Technical Information
Malicious functions
Executes the following
- '%WINDIR%\syswow64\net.exe' stop tacticalrmm
- '%WINDIR%\syswow64\taskkill.exe' /F /IM tacticalrmm.exe
Modifies file system
Creates the following files
- %TEMP%\is-30ash.tmp\<File name>.tmp
- %TEMP%\setup log 2026-06-17 #001.txt
- %TEMP%\is-u2m36.tmp\_isetup\_setup64.tmp
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: ''
Creates and executes the following
- '%TEMP%\is-30ash.tmp\<File name>.tmp' /SL5="$D02C8,4211567,861184,<Full path to file>"
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c ping 127.0.0.1 -n 2 && net stop tacticalrmm
- '%WINDIR%\syswow64\ping.exe' 127.0.0.1 -n 2
- '%WINDIR%\syswow64\net1.exe' stop tacticalrmm
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /F /IM tacticalrmm.exe
- '%WINDIR%\syswow64\cmd.exe' /c ping 127.0.0.1 -n 2 && net stop tacticalrmm' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /F /IM tacticalrmm.exe' (with hidden window)
