Technical Information
Malicious functions:
Creates and executes the following:
- '' (downloaded from the Internet)
Modifies file system:
Creates the following files:
- %TEMP%\is-97CGR.tmp\<File name>.tmp
- %TEMP%\is-B4TPE.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-B4TPE.tmp\itdownload.dll
- %TEMP%\is-B4TPE.tmp\netstream.exe
- %TEMP%\is-B4TPE.tmp\SetupZippy.exe
- %TEMP%\is-LG8NE.tmp\SetupZippy.tmp
- %TEMP%\is-PT5OL.tmp\_isetup\_shfoldr.dll
- %ProgramFiles%\Zippy\is-D35RU.tmp
- %ProgramFiles%\Zippy\is-HV6NJ.tmp
- %ALLUSERSPROFILE%\Start Menu\Programs\Zippy.lnk
- %ProgramFiles%\Zippy\unins000.dat
Deletes the following files:
- %TEMP%\is-B4TPE.tmp\itdownload.dll
- %TEMP%\is-B4TPE.tmp\netstream.exe
- %TEMP%\is-B4TPE.tmp\SetupZippy.exe
- %TEMP%\is-PT5OL.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-B4TPE.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-LG8NE.tmp\SetupZippy.tmp
- %TEMP%\is-97CGR.tmp\<File name>.tmp
Moves the following files:
- from %ProgramFiles%\Zippy\is-D35RU.tmp to %ProgramFiles%\Zippy\unins000.exe
- from %ProgramFiles%\Zippy\is-HV6NJ.tmp to %ProgramFiles%\Zippy\Zippyy.exe
Network activity:
Connects to:
- 'al####oudmedia.com':80
TCP:
HTTP GET requests:
- http://al####oudmedia.com/tunnel/netstream.exe
UDP:
- DNS ASK al####oudmedia.com
Miscellaneous:
Creates and executes the following:
- '%TEMP%\is-97CGR.tmp\<File name>.tmp' /SL5="$30092,487828,91648,<Full path to file>"
- '%TEMP%\is-B4TPE.tmp\netstream.exe' /pubid=9 /subid=9
- '%TEMP%\is-B4TPE.tmp\SetupZippy.exe' /VerySilent
- '%TEMP%\is-LG8NE.tmp\SetupZippy.tmp' /SL5="$300E4,94127,56832,%TEMP%\is-B4TPE.tmp\SetupZippy.exe" /VerySilent
