Technical Information
Malicious functions:
Creates and executes the following:
- '%TEMP%\is-38C4S.tmp\Bundle_NetworkManager.exe' (downloaded from the Internet)
Executes the following:
- '<SYSTEM32>\cmd.exe' /C copy "%TEMP%\is-38C4S.tmp\ii465340i06054600646.exe" "%TEMP%\is-UFRVD.tmp\wQyDr.exe"
- '<SYSTEM32>\cmd.exe' /C copy "%TEMP%\is-38C4S.tmp\ii465340i06054600646.exe" "<SYSTEM32>\..\systwin.exe"
- '%TEMP%\is-C8I2T.tmp\wQyDr.tmp' /SL5="$400EE,56832,56832,%TEMP%\is-UFRVD.tmp\wQyDr.exe" /VERYSILENT /PASSWORD=1453420i053405341420534145ii /SUPPRESSMSGBOXES /NOCANCEL /CLOSEAPPLICATIONS /FORCECLOSEAPPLICATIONS /RESTARTAPPLICA...
- '%TEMP%\is-UFRVD.tmp\wQyDr.exe' /VERYSILENT /PASSWORD=1453420i053405341420534145ii /SUPPRESSMSGBOXES /NOCANCEL /CLOSEAPPLICATIONS /FORCECLOSEAPPLICATIONS /RESTARTAPPLICATIONS
- '%TEMP%\is-SIAMQ.tmp\ii465340i06054600646.tmp' /SL5="$100E6,56832,56832,%TEMP%\is-38C4S.tmp\ii465340i06054600646.exe" /INSTALL /VERYSILENT
- '%TEMP%\is-VL2JE.tmp\<Virus name>.tmp' /SL5="$50036,335206,56832,<Full path to virus>" /VERYSILENT /VSFORCED
- '%TEMP%\is-GS3UM.tmp\<Virus name>.tmp' /SL5="$30092,335206,56832,<Full path to virus>"
- '%TEMP%\is-38C4S.tmp\ii465340i06054600646.exe' /INSTALL /VERYSILENT
- '%TEMP%\is-38C4S.tmp\Bundle_NetworkManager.exe'
Modifies file system:
Creates the following files:
- %WINDIR%\systwin.exe
- %TEMP%\is-UFRVD.tmp\_isetup\_iscrypt.dll
- %TEMP%\is-UFRVD.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-UFRVD.tmp\wQyDr.exe
- %TEMP%\is-EABJI.tmp\_isetup\_iscrypt.dll
- %TEMP%\is-EABJI.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-C8I2T.tmp\wQyDr.tmp
- %TEMP%\is-SIAMQ.tmp\ii465340i06054600646.tmp
- %TEMP%\is-VL2JE.tmp\<Virus name>.tmp
- %TEMP%\is-DJ4MB.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-GS3UM.tmp\<Virus name>.tmp
- %TEMP%\is-38C4S.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-38C4S.tmp\ii465340i06054600646.exe
- %TEMP%\is-38C4S.tmp\Bundle_NetworkManager.exe
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\Bundle_NetworkManager[1].exe
Deletes the following files:
- %TEMP%\is-UFRVD.tmp\wQyDr.exe
- %TEMP%\is-GS3UM.tmp\<Virus name>.tmp
- %TEMP%\is-DJ4MB.tmp\_isetup\_shfoldr.dll
Network activity:
Connects to:
- 'an########atmservices.rhcloud.com':80
- 'www.hr##ap.tech':80
- 'an#######.apptrafficmedia.com':80
TCP:
HTTP GET requests:
- http://www.hr##ap.tech/NetworkManager/Bundle_NetworkManager.exe
HTTP POST requests:
- http://an########atmservices.rhcloud.com/piwik.php
- http://an#######.apptrafficmedia.com/piwik.php
UDP:
- DNS ASK an########atmservices.rhcloud.com
- DNS ASK www.hr##ap.tech
- DNS ASK an#######.apptrafficmedia.com
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: ''
