Technical Information
Modifies file system
Creates the following files
- %TEMP%\is-ikpmd.tmp\<File name>.tmp
- %ProgramFiles(x86)%\repudiandae\non\is-8akgh.tmp
- %ProgramFiles(x86)%\repudiandae\non\is-tb4r4.tmp
- %ProgramFiles(x86)%\repudiandae\non\is-bhhjg.tmp
- %ProgramFiles(x86)%\repudiandae\eius\is-q0umd.tmp
- %ProgramFiles(x86)%\repudiandae\eius\is-sc878.tmp
- %ProgramFiles(x86)%\repudiandae\eius\is-n3lds.tmp
- %ProgramFiles(x86)%\repudiandae\eius\is-04efr.tmp
- %ProgramFiles(x86)%\repudiandae\eius\is-1tars.tmp
- %ProgramFiles(x86)%\repudiandae\eius\is-92sih.tmp
- %ProgramFiles(x86)%\repudiandae\dolorem\is-5sir4.tmp
- %ProgramFiles(x86)%\repudiandae\dolorem\is-8i67s.tmp
- %ProgramFiles(x86)%\repudiandae\dolorem\is-m6bgg.tmp
- %ProgramFiles(x86)%\repudiandae\dolorem\is-uritl.tmp
- %ProgramFiles(x86)%\repudiandae\dolorem\is-ng255.tmp
- %ProgramFiles(x86)%\repudiandae\is-dro8t.tmp
- %ProgramFiles(x86)%\repudiandae\is-71ogg.tmp
- %ProgramFiles(x86)%\repudiandae\is-d2r7s.tmp
- %ProgramFiles(x86)%\repudiandae\is-7gui6.tmp
- %ProgramFiles(x86)%\repudiandae\is-pfrk3.tmp
- %ProgramFiles(x86)%\repudiandae\is-ktks4.tmp
- %TEMP%\is-jse4c.tmp\_isetup\_iscrypt.dll
- %TEMP%\is-jse4c.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-jse4c.tmp\_isetup\_setup64.tmp
- %ProgramFiles(x86)%\repudiandae\non\is-bso7r.tmp
- %ProgramFiles(x86)%\repudiandae\unins000.dat
Moves the following files
- from %ProgramFiles(x86)%\repudiandae\is-ktks4.tmp to %ProgramFiles(x86)%\repudiandae\unins000.exe
- from %ProgramFiles(x86)%\repudiandae\non\is-tb4r4.tmp to %ProgramFiles(x86)%\repudiandae\non\corrupti.ha
- from %ProgramFiles(x86)%\repudiandae\non\is-bhhjg.tmp to %ProgramFiles(x86)%\repudiandae\non\autem.mp4
- from %ProgramFiles(x86)%\repudiandae\eius\is-q0umd.tmp to %ProgramFiles(x86)%\repudiandae\eius\sqlite3.dll
- from %ProgramFiles(x86)%\repudiandae\eius\is-sc878.tmp to %ProgramFiles(x86)%\repudiandae\eius\rerum.wav
- from %ProgramFiles(x86)%\repudiandae\eius\is-n3lds.tmp to %ProgramFiles(x86)%\repudiandae\eius\quasi.rar
- from %ProgramFiles(x86)%\repudiandae\eius\is-04efr.tmp to %ProgramFiles(x86)%\repudiandae\eius\et.tex
- from %ProgramFiles(x86)%\repudiandae\eius\is-1tars.tmp to %ProgramFiles(x86)%\repudiandae\eius\et.htm
- from %ProgramFiles(x86)%\repudiandae\eius\is-92sih.tmp to %ProgramFiles(x86)%\repudiandae\eius\aut.exe
- from %ProgramFiles(x86)%\repudiandae\non\is-8akgh.tmp to %ProgramFiles(x86)%\repudiandae\non\nam.wav
- from %ProgramFiles(x86)%\repudiandae\dolorem\is-5sir4.tmp to %ProgramFiles(x86)%\repudiandae\dolorem\voluptates.png
- from %ProgramFiles(x86)%\repudiandae\dolorem\is-m6bgg.tmp to %ProgramFiles(x86)%\repudiandae\dolorem\et.mp4
- from %ProgramFiles(x86)%\repudiandae\dolorem\is-uritl.tmp to %ProgramFiles(x86)%\repudiandae\dolorem\eligendi.mp3
- from %ProgramFiles(x86)%\repudiandae\dolorem\is-ng255.tmp to %ProgramFiles(x86)%\repudiandae\dolorem\assumenda.hta
- from %ProgramFiles(x86)%\repudiandae\is-dro8t.tmp to %ProgramFiles(x86)%\repudiandae\voluptatem.hta
- from %ProgramFiles(x86)%\repudiandae\is-71ogg.tmp to %ProgramFiles(x86)%\repudiandae\veritatis.pps
- from %ProgramFiles(x86)%\repudiandae\is-d2r7s.tmp to %ProgramFiles(x86)%\repudiandae\quos.png
- from %ProgramFiles(x86)%\repudiandae\is-7gui6.tmp to %ProgramFiles(x86)%\repudiandae\mollitia.txt
- from %ProgramFiles(x86)%\repudiandae\is-pfrk3.tmp to %ProgramFiles(x86)%\repudiandae\error.hta
- from %ProgramFiles(x86)%\repudiandae\dolorem\is-8i67s.tmp to %ProgramFiles(x86)%\repudiandae\dolorem\non.mp4
- from %ProgramFiles(x86)%\repudiandae\non\is-bso7r.tmp to %ProgramFiles(x86)%\repudiandae\non\veniam.hta
Network activity
TCP
HTTP POST requests
- http://cl###etapi.com/v2/events
UDP
- DNS ASK cl###etapi.com
Miscellaneous
Searches for the following windows
- ClassName: '5287B59A-6CB6-44A7-A0FD-F3D1E0BD2F85' WindowName: ''
Creates and executes the following
- '%TEMP%\is-ikpmd.tmp\<File name>.tmp' /SL5="$F020E,2712178,140800,<Full path to file>"
- '%ProgramFiles(x86)%\repudiandae\eius\aut.exe' e826c0b3be21e50fe4292ff0d924f5e2
