Technical Information
Modifies file system
Creates the following files
- %TEMP%\is-r25v9.tmp\<File name>.tmp
- %ProgramFiles(x86)%\debitis\sit\is-dpi32.tmp
- %ProgramFiles(x86)%\debitis\sit\is-15bfu.tmp
- %ProgramFiles(x86)%\debitis\sit\is-kgslu.tmp
- %ProgramFiles(x86)%\debitis\sit\is-378k0.tmp
- %ProgramFiles(x86)%\debitis\sit\is-bf9ql.tmp
- %ProgramFiles(x86)%\debitis\sit\is-9g87l.tmp
- %ProgramFiles(x86)%\debitis\sit\is-pm5ug.tmp
- %ProgramFiles(x86)%\debitis\necessitatibus\is-3oldg.tmp
- %ProgramFiles(x86)%\debitis\necessitatibus\is-3a31v.tmp
- %ProgramFiles(x86)%\debitis\necessitatibus\is-rs7ig.tmp
- %ProgramFiles(x86)%\debitis\magni\is-d40qs.tmp
- %ProgramFiles(x86)%\debitis\sit\is-ht9p0.tmp
- %ProgramFiles(x86)%\debitis\magni\is-pun7p.tmp
- %ProgramFiles(x86)%\debitis\consequatur\is-isjco.tmp
- %ProgramFiles(x86)%\debitis\consequatur\is-b37aa.tmp
- %ProgramFiles(x86)%\debitis\consequatur\is-mob92.tmp
- %ProgramFiles(x86)%\debitis\consequatur\is-akn8m.tmp
- %ProgramFiles(x86)%\debitis\consequatur\is-le0ml.tmp
- %ProgramFiles(x86)%\debitis\consequatur\is-j0s03.tmp
- %ProgramFiles(x86)%\debitis\is-fnmrk.tmp
- %ProgramFiles(x86)%\debitis\is-e6luj.tmp
- %TEMP%\is-cmhke.tmp\_isetup\_iscrypt.dll
- %TEMP%\is-cmhke.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-cmhke.tmp\_isetup\_setup64.tmp
- %ProgramFiles(x86)%\debitis\illo\is-4en67.tmp
- %ProgramFiles(x86)%\debitis\unins000.dat
Moves the following files
- from %ProgramFiles(x86)%\debitis\is-e6luj.tmp to %ProgramFiles(x86)%\debitis\unins000.exe
- from %ProgramFiles(x86)%\debitis\sit\is-15bfu.tmp to %ProgramFiles(x86)%\debitis\sit\unde.wps
- from %ProgramFiles(x86)%\debitis\sit\is-kgslu.tmp to %ProgramFiles(x86)%\debitis\sit\sunt.pif
- from %ProgramFiles(x86)%\debitis\sit\is-378k0.tmp to %ProgramFiles(x86)%\debitis\sit\ratione.wps
- from %ProgramFiles(x86)%\debitis\sit\is-bf9ql.tmp to %ProgramFiles(x86)%\debitis\sit\praesentium.exe
- from %ProgramFiles(x86)%\debitis\sit\is-9g87l.tmp to %ProgramFiles(x86)%\debitis\sit\nulla.rar
- from %ProgramFiles(x86)%\debitis\sit\is-pm5ug.tmp to %ProgramFiles(x86)%\debitis\sit\libero.wav
- from %ProgramFiles(x86)%\debitis\necessitatibus\is-3oldg.tmp to %ProgramFiles(x86)%\debitis\necessitatibus\qui.sdf
- from %ProgramFiles(x86)%\debitis\necessitatibus\is-3a31v.tmp to %ProgramFiles(x86)%\debitis\necessitatibus\numquam.htm
- from %ProgramFiles(x86)%\debitis\necessitatibus\is-rs7ig.tmp to %ProgramFiles(x86)%\debitis\necessitatibus\accusamus.pdf
- from %ProgramFiles(x86)%\debitis\magni\is-d40qs.tmp to %ProgramFiles(x86)%\debitis\magni\sint.bin
- from %ProgramFiles(x86)%\debitis\magni\is-pun7p.tmp to %ProgramFiles(x86)%\debitis\magni\atque.tex
- from %ProgramFiles(x86)%\debitis\illo\is-4en67.tmp to %ProgramFiles(x86)%\debitis\illo\sequi.wav
- from %ProgramFiles(x86)%\debitis\consequatur\is-isjco.tmp to %ProgramFiles(x86)%\debitis\consequatur\sequi.avi
- from %ProgramFiles(x86)%\debitis\consequatur\is-b37aa.tmp to %ProgramFiles(x86)%\debitis\consequatur\sed.pps
- from %ProgramFiles(x86)%\debitis\consequatur\is-mob92.tmp to %ProgramFiles(x86)%\debitis\consequatur\repellendus.txt
- from %ProgramFiles(x86)%\debitis\consequatur\is-akn8m.tmp to %ProgramFiles(x86)%\debitis\consequatur\eum.mp4
- from %ProgramFiles(x86)%\debitis\consequatur\is-le0ml.tmp to %ProgramFiles(x86)%\debitis\consequatur\doloribus.wav
- from %ProgramFiles(x86)%\debitis\consequatur\is-j0s03.tmp to %ProgramFiles(x86)%\debitis\consequatur\assumenda.pif
- from %ProgramFiles(x86)%\debitis\is-fnmrk.tmp to %ProgramFiles(x86)%\debitis\recusandae.7z
- from %ProgramFiles(x86)%\debitis\sit\is-dpi32.tmp to %ProgramFiles(x86)%\debitis\sit\ut.7z
- from %ProgramFiles(x86)%\debitis\sit\is-ht9p0.tmp to %ProgramFiles(x86)%\debitis\sit\sqlite3.dll
Network activity
TCP
HTTP POST requests
- http://cl###etapi.com/v2/events
UDP
- DNS ASK cl###etapi.com
Miscellaneous
Searches for the following windows
- ClassName: 'B54438F9-015B-469E-ABA7-B99A25458983' WindowName: ''
Creates and executes the following
- '%TEMP%\is-r25v9.tmp\<File name>.tmp' /SL5="$150224,3424025,140800,<Full path to file>"
- '%ProgramFiles(x86)%\debitis\sit\praesentium.exe' 59a8341fd550c4c7993208ded469acd5
