa91-918d-5610-60e9-95b0c0990bec}\_setupx.dll
- %TEMP%\{c4b5fa91-918d-5610-60e9-95b0c0990bec}\_setup.dll
- %TEMP%\{c4b5fa91-918d-5610-60e9-95b0c0990bec}\x64\regsvr32.exe
- %TEMP%\{c4b5fa91-918d-5610-60e9-95b0c0990bec}\x86\regsvr32.exe
- %TEMP%\tsu-087c.dll
Moves the following files
- from %ALLUSERSPROFILE%\installmate\36024082\cfg\1.ini.tmp to %ALLUSERSPROFILE%\installmate\36024082\cfg\1.ini
- from %TEMP%\<File name>.log to %ALLUSERSPROFILE%\installmate\{16782e9c-e344-47bd-a045-b9ba79870632}\20220531194247.log
Network activity
Connects to
- 'nl###rage.info':80
TCP
HTTP GET requests
- http://www.nl###rage.info/installmate/php/get_cfg.php?st#########################################################################################################################################
HTTP POST requests
- http://www.nl###rage.info/installmate/php/track_installer_products.php?in##################
UDP
- DNS ASK nl###rage.info
Miscellaneous
Searches for the following windows
- ClassName: 'TSUWNDW' WindowName: ''
Creates and executes the following
- '%WINDIR%\syswow64\cmd.exe' /c "%TEMP%\_tin0822.bat"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c "%TEMP%\_tinF4E9.bat"' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c "%TEMP%\_tin0822.bat"
- '%WINDIR%\syswow64\cmd.exe' /c "%TEMP%\_tinF4E9.bat"
