Technical Information
Malicious functions
Executes the following
- '%WINDIR%\syswow64\taskkill.exe' /f /im "firefox.exe"
Terminates or attempts to terminate
the following user processes:
- firefox.exe
Modifies file system
Creates the following files
- %TEMP%\is-4t8dr.tmp\<File name>.tmp
- %APPDATA%\opera software\opera stable\extensions\egafjhhpbipcmpoiomegbckljbbbphoj\1.1_0\js\is-npdk0.tmp
- %APPDATA%\opera software\opera stable\extensions\egafjhhpbipcmpoiomegbckljbbbphoj\1.1_0\icon\is-05uii.tmp
- %APPDATA%\opera software\opera stable\extensions\egafjhhpbipcmpoiomegbckljbbbphoj\1.1_0\icon\is-87sfu.tmp
- %APPDATA%\opera software\opera stable\extensions\egafjhhpbipcmpoiomegbckljbbbphoj\1.1_0\icon\is-jda0r.tmp
- %APPDATA%\opera software\opera stable\extensions\egafjhhpbipcmpoiomegbckljbbbphoj\1.1_0\icon\is-ogdtf.tmp
- %APPDATA%\opera software\opera stable\extensions\egafjhhpbipcmpoiomegbckljbbbphoj\1.1_0\is-v75l2.tmp
- %APPDATA%\opera software\opera stable\extensions\egafjhhpbipcmpoiomegbckljbbbphoj\1.1_0\is-hc9hq.tmp
- %TEMP%\is-5i1nr.tmp\is-do607.tmp
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\chrome\is-3sagb.tmp
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\is-u31sk.tmp
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\is-rah4o.tmp
- %TEMP%\is-5i1nr.tmp\is-gblvq.tmp
- <LS_APPDATA>\google\chrome\user data\default\extensions\fngmhnnpilhplaeedifhccceomclgfbg\78.0_0\js\is-urtcs.tmp
- <LS_APPDATA>\google\chrome\user data\default\extensions\fngmhnnpilhplaeedifhccceomclgfbg\78.0_0\icon\is-20msh.tmp
- <LS_APPDATA>\google\chrome\user data\default\extensions\fngmhnnpilhplaeedifhccceomclgfbg\78.0_0\icon\is-dd5it.tmp
- <LS_APPDATA>\google\chrome\user data\default\extensions\fngmhnnpilhplaeedifhccceomclgfbg\78.0_0\icon\is-etlkr.tmp
- <LS_APPDATA>\google\chrome\user data\default\extensions\fngmhnnpilhplaeedifhccceomclgfbg\78.0_0\icon\is-jttn9.tmp
- <LS_APPDATA>\google\chrome\user data\default\extensions\fngmhnnpilhplaeedifhccceomclgfbg\78.0_0\is-mcqs1.tmp
- <LS_APPDATA>\google\chrome\user data\default\extensions\fngmhnnpilhplaeedifhccceomclgfbg\78.0_0\is-6v3ak.tmp
- %APPDATA%\browsermodule\is-ocs8j.tmp
- %TEMP%\is-5i1nr.tmp\_isetup\_setup64.tmp
- %TEMP%\is-41ec0.tmp\<File name>.tmp
- %TEMP%\is-anupi.tmp\_isetup\_setup64.tmp
- %TEMP%\is-5i1nr.tmp\is-a8o0d.tmp
- %APPDATA%\browsermodule\component.log
Deletes the following files
- %TEMP%\is-anupi.tmp\_isetup\_setup64.tmp
- %TEMP%\is-4t8dr.tmp\<File name>.tmp
- %APPDATA%\browsermodule\common.dll
- %TEMP%\is-5i1nr.tmp\chromesettings.txt
- %TEMP%\is-5i1nr.tmp\mozillasettings.txt
- %TEMP%\is-5i1nr.tmp\operasettings.txt
- %TEMP%\is-5i1nr.tmp\_isetup\_setup64.tmp
- %TEMP%\is-41ec0.tmp\<File name>.tmp
Moves the following files
- from %APPDATA%\browsermodule\is-ocs8j.tmp to %APPDATA%\browsermodule\common.dll
- from %APPDATA%\opera software\opera stable\extensions\egafjhhpbipcmpoiomegbckljbbbphoj\1.1_0\icon\is-05uii.tmp to %APPDATA%\opera software\opera stable\extensions\egafjhhpbipcmpoiomegbckljbbbphoj\1.1_0\icon\icon32.png
- from %APPDATA%\opera software\opera stable\extensions\egafjhhpbipcmpoiomegbckljbbbphoj\1.1_0\icon\is-87sfu.tmp to %APPDATA%\opera software\opera stable\extensions\egafjhhpbipcmpoiomegbckljbbbphoj\1.1_0\icon\icon24.png
- from %APPDATA%\opera software\opera stable\extensions\egafjhhpbipcmpoiomegbckljbbbphoj\1.1_0\icon\is-jda0r.tmp to %APPDATA%\opera software\opera stable\extensions\egafjhhpbipcmpoiomegbckljbbbphoj\1.1_0\icon\icon16.png
- from %APPDATA%\opera software\opera stable\extensions\egafjhhpbipcmpoiomegbckljbbbphoj\1.1_0\icon\is-ogdtf.tmp to %APPDATA%\opera software\opera stable\extensions\egafjhhpbipcmpoiomegbckljbbbphoj\1.1_0\icon\icon128.png
- from %APPDATA%\opera software\opera stable\extensions\egafjhhpbipcmpoiomegbckljbbbphoj\1.1_0\is-v75l2.tmp to %APPDATA%\opera software\opera stable\extensions\egafjhhpbipcmpoiomegbckljbbbphoj\1.1_0\manifest.json
- from %APPDATA%\opera software\opera stable\extensions\egafjhhpbipcmpoiomegbckljbbbphoj\1.1_0\is-hc9hq.tmp to %APPDATA%\opera software\opera stable\extensions\egafjhhpbipcmpoiomegbckljbbbphoj\1.1_0\index.html
- from %TEMP%\is-5i1nr.tmp\is-do607.tmp to %TEMP%\is-5i1nr.tmp\mozillasettings.txt
- from %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\chrome\is-3sagb.tmp to %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\chrome\usercontent.css
- from %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\is-rah4o.tmp to %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\extensions\300414@extcorp.com.xpi
- from %TEMP%\is-5i1nr.tmp\is-gblvq.tmp to %TEMP%\is-5i1nr.tmp\chromesettings.txt
- from <LS_APPDATA>\google\chrome\user data\default\extensions\fngmhnnpilhplaeedifhccceomclgfbg\78.0_0\js\is-urtcs.tmp to <LS_APPDATA>\google\chrome\user data\default\extensions\fngmhnnpilhplaeedifhccceomclgfbg\78.0_0\js\background.js
- from <LS_APPDATA>\google\chrome\user data\default\extensions\fngmhnnpilhplaeedifhccceomclgfbg\78.0_0\icon\is-20msh.tmp to <LS_APPDATA>\google\chrome\user data\default\extensions\fngmhnnpilhplaeedifhccceomclgfbg\78.0_0\icon\icon32.png
- from <LS_APPDATA>\google\chrome\user data\default\extensions\fngmhnnpilhplaeedifhccceomclgfbg\78.0_0\icon\is-dd5it.tmp to <LS_APPDATA>\google\chrome\user data\default\extensions\fngmhnnpilhplaeedifhccceomclgfbg\78.0_0\icon\icon24.png
- from <LS_APPDATA>\google\chrome\user data\default\extensions\fngmhnnpilhplaeedifhccceomclgfbg\78.0_0\icon\is-etlkr.tmp to <LS_APPDATA>\google\chrome\user data\default\extensions\fngmhnnpilhplaeedifhccceomclgfbg\78.0_0\icon\icon16.png
- from <LS_APPDATA>\google\chrome\user data\default\extensions\fngmhnnpilhplaeedifhccceomclgfbg\78.0_0\icon\is-jttn9.tmp to <LS_APPDATA>\google\chrome\user data\default\extensions\fngmhnnpilhplaeedifhccceomclgfbg\78.0_0\icon\icon128.png
- from <LS_APPDATA>\google\chrome\user data\default\extensions\fngmhnnpilhplaeedifhccceomclgfbg\78.0_0\is-mcqs1.tmp to <LS_APPDATA>\google\chrome\user data\default\extensions\fngmhnnpilhplaeedifhccceomclgfbg\78.0_0\manifest.json
- from <LS_APPDATA>\google\chrome\user data\default\extensions\fngmhnnpilhplaeedifhccceomclgfbg\78.0_0\is-6v3ak.tmp to <LS_APPDATA>\google\chrome\user data\default\extensions\fngmhnnpilhplaeedifhccceomclgfbg\78.0_0\index.html
- from %APPDATA%\opera software\opera stable\extensions\egafjhhpbipcmpoiomegbckljbbbphoj\1.1_0\js\is-npdk0.tmp to %APPDATA%\opera software\opera stable\extensions\egafjhhpbipcmpoiomegbckljbbbphoj\1.1_0\js\background.js
- from %TEMP%\is-5i1nr.tmp\is-a8o0d.tmp to %TEMP%\is-5i1nr.tmp\operasettings.txt
Substitutes the following files
- %APPDATA%\Mozilla\Firefox\Profiles\gn7ryp3k.default\user.js
Network activity
UDP
- DNS ASK tr##ert.pw
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: ''
Creates and executes the following
- '%TEMP%\is-4t8dr.tmp\<File name>.tmp' /SL5="$70240,246237,121344,<Full path to file>"
- '%TEMP%\is-41ec0.tmp\<File name>.tmp' /SL5="$8001E,246237,121344,<Full path to file>" /VERYSILENT
- '%WINDIR%\syswow64\taskkill.exe' /f /im "firefox.exe"' (with hidden window)
