Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run\] 'GenericTools' = '%LOCALAPPDATA%\GenericTools\GenericTools.exe'
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run\] 'SiSoft' = '%LOCALAPPDATA%\GenericTools\SiSoft.exe'
Modifies file system
Creates the following files
- %TEMP%\is-mqvbv.tmp\<File name>.tmp
- %LOCALAPPDATA%\generictools\imageformats\is-fckle.tmp
- %LOCALAPPDATA%\generictools\imageformats\is-oqkt5.tmp
- %LOCALAPPDATA%\generictools\imageformats\is-c8enu.tmp
- %LOCALAPPDATA%\generictools\imageformats\is-jmali.tmp
- %LOCALAPPDATA%\generictools\imageformats\is-isj6n.tmp
- %LOCALAPPDATA%\generictools\is-ai8cd.tmp
- %LOCALAPPDATA%\generictools\is-r9k16.tmp
- %LOCALAPPDATA%\generictools\is-uem80.tmp
- %LOCALAPPDATA%\generictools\is-sprf0.tmp
- %LOCALAPPDATA%\generictools\imageformats\is-q0066.tmp
- %LOCALAPPDATA%\generictools\is-k6p9s.tmp
- %LOCALAPPDATA%\generictools\is-butgp.tmp
- %LOCALAPPDATA%\generictools\is-koaoi.tmp
- %LOCALAPPDATA%\generictools\is-j9iap.tmp
- %LOCALAPPDATA%\generictools\is-dq7ms.tmp
- %LOCALAPPDATA%\generictools\is-uptn4.tmp
- %LOCALAPPDATA%\generictools\is-itohk.tmp
- %TEMP%\is-8o9oc.tmp\_isetup\_setup64.tmp
- %TEMP%\is-8glkp.tmp\<File name>.tmp
- %TEMP%\is-4vhhm.tmp\_isetup\_setup64.tmp
- %LOCALAPPDATA%\generictools\is-faua3.tmp
- %LOCALAPPDATA%\generictools\imageformats\is-7v1e3.tmp
Deletes the following files
- %TEMP%\is-4vhhm.tmp\_isetup\_setup64.tmp
- %TEMP%\is-mqvbv.tmp\<File name>.tmp
Moves the following files
- from %LOCALAPPDATA%\generictools\is-itohk.tmp to %LOCALAPPDATA%\generictools\generictools.exe
- from %LOCALAPPDATA%\generictools\imageformats\is-fckle.tmp to %LOCALAPPDATA%\generictools\imageformats\qsvg4.dll
- from %LOCALAPPDATA%\generictools\imageformats\is-oqkt5.tmp to %LOCALAPPDATA%\generictools\imageformats\qmng4.dll
- from %LOCALAPPDATA%\generictools\imageformats\is-c8enu.tmp to %LOCALAPPDATA%\generictools\imageformats\qjpeg4.dll
- from %LOCALAPPDATA%\generictools\imageformats\is-jmali.tmp to %LOCALAPPDATA%\generictools\imageformats\qico4.dll
- from %LOCALAPPDATA%\generictools\imageformats\is-isj6n.tmp to %LOCALAPPDATA%\generictools\imageformats\qgif4.dll
- from %LOCALAPPDATA%\generictools\is-ai8cd.tmp to %LOCALAPPDATA%\generictools\libcurl.dll
- from %LOCALAPPDATA%\generictools\is-r9k16.tmp to %LOCALAPPDATA%\generictools\qtscript4.dll
- from %LOCALAPPDATA%\generictools\imageformats\is-q0066.tmp to %LOCALAPPDATA%\generictools\imageformats\qtga4.dll
- from %LOCALAPPDATA%\generictools\is-uem80.tmp to %LOCALAPPDATA%\generictools\qtwebkit4.dll
- from %LOCALAPPDATA%\generictools\is-k6p9s.tmp to %LOCALAPPDATA%\generictools\msvcr100.dll
- from %LOCALAPPDATA%\generictools\is-faua3.tmp to %LOCALAPPDATA%\generictools\msvcp100.dll
- from %LOCALAPPDATA%\generictools\is-butgp.tmp to %LOCALAPPDATA%\generictools\qtnetwork4.dll
- from %LOCALAPPDATA%\generictools\is-koaoi.tmp to %LOCALAPPDATA%\generictools\qtgui4.dll
- from %LOCALAPPDATA%\generictools\is-j9iap.tmp to %LOCALAPPDATA%\generictools\qtcore4.dll
- from %LOCALAPPDATA%\generictools\is-dq7ms.tmp to %LOCALAPPDATA%\generictools\ssleay32.dll
- from %LOCALAPPDATA%\generictools\is-uptn4.tmp to %LOCALAPPDATA%\generictools\libeay32.dll
- from %LOCALAPPDATA%\generictools\is-sprf0.tmp to %LOCALAPPDATA%\generictools\sisoft.exe
- from %LOCALAPPDATA%\generictools\imageformats\is-7v1e3.tmp to %LOCALAPPDATA%\generictools\imageformats\qtiff4.dll
Network activity
Connects to
- 'my####tscreen.com':80
- 'my####tscreen.com':443
TCP
HTTP GET requests
- http://my####tscreen.com/first9.php?id#########################################
- http://my####tscreen.com/
Other
- 'my####tscreen.com':443
UDP
- DNS ASK my####tscreen.com
Miscellaneous
Creates and executes the following
- '%TEMP%\is-mqvbv.tmp\<File name>.tmp' /SL5="$A0234,9460200,875520,<Full path to file>"
- '%TEMP%\is-8glkp.tmp\<File name>.tmp' /SL5="$B0234,9460200,875520,<Full path to file>" /VERYSILENT
