Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\a0c81c7d5fff2c0b.lnk
Malicious functions
Modifies settings of Windows Internet Explorer
- [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3] '2500' = '00000003'
Modifies file system
Creates the following files
- %TEMP%\is-46nlk.tmp\<File name>.tmp
- %APPDATA%\a0c81c7d5fff2c0b\api-ms-win-crt-heap-l1-1-0.dll
- %APPDATA%\a0c81c7d5fff2c0b\api-ms-win-crt-filesystem-l1-1-0.dll
- %APPDATA%\a0c81c7d5fff2c0b\api-ms-win-crt-environment-l1-1-0.dll
- %APPDATA%\a0c81c7d5fff2c0b\api-ms-win-crt-convert-l1-1-0.dll
- %APPDATA%\a0c81c7d5fff2c0b\api-ms-win-crt-conio-l1-1-0.dll
- %APPDATA%\a0c81c7d5fff2c0b\api-ms-win-core-util-l1-1-0.dll
- %APPDATA%\a0c81c7d5fff2c0b\api-ms-win-core-timezone-l1-1-0.dll
- %APPDATA%\tor\state.tmp
- %APPDATA%\a0c81c7d5fff2c0b\api-ms-win-core-sysinfo-l1-1-0.dll
- %APPDATA%\a0c81c7d5fff2c0b\api-ms-win-core-synch-l1-2-0.dll
- %APPDATA%\a0c81c7d5fff2c0b\api-ms-win-core-synch-l1-1-0.dll
- %APPDATA%\a0c81c7d5fff2c0b\api-ms-win-core-string-l1-1-0.dll
- %APPDATA%\a0c81c7d5fff2c0b\api-ms-win-core-rtlsupport-l1-1-0.dll
- %APPDATA%\a0c81c7d5fff2c0b\api-ms-win-core-profile-l1-1-0.dll
- %APPDATA%\a0c81c7d5fff2c0b\api-ms-win-core-processthreads-l1-1-1.dll
- %APPDATA%\a0c81c7d5fff2c0b\api-ms-win-core-processthreads-l1-1-0.dll
- %APPDATA%\a0c81c7d5fff2c0b\api-ms-win-core-processenvironment-l1-1-0.dll
- %APPDATA%\a0c81c7d5fff2c0b\api-ms-win-core-namedpipe-l1-1-0.dll
- %APPDATA%\a0c81c7d5fff2c0b\api-ms-win-core-memory-l1-1-0.dll
- %APPDATA%\a0c81c7d5fff2c0b\api-ms-win-core-localization-l1-2-0.dll
- %APPDATA%\a0c81c7d5fff2c0b\api-ms-win-core-libraryloader-l1-1-0.dll
- %APPDATA%\a0c81c7d5fff2c0b\api-ms-win-core-interlocked-l1-1-0.dll
- %APPDATA%\a0c81c7d5fff2c0b\api-ms-win-core-heap-l1-1-0.dll
- %APPDATA%\a0c81c7d5fff2c0b\api-ms-win-core-handle-l1-1-0.dll
- %APPDATA%\a0c81c7d5fff2c0b\api-ms-win-core-file-l2-1-0.dll
- %APPDATA%\a0c81c7d5fff2c0b\api-ms-win-core-file-l1-2-0.dll
- %APPDATA%\a0c81c7d5fff2c0b\api-ms-win-core-file-l1-1-0.dll
- %APPDATA%\a0c81c7d5fff2c0b\api-ms-win-core-errorhandling-l1-1-0.dll
- %APPDATA%\a0c81c7d5fff2c0b\api-ms-win-core-debug-l1-1-0.dll
- %APPDATA%\a0c81c7d5fff2c0b\api-ms-win-crt-locale-l1-1-0.dll
- %APPDATA%\a0c81c7d5fff2c0b\api-ms-win-crt-multibyte-l1-1-0.dll
- %APPDATA%\a0c81c7d5fff2c0b\_isetup\_setup64.tmp
- %APPDATA%\a0c81c7d5fff2c0b\api-ms-win-crt-private-l1-1-0.dll
- %APPDATA%\a0c81c7d5fff2c0b\_isetup\_isdecmp.dll
- %APPDATA%\a0c81c7d5fff2c0b\zlib1.dll
- %APPDATA%\a0c81c7d5fff2c0b\vcruntime140.dll
- %APPDATA%\a0c81c7d5fff2c0b\ucrtbase.dll
- %APPDATA%\a0c81c7d5fff2c0b\tor.exe
- %APPDATA%\a0c81c7d5fff2c0b\ssleay32.dll
- %APPDATA%\a0c81c7d5fff2c0b\msvcr110.dll
- %APPDATA%\a0c81c7d5fff2c0b\msvcp140.dll
- %APPDATA%\a0c81c7d5fff2c0b\mozglue.dll
- %APPDATA%\a0c81c7d5fff2c0b\libssp-0.dll
- %APPDATA%\a0c81c7d5fff2c0b\libgmp-10.dll
- %APPDATA%\a0c81c7d5fff2c0b\libgcc_s_sjlj-1.dll
- %APPDATA%\a0c81c7d5fff2c0b\libevent_extra-2-0-5.dll
- %APPDATA%\a0c81c7d5fff2c0b\libevent_core-2-0-5.dll
- %APPDATA%\a0c81c7d5fff2c0b\libevent-2-0-5.dll
- %APPDATA%\a0c81c7d5fff2c0b\libeay32.dll
- %APPDATA%\a0c81c7d5fff2c0b\karlaregular.ttf
- %APPDATA%\a0c81c7d5fff2c0b\karlaitalic.ttf
- %APPDATA%\a0c81c7d5fff2c0b\karla700italic.ttf
- %APPDATA%\a0c81c7d5fff2c0b\karla700.ttf
- %APPDATA%\a0c81c7d5fff2c0b\firefox.exe
- %APPDATA%\a0c81c7d5fff2c0b\dependentlibs.list
- %APPDATA%\a0c81c7d5fff2c0b\data.dll
- %APPDATA%\a0c81c7d5fff2c0b\api-ms-win-crt-utility-l1-1-0.dll
- %APPDATA%\a0c81c7d5fff2c0b\api-ms-win-crt-time-l1-1-0.dll
- %APPDATA%\a0c81c7d5fff2c0b\api-ms-win-crt-string-l1-1-0.dll
- %APPDATA%\a0c81c7d5fff2c0b\api-ms-win-crt-stdio-l1-1-0.dll
- %APPDATA%\a0c81c7d5fff2c0b\api-ms-win-crt-runtime-l1-1-0.dll
- %APPDATA%\a0c81c7d5fff2c0b\api-ms-win-crt-process-l1-1-0.dll
- %APPDATA%\a0c81c7d5fff2c0b\api-ms-win-core-datetime-l1-1-0.dll
- %APPDATA%\a0c81c7d5fff2c0b\api-ms-win-crt-math-l1-1-0.dll
- %APPDATA%\a0c81c7d5fff2c0b\api-ms-win-core-console-l1-1-0.dll
- %TEMP%\is-skc3p.tmp\is-4d9sm.tmp
- %TEMP%\is-skc3p.tmp\is-0jggi.tmp
- %TEMP%\is-skc3p.tmp\is-vmi64.tmp
- %TEMP%\is-skc3p.tmp\is-r0qu9.tmp
- %TEMP%\is-skc3p.tmp\is-8b4ep.tmp
- %TEMP%\is-skc3p.tmp\is-j07j4.tmp
- %TEMP%\is-skc3p.tmp\is-8vehk.tmp
- %TEMP%\is-skc3p.tmp\is-quafj.tmp
- %TEMP%\is-skc3p.tmp\is-941rk.tmp
- %TEMP%\is-skc3p.tmp\is-pul9g.tmp
- %TEMP%\is-skc3p.tmp\is-2i0tt.tmp
- %TEMP%\is-skc3p.tmp\is-6t1tr.tmp
- %TEMP%\is-skc3p.tmp\is-0fkns.tmp
- %TEMP%\is-skc3p.tmp\is-4e3iu.tmp
- %TEMP%\is-skc3p.tmp\is-nhmh6.tmp
- %TEMP%\is-skc3p.tmp\is-9f2aa.tmp
- %TEMP%\is-skc3p.tmp\is-l323p.tmp
- %TEMP%\is-skc3p.tmp\is-1q52n.tmp
- %TEMP%\is-skc3p.tmp\is-3t4lo.tmp
- %TEMP%\is-skc3p.tmp\is-p1ea7.tmp
- %TEMP%\is-skc3p.tmp\is-64s3i.tmp
- %TEMP%\is-skc3p.tmp\is-87f02.tmp
- %TEMP%\is-skc3p.tmp\is-ogqpq.tmp
- %TEMP%\is-skc3p.tmp\is-g9k6q.tmp
- %TEMP%\is-skc3p.tmp\is-sm3vf.tmp
- %TEMP%\is-skc3p.tmp\is-vlj68.tmp
- %TEMP%\is-skc3p.tmp\is-pqkfl.tmp
- %TEMP%\is-skc3p.tmp\is-5fntd.tmp
- %TEMP%\is-skc3p.tmp\_isetup\_isdecmp.dll
- %TEMP%\is-skc3p.tmp\_isetup\_setup64.tmp
- %TEMP%\is-skc3p.tmp\is-m12l2.tmp
- %TEMP%\is-skc3p.tmp\is-edkp4.tmp
- %TEMP%\is-skc3p.tmp\is-6g5n7.tmp
- %TEMP%\is-skc3p.tmp\is-btkmj.tmp
- %TEMP%\is-skc3p.tmp\is-ttr2b.tmp
- %TEMP%\is-skc3p.tmp\is-7f781.tmp
- %TEMP%\is-skc3p.tmp\is-0r1vk.tmp
- %TEMP%\is-skc3p.tmp\is-k16o6.tmp
- %TEMP%\is-skc3p.tmp\is-7l0ru.tmp
- %TEMP%\is-skc3p.tmp\is-d19gu.tmp
- %TEMP%\is-skc3p.tmp\is-90e60.tmp
- %TEMP%\is-skc3p.tmp\is-00tes.tmp
- %TEMP%\is-skc3p.tmp\is-gvjmm.tmp
- %TEMP%\is-skc3p.tmp\is-1kp3m.tmp
- %TEMP%\is-skc3p.tmp\is-4vrb5.tmp
- %TEMP%\is-skc3p.tmp\is-n3u8g.tmp
- %TEMP%\is-skc3p.tmp\is-10seq.tmp
- %TEMP%\is-skc3p.tmp\is-ps2vh.tmp
- %TEMP%\is-skc3p.tmp\is-p6tla.tmp
- %TEMP%\is-skc3p.tmp\is-gb56a.tmp
- %TEMP%\is-skc3p.tmp\is-7gv4i.tmp
- %TEMP%\is-skc3p.tmp\is-33cnm.tmp
- %TEMP%\is-skc3p.tmp\is-9e1eo.tmp
- %TEMP%\is-skc3p.tmp\is-7rvtk.tmp
- %TEMP%\is-skc3p.tmp\is-ekss8.tmp
- %TEMP%\is-skc3p.tmp\is-elejd.tmp
- %TEMP%\is-skc3p.tmp\is-ait5m.tmp
- %TEMP%\is-skc3p.tmp\is-q5nnj.tmp
- %TEMP%\is-skc3p.tmp\is-vvlu1.tmp
- %TEMP%\is-skc3p.tmp\is-dlddv.tmp
- %TEMP%\is-skc3p.tmp\is-b43cd.tmp
- %TEMP%\is-skc3p.tmp\is-a3rhh.tmp
- %TEMP%\is-skc3p.tmp\is-5cbm7.tmp
- %TEMP%\is-skc3p.tmp\is-nj8lo.tmp
- %TEMP%\a0c81c7d5fff2c0b
Moves the following files
- from %TEMP%\is-skc3p.tmp\is-5fntd.tmp to %TEMP%\is-skc3p.tmp\api-ms-win-core-console-l1-1-0.dll
- from %TEMP%\is-skc3p.tmp\is-b43cd.tmp to %TEMP%\is-skc3p.tmp\api-ms-win-crt-private-l1-1-0.dll
- from %TEMP%\is-skc3p.tmp\is-dlddv.tmp to %TEMP%\is-skc3p.tmp\api-ms-win-crt-process-l1-1-0.dll
- from %TEMP%\is-skc3p.tmp\is-vvlu1.tmp to %TEMP%\is-skc3p.tmp\api-ms-win-crt-runtime-l1-1-0.dll
- from %TEMP%\is-skc3p.tmp\is-q5nnj.tmp to %TEMP%\is-skc3p.tmp\api-ms-win-crt-stdio-l1-1-0.dll
- from %TEMP%\is-skc3p.tmp\is-ait5m.tmp to %TEMP%\is-skc3p.tmp\api-ms-win-crt-string-l1-1-0.dll
- from %TEMP%\is-skc3p.tmp\is-elejd.tmp to %TEMP%\is-skc3p.tmp\api-ms-win-crt-time-l1-1-0.dll
- from %TEMP%\is-skc3p.tmp\is-ekss8.tmp to %TEMP%\is-skc3p.tmp\api-ms-win-crt-utility-l1-1-0.dll
- from %TEMP%\is-skc3p.tmp\is-7rvtk.tmp to %TEMP%\is-skc3p.tmp\data.dll
- from %TEMP%\is-skc3p.tmp\is-9e1eo.tmp to %TEMP%\is-skc3p.tmp\dependentlibs.list
- from %TEMP%\is-skc3p.tmp\is-33cnm.tmp to %TEMP%\is-skc3p.tmp\firefox.exe
- from %TEMP%\is-skc3p.tmp\is-7gv4i.tmp to %TEMP%\is-skc3p.tmp\karla700.ttf
- from %TEMP%\is-skc3p.tmp\is-gb56a.tmp to %TEMP%\is-skc3p.tmp\karla700italic.ttf
- from %TEMP%\is-skc3p.tmp\is-p6tla.tmp to %TEMP%\is-skc3p.tmp\karlaitalic.ttf
- from %TEMP%\is-skc3p.tmp\is-10seq.tmp to %TEMP%\is-skc3p.tmp\libeay32.dll
- from %TEMP%\is-skc3p.tmp\is-nj8lo.tmp to %TEMP%\is-skc3p.tmp\zlib1.dll
- from %TEMP%\is-skc3p.tmp\is-n3u8g.tmp to %TEMP%\is-skc3p.tmp\libevent-2-0-5.dll
- from %TEMP%\is-skc3p.tmp\is-4vrb5.tmp to %TEMP%\is-skc3p.tmp\libevent_core-2-0-5.dll
- from %TEMP%\is-skc3p.tmp\is-1kp3m.tmp to %TEMP%\is-skc3p.tmp\libevent_extra-2-0-5.dll
- from %TEMP%\is-skc3p.tmp\is-gvjmm.tmp to %TEMP%\is-skc3p.tmp\libgcc_s_sjlj-1.dll
- from %TEMP%\is-skc3p.tmp\is-00tes.tmp to %TEMP%\is-skc3p.tmp\libgmp-10.dll
- from %TEMP%\is-skc3p.tmp\is-90e60.tmp to %TEMP%\is-skc3p.tmp\libssp-0.dll
- from %TEMP%\is-skc3p.tmp\is-d19gu.tmp to %TEMP%\is-skc3p.tmp\mozglue.dll
- from %TEMP%\is-skc3p.tmp\is-7l0ru.tmp to %TEMP%\is-skc3p.tmp\msvcp140.dll
- from %TEMP%\is-skc3p.tmp\is-k16o6.tmp to %TEMP%\is-skc3p.tmp\msvcr110.dll
- from %TEMP%\is-skc3p.tmp\is-0r1vk.tmp to %TEMP%\is-skc3p.tmp\ssleay32.dll
- from %TEMP%\is-skc3p.tmp\is-7f781.tmp to %TEMP%\is-skc3p.tmp\tor.exe
- from %TEMP%\is-skc3p.tmp\is-ttr2b.tmp to %TEMP%\is-skc3p.tmp\ucrtbase.dll
- from %TEMP%\is-skc3p.tmp\is-6g5n7.tmp to %TEMP%\is-skc3p.tmp\vcruntime140.dll
- from %TEMP%\is-skc3p.tmp\is-a3rhh.tmp to %TEMP%\is-skc3p.tmp\api-ms-win-crt-multibyte-l1-1-0.dll
- from %TEMP%\is-skc3p.tmp\is-ps2vh.tmp to %TEMP%\is-skc3p.tmp\karlaregular.ttf
- from %TEMP%\is-skc3p.tmp\is-5cbm7.tmp to %TEMP%\is-skc3p.tmp\api-ms-win-crt-math-l1-1-0.dll
- from %TEMP%\is-skc3p.tmp\is-4e3iu.tmp to %TEMP%\is-skc3p.tmp\api-ms-win-core-processenvironment-l1-1-0.dll
- from %TEMP%\is-skc3p.tmp\is-pqkfl.tmp to %TEMP%\is-skc3p.tmp\api-ms-win-core-datetime-l1-1-0.dll
- from %TEMP%\is-skc3p.tmp\is-vlj68.tmp to %TEMP%\is-skc3p.tmp\api-ms-win-core-debug-l1-1-0.dll
- from %TEMP%\is-skc3p.tmp\is-sm3vf.tmp to %TEMP%\is-skc3p.tmp\api-ms-win-core-errorhandling-l1-1-0.dll
- from %TEMP%\is-skc3p.tmp\is-g9k6q.tmp to %TEMP%\is-skc3p.tmp\api-ms-win-core-file-l1-1-0.dll
- from %TEMP%\is-skc3p.tmp\is-ogqpq.tmp to %TEMP%\is-skc3p.tmp\api-ms-win-core-file-l1-2-0.dll
- from %TEMP%\is-skc3p.tmp\is-87f02.tmp to %TEMP%\is-skc3p.tmp\api-ms-win-core-file-l2-1-0.dll
- from %TEMP%\is-skc3p.tmp\is-64s3i.tmp to %TEMP%\is-skc3p.tmp\api-ms-win-core-handle-l1-1-0.dll
- from %TEMP%\is-skc3p.tmp\is-p1ea7.tmp to %TEMP%\is-skc3p.tmp\api-ms-win-core-heap-l1-1-0.dll
- from %TEMP%\is-skc3p.tmp\is-3t4lo.tmp to %TEMP%\is-skc3p.tmp\api-ms-win-core-interlocked-l1-1-0.dll
- from %TEMP%\is-skc3p.tmp\is-1q52n.tmp to %TEMP%\is-skc3p.tmp\api-ms-win-core-libraryloader-l1-1-0.dll
- from %TEMP%\is-skc3p.tmp\is-l323p.tmp to %TEMP%\is-skc3p.tmp\api-ms-win-core-localization-l1-2-0.dll
- from %TEMP%\is-skc3p.tmp\is-9f2aa.tmp to %TEMP%\is-skc3p.tmp\api-ms-win-core-memory-l1-1-0.dll
- from %TEMP%\is-skc3p.tmp\is-nhmh6.tmp to %TEMP%\is-skc3p.tmp\api-ms-win-core-namedpipe-l1-1-0.dll
- from %TEMP%\is-skc3p.tmp\is-0fkns.tmp to %TEMP%\is-skc3p.tmp\api-ms-win-core-processthreads-l1-1-0.dll
- from %TEMP%\is-skc3p.tmp\is-edkp4.tmp to %TEMP%\is-skc3p.tmp\api-ms-win-crt-heap-l1-1-0.dll
- from %TEMP%\is-skc3p.tmp\is-6t1tr.tmp to %TEMP%\is-skc3p.tmp\api-ms-win-core-processthreads-l1-1-1.dll
- from %TEMP%\is-skc3p.tmp\is-2i0tt.tmp to %TEMP%\is-skc3p.tmp\api-ms-win-core-profile-l1-1-0.dll
- from %TEMP%\is-skc3p.tmp\is-pul9g.tmp to %TEMP%\is-skc3p.tmp\api-ms-win-core-rtlsupport-l1-1-0.dll
- from %TEMP%\is-skc3p.tmp\is-941rk.tmp to %TEMP%\is-skc3p.tmp\api-ms-win-core-string-l1-1-0.dll
- from %TEMP%\is-skc3p.tmp\is-quafj.tmp to %TEMP%\is-skc3p.tmp\api-ms-win-core-synch-l1-1-0.dll
- from %TEMP%\is-skc3p.tmp\is-8vehk.tmp to %TEMP%\is-skc3p.tmp\api-ms-win-core-synch-l1-2-0.dll
- from %TEMP%\is-skc3p.tmp\is-j07j4.tmp to %TEMP%\is-skc3p.tmp\api-ms-win-core-sysinfo-l1-1-0.dll
- from %TEMP%\is-skc3p.tmp\is-8b4ep.tmp to %TEMP%\is-skc3p.tmp\api-ms-win-core-timezone-l1-1-0.dll
- from %TEMP%\is-skc3p.tmp\is-r0qu9.tmp to %TEMP%\is-skc3p.tmp\api-ms-win-core-util-l1-1-0.dll
- from %TEMP%\is-skc3p.tmp\is-vmi64.tmp to %TEMP%\is-skc3p.tmp\api-ms-win-crt-conio-l1-1-0.dll
- from %TEMP%\is-skc3p.tmp\is-0jggi.tmp to %TEMP%\is-skc3p.tmp\api-ms-win-crt-convert-l1-1-0.dll
- from %TEMP%\is-skc3p.tmp\is-m12l2.tmp to %TEMP%\is-skc3p.tmp\api-ms-win-crt-environment-l1-1-0.dll
- from %TEMP%\is-skc3p.tmp\is-4d9sm.tmp to %TEMP%\is-skc3p.tmp\api-ms-win-crt-filesystem-l1-1-0.dll
- from %TEMP%\is-skc3p.tmp\is-btkmj.tmp to %TEMP%\is-skc3p.tmp\api-ms-win-crt-locale-l1-1-0.dll
- from %APPDATA%\tor\state.tmp to %APPDATA%\tor\state
Network activity
Connects to
- '92.##2.38.67':443
- '19#.#09.206.212':443
- '77.##7.181.162':443
- '10#.#00.20.46':9001
- '20#.#3.164.118':443
- '81.#.16.182':443
- '46.##.109.231':9001
- '5.#.110.236':9001
Miscellaneous
Creates and executes the following
- '%TEMP%\is-46nlk.tmp\<File name>.tmp' /SL5="$C022A,5155818,88064,<Full path to file>"
- '%TEMP%\is-skc3p.tmp\firefox.exe'
- '%TEMP%\is-skc3p.tmp\tor.exe'
- '%APPDATA%\a0c81c7d5fff2c0b\firefox.exe'
- '%APPDATA%\a0c81c7d5fff2c0b\tor.exe'
