Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\windowsupdate.lnk
Modifies file system
Creates the following files
- <Current directory>\plugins.exe
- %TEMP%\is-r9btp.tmp\sdwimage7.png
- %TEMP%\is-r9btp.tmp\sdwimage8.png
- %TEMP%\is-r9btp.tmp\sdwimage9.png
- %TEMP%\is-r9btp.tmp\sdwimage10.png
- %TEMP%\is-r9btp.tmp\sdwimage11.png
- %TEMP%\is-r9btp.tmp\sdwimage12.png
- %TEMP%\is-r9btp.tmp\flrimage1.png
- %TEMP%\is-r9btp.tmp\sdwimage5.png
- %TEMP%\is-r9btp.tmp\sdwimage6.png
- %ALLUSERSPROFILE%\windows\msvcr110.dll
- %ALLUSERSPROFILE%\windows\system32.exe
- %TEMP%\is-r9btp.tmp\lstimage2.bmp
- %TEMP%\is-r9btp.tmp\button0.bmp
- %TEMP%\is-r9btp.tmp\button1.png
- %TEMP%\is-r9btp.tmp\button2.png
- %TEMP%\is-r9btp.tmp\button3.png
- %TEMP%\is-r9btp.tmp\progress1.png
- %TEMP%\is-r9btp.tmp\lstimage1.bmp
- %ALLUSERSPROFILE%\windows\shall.exe
- %TEMP%\is-r9btp.tmp\sdwimage4.png
- %TEMP%\is-r9btp.tmp\sdwimage3.png
- %TEMP%\is-r9btp.tmp\sdwimage2.png
- %ALLUSERSPROFILE%\windows\auth.exe
- %ALLUSERSPROFILE%\windows\data.exe
- %TEMP%\is-7n08j.tmp\setup.tmp
- %ALLUSERSPROFILE%\windows\update.vbs
- %TEMP%\is-r9btp.tmp\_isetup\_regdll.tmp
- %TEMP%\is-r9btp.tmp\_isetup\_setup64.tmp
- %TEMP%\is-r9btp.tmp\_isetup\_shfoldr.dll
- %TEMP%\7139.tmp\713a.bat
- <Current directory>\setup.exe
- %TEMP%\is-r9btp.tmp\innocallback.dll
- %TEMP%\is-r9btp.tmp\isprogressbar.dll
- %ALLUSERSPROFILE%\windows\config.txt
- %TEMP%\is-r9btp.tmp\botva2.dll
- %ALLUSERSPROFILE%\windows\boot.exe
- %TEMP%\is-r9btp.tmp\callbackctrl.dll
- %TEMP%\is-r9btp.tmp\bgimage1.png
- %TEMP%\is-r9btp.tmp\bgimage2.png
- %TEMP%\is-r9btp.tmp\sdwimage1.png
- %TEMP%\is-r9btp.tmp\isdone.dll
- %TEMP%\a15d.tmp\a15e.bat
- %ALLUSERSPROFILE%\windows\1709860167_log.txt
Sets the 'hidden' attribute to the following files
- %ALLUSERSPROFILE%\windows\auth.exe
- %ALLUSERSPROFILE%\windows\data.exe
- %ALLUSERSPROFILE%\windows\update.vbs
- %ALLUSERSPROFILE%\windows\config.txt
- %ALLUSERSPROFILE%\windows\boot.exe
- %ALLUSERSPROFILE%\windows\msvcr110.dll
- %ALLUSERSPROFILE%\windows\shall.exe
- %ALLUSERSPROFILE%\windows\system32.exe
Deletes the following files
- %TEMP%\7139.tmp\713a.bat
- %ALLUSERSPROFILE%\windows\data.exe
- %ALLUSERSPROFILE%\windows\auth.exe
- %ALLUSERSPROFILE%\windows\boot.exe
Network activity
Connects to
- 'xm#.###l.minergate.com':45560
- 'xm#.#uprnova.cc':5222
UDP
- DNS ASK google.com
- DNS ASK xm#.###l.minergate.com
- DNS ASK xm#.#uprnova.cc
Miscellaneous
Searches for the following windows
- ClassName: 'EDIT' WindowName: ''
Creates and executes the following
- '<Current directory>\setup.exe'
- '<Current directory>\plugins.exe'
- '%TEMP%\is-7n08j.tmp\setup.tmp' /SL5="$20254,2529837,417280,<Current directory>\setup.exe"
- '%ALLUSERSPROFILE%\windows\auth.exe'
- '%ALLUSERSPROFILE%\windows\data.exe' -p1234 -d%ALLUSERSPROFILE%\Windows
- '%WINDIR%\syswow64\wscript.exe' "%ALLUSERSPROFILE%\Windows\update.vbs"
- '%ALLUSERSPROFILE%\windows\boot.exe'
- '%ALLUSERSPROFILE%\windows\shall.exe'
- '%ALLUSERSPROFILE%\windows\system32.exe'
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\7139.tmp\713A.bat %ALLUSERSPROFILE%\Windows\auth.exe"' (with hidden window)
- '%WINDIR%\syswow64\ping.exe' -n 1 google.com' (with hidden window)
- '%ALLUSERSPROFILE%\windows\shall.exe' ' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\A15D.tmp\A15E.bat %ALLUSERSPROFILE%\Windows\shall.exe"' (with hidden window)
Executes the following
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\7139.tmp\713A.bat %ALLUSERSPROFILE%\Windows\auth.exe"
- '%WINDIR%\syswow64\ping.exe' -n 1 google.com
- '<SYSTEM32>\cmd.exe' /c "%TEMP%\A15D.tmp\A15E.bat %ALLUSERSPROFILE%\Windows\shall.exe"
- '<SYSTEM32>\rundll32.exe' <SYSTEM32>\FirewallControlPanel.dll,ShowNotificationDialog /configure /ETOnly 0 /OnProfiles 6 /OtherAllowed 0 /OtherBlocked 0 /OtherEdgeAllowed 0 /NewBlocked 4 "%ALLUSERSPROFILE%\windows\system...
