Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\bgtaskregistrationmaintenancetask693.77.9910.35{67cfaa8d-c3b5-4cb8-9187-35cea85cb324}
Malicious functions
Terminates or attempts to terminate
the following system processes:
- <SYSTEM32>\regsvr32.exe
Modifies file system
Creates the following files
- %TEMP%\is-hf6j0.tmp\<File name>.tmp
- %TEMP%\is-bsrav.tmp\_isetup\_setup64.tmp
- %TEMP%\is-bsrav.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-bsrav.tmp\_isetup\_isdecmp.dll
- %TEMP%\is-bsrav.tmp\dynwin32loader.dll
- %TEMP%\is-bsrav.tmp\datastore.dat
- %LOCALAPPDATA%\steam\htmlcache\ab143df2_fdcf_6a31_dc03_0e4b4ddb7e5f.dll
Deletes following files that it created itself
- %TEMP%\is-bsrav.tmp\datastore.dat
- %TEMP%\is-hf6j0.tmp\<File name>.tmp
Network activity
Connects to
- '13#.#22.139.114':8080
TCP
Other
- '13#.#22.139.114':8080
Miscellaneous
Creates and executes the following
- '%TEMP%\is-hf6j0.tmp\<File name>.tmp' /SL5="$902BE,283869,137216,<Full path to file>"
Executes the following
- '<SYSTEM32>\regsvr32.exe' /s /u "%LOCALAPPDATA%\Steam\htmlcache\ab143df2_fdcf_6a31_dc03_0e4b4ddb7e5f.dll"
- '<SYSTEM32>\regsvr32.exe' /s /u "%LOCALAPPDATA%\Steam\htmlcache\ab143df2"_"fdcf"_"6a31"_"dc03"_"0e4b4ddb7e5f.dll"
