Technical Information
Modifies file system
Creates the following files
- %TEMP%\is-4erpj.tmp\<File name>.tmp
- %ProgramFiles(x86)%\rbit\rbit fighter 7\is-ocvr8.tmp
- %ProgramFiles(x86)%\rbit\rbit fighter 7\is-eo81l.tmp
- %ProgramFiles(x86)%\rbit\rbit fighter 7\is-cn8fv.tmp
- %ProgramFiles(x86)%\rbit\rbit fighter 7\is-ja7up.tmp
- %ProgramFiles(x86)%\rbit\rbit fighter 7\is-0fvd2.tmp
- %ProgramFiles(x86)%\rbit\rbit fighter 7\is-1qv9p.tmp
- %ProgramFiles(x86)%\rbit\rbit fighter 7\is-pms3l.tmp
- %ProgramFiles(x86)%\rbit\rbit fighter 7\is-id6o5.tmp
- %ProgramFiles(x86)%\rbit\rbit fighter 7\is-me8v1.tmp
- %ProgramFiles(x86)%\rbit\rbit fighter 7\is-6it2k.tmp
- %ProgramFiles(x86)%\rbit\rbit fighter 7\is-1fmqr.tmp
- %ProgramFiles(x86)%\rbit\rbit fighter 7\is-qa9j5.tmp
- %ProgramFiles(x86)%\rbit\rbit fighter 7\action center\is-nb98t.tmp
- %ProgramFiles(x86)%\rbit\rbit fighter 7\is-f0p2u.tmp
- %ProgramFiles(x86)%\rbit\rbit fighter 7\is-ok77a.tmp
- %ProgramFiles(x86)%\rbit\rbit fighter 7\is-e7h8e.tmp
- %ProgramFiles(x86)%\rbit\rbit fighter 7\is-ols6d.tmp
- %ProgramFiles(x86)%\rbit\rbit fighter 7\is-q2mld.tmp
- %ProgramFiles(x86)%\rbit\rbit fighter 7\is-jtlup.tmp
- %ProgramFiles(x86)%\rbit\rbit fighter 7\is-gh14q.tmp
- %ProgramFiles(x86)%\rbit\rbit fighter 7\is-2fan9.tmp
- %ProgramFiles(x86)%\rbit\rbit fighter 7\is-ej927.tmp
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\rbit fighter 7\rbit fighter 7.lnk
- %ProgramFiles(x86)%\rbit\rbit fighter 7\is-d8pi2.tmp
- %ProgramFiles(x86)%\rbit\rbit fighter 7\is-6velq.tmp
- %TEMP%\is-4gcpn.tmp\_isetup\_setup64.tmp
- %TEMP%\is-4gcpn.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-4gcpn.tmp\_isetup\_isdecmp.dll
- %TEMP%\is-4gcpn.tmp\_isetup\_iscrypt.dll
- %ProgramFiles(x86)%\rbit\rbit fighter 7\is-ccrli.tmp
- %ProgramFiles(x86)%\rbit\rbit fighter 7\is-crosv.tmp
- %ProgramFiles(x86)%\rbit\rbit fighter 7\is-vdhf9.tmp
- %ProgramFiles(x86)%\rbit\rbit fighter 7\is-kvkd2.tmp
- %ProgramFiles(x86)%\rbit\rbit fighter 7\is-b2jd7.tmp
- %ProgramFiles(x86)%\rbit\rbit fighter 7\is-sf86b.tmp
- %ProgramFiles(x86)%\rbit\rbit fighter 7\is-o3ot5.tmp
- %ProgramFiles(x86)%\rbit\rbit fighter 7\is-fm0dd.tmp
- %ProgramFiles(x86)%\rbit\rbit fighter 7\language\is-uhhlv.tmp
- %ProgramFiles(x86)%\rbit\rbit fighter 7\is-ssal3.tmp
- %ProgramFiles(x86)%\rbit\rbit fighter 7\is-jjslv.tmp
- %ProgramFiles(x86)%\rbit\rbit fighter 7\is-ev8kh.tmp
- %ProgramFiles(x86)%\rbit\rbit fighter 7\is-o65gi.tmp
- %ProgramFiles(x86)%\rbit\rbit fighter 7\is-0q3d0.tmp
- %ProgramFiles(x86)%\rbit\rbit fighter 7\is-id4cg.tmp
- %ProgramFiles(x86)%\rbit\rbit fighter 7\is-rib05.tmp
- %ProgramFiles(x86)%\rbit\rbit fighter 7\is-r8shn.tmp
- %ProgramFiles(x86)%\rbit\rbit fighter 7\is-e1l7f.tmp
- %ProgramFiles(x86)%\rbit\rbit fighter 7\unins000.dat
Moves the following files
- from %ProgramFiles(x86)%\rbit\rbit fighter 7\is-ccrli.tmp to %ProgramFiles(x86)%\rbit\rbit fighter 7\unins000.exe
- from %ProgramFiles(x86)%\rbit\rbit fighter 7\is-ja7up.tmp to %ProgramFiles(x86)%\rbit\rbit fighter 7\imfefsfctl.dll
- from %ProgramFiles(x86)%\rbit\rbit fighter 7\is-0fvd2.tmp to %ProgramFiles(x86)%\rbit\rbit fighter 7\history.txt
- from %ProgramFiles(x86)%\rbit\rbit fighter 7\is-1qv9p.tmp to %ProgramFiles(x86)%\rbit\rbit fighter 7\imfhpfilectl.dll
- from %ProgramFiles(x86)%\rbit\rbit fighter 7\is-pms3l.tmp to %ProgramFiles(x86)%\rbit\rbit fighter 7\imfhprgfpctl.dll
- from %ProgramFiles(x86)%\rbit\rbit fighter 7\is-id6o5.tmp to %ProgramFiles(x86)%\rbit\rbit fighter 7\imfrgfpctl.dll
- from %ProgramFiles(x86)%\rbit\rbit fighter 7\is-me8v1.tmp to %ProgramFiles(x86)%\rbit\rbit fighter 7\fuzzy.dll
- from %ProgramFiles(x86)%\rbit\rbit fighter 7\is-6it2k.tmp to %ProgramFiles(x86)%\rbit\rbit fighter 7\imfscancontrol.dll
- from %ProgramFiles(x86)%\rbit\rbit fighter 7\is-jjslv.tmp to %ProgramFiles(x86)%\rbit\rbit fighter 7\locallang.exe
- from %ProgramFiles(x86)%\rbit\rbit fighter 7\is-1fmqr.tmp to %ProgramFiles(x86)%\rbit\rbit fighter 7\imfscanner.dll
- from %ProgramFiles(x86)%\rbit\rbit fighter 7\action center\is-nb98t.tmp to %ProgramFiles(x86)%\rbit\rbit fighter 7\action center\aomei.png
- from %ProgramFiles(x86)%\rbit\rbit fighter 7\is-f0p2u.tmp to %ProgramFiles(x86)%\rbit\rbit fighter 7\scanner.dll
- from %ProgramFiles(x86)%\rbit\rbit fighter 7\is-ok77a.tmp to %ProgramFiles(x86)%\rbit\rbit fighter 7\updatedll.dll
- from %ProgramFiles(x86)%\rbit\rbit fighter 7\is-e7h8e.tmp to %ProgramFiles(x86)%\rbit\rbit fighter 7\imffd.dll
- from %ProgramFiles(x86)%\rbit\rbit fighter 7\is-ols6d.tmp to %ProgramFiles(x86)%\rbit\rbit fighter 7\cub.dbd
- from %ProgramFiles(x86)%\rbit\rbit fighter 7\is-q2mld.tmp to %ProgramFiles(x86)%\rbit\rbit fighter 7\giftbox.dll
- from %ProgramFiles(x86)%\rbit\rbit fighter 7\is-jtlup.tmp to %ProgramFiles(x86)%\rbit\rbit fighter 7\imf.exe
- from %ProgramFiles(x86)%\rbit\rbit fighter 7\is-eo81l.tmp to %ProgramFiles(x86)%\rbit\rbit fighter 7\imfdownprotectl.dll
- from %ProgramFiles(x86)%\rbit\rbit fighter 7\is-cn8fv.tmp to %ProgramFiles(x86)%\rbit\rbit fighter 7\imfpp.dll
- from %ProgramFiles(x86)%\rbit\rbit fighter 7\is-ocvr8.tmp to %ProgramFiles(x86)%\rbit\rbit fighter 7\dwfilectl.dll
- from %ProgramFiles(x86)%\rbit\rbit fighter 7\is-ej927.tmp to %ProgramFiles(x86)%\rbit\rbit fighter 7\bdshook.dll
- from %ProgramFiles(x86)%\rbit\rbit fighter 7\is-d8pi2.tmp to %ProgramFiles(x86)%\rbit\rbit fighter 7\filectl.dll
- from %ProgramFiles(x86)%\rbit\rbit fighter 7\is-vdhf9.tmp to %ProgramFiles(x86)%\rbit\rbit fighter 7\madbasic_.bpl
- from %ProgramFiles(x86)%\rbit\rbit fighter 7\is-kvkd2.tmp to %ProgramFiles(x86)%\rbit\rbit fighter 7\maddisasm_.bpl
- from %ProgramFiles(x86)%\rbit\rbit fighter 7\is-b2jd7.tmp to %ProgramFiles(x86)%\rbit\rbit fighter 7\madexcept_.bpl
- from %ProgramFiles(x86)%\rbit\rbit fighter 7\is-sf86b.tmp to %ProgramFiles(x86)%\rbit\rbit fighter 7\fdptctl.dll
- from %ProgramFiles(x86)%\rbit\rbit fighter 7\is-o3ot5.tmp to %ProgramFiles(x86)%\rbit\rbit fighter 7\iwsimf_av10.exe
- from %ProgramFiles(x86)%\rbit\rbit fighter 7\is-fm0dd.tmp to %ProgramFiles(x86)%\rbit\rbit fighter 7\detectionex.ini
- from %ProgramFiles(x86)%\rbit\rbit fighter 7\language\is-uhhlv.tmp to %ProgramFiles(x86)%\rbit\rbit fighter 7\language\english.lng
- from %ProgramFiles(x86)%\rbit\rbit fighter 7\is-gh14q.tmp to %ProgramFiles(x86)%\rbit\rbit fighter 7\wmfdist.exe
- from %ProgramFiles(x86)%\rbit\rbit fighter 7\is-qa9j5.tmp to %ProgramFiles(x86)%\rbit\rbit fighter 7\pluginhelper.dll
- from %ProgramFiles(x86)%\rbit\rbit fighter 7\is-ssal3.tmp to %ProgramFiles(x86)%\rbit\rbit fighter 7\spurlscanner.dll
- from %ProgramFiles(x86)%\rbit\rbit fighter 7\is-o65gi.tmp to %ProgramFiles(x86)%\rbit\rbit fighter 7\winid.dat
- from %ProgramFiles(x86)%\rbit\rbit fighter 7\is-0q3d0.tmp to %ProgramFiles(x86)%\rbit\rbit fighter 7\reprocess.exe
- from %ProgramFiles(x86)%\rbit\rbit fighter 7\is-id4cg.tmp to %ProgramFiles(x86)%\rbit\rbit fighter 7\webres.dll
- from %ProgramFiles(x86)%\rbit\rbit fighter 7\is-rib05.tmp to %ProgramFiles(x86)%\rbit\rbit fighter 7\infohelp.dll
- from %ProgramFiles(x86)%\rbit\rbit fighter 7\is-r8shn.tmp to %ProgramFiles(x86)%\rbit\rbit fighter 7\defbit.db
- from %ProgramFiles(x86)%\rbit\rbit fighter 7\is-6velq.tmp to %ProgramFiles(x86)%\rbit\rbit fighter 7\cameractl.dll
- from %ProgramFiles(x86)%\rbit\rbit fighter 7\is-e1l7f.tmp to %ProgramFiles(x86)%\rbit\rbit fighter 7\libssl-1_1.dll
- from %ProgramFiles(x86)%\rbit\rbit fighter 7\is-crosv.tmp to %ProgramFiles(x86)%\rbit\rbit fighter 7\vclx120.bpl
- from %ProgramFiles(x86)%\rbit\rbit fighter 7\is-ev8kh.tmp to %ProgramFiles(x86)%\rbit\rbit fighter 7\lang.dat
- from %ProgramFiles(x86)%\rbit\rbit fighter 7\is-2fan9.tmp to %ProgramFiles(x86)%\rbit\rbit fighter 7\sqlite3.dll
Network activity
Connects to
- 'op###olad.com':80
TCP
HTTP POST requests
- http://op###olad.com/v2/events
UDP
- DNS ASK op###olad.com
Miscellaneous
Searches for the following windows
- ClassName: '42e401d2-fb7a-11dc-ba4a-fe7ab000f428' WindowName: ''
Creates and executes the following
- '%TEMP%\is-4erpj.tmp\<File name>.tmp' /SL5="$D0232,12792426,74752,<Full path to file>"
- '%ProgramFiles(x86)%\rbit\rbit fighter 7\wmfdist.exe' /Q:A /R:N
- '%ProgramFiles(x86)%\rbit\rbit fighter 7\imf.exe' <File name>.exe
