Technical Information
Modifies file system
Creates the following files
- D:\windows\system32\config\software.log1
- D:\windows\system32\winevt\logs\microsoft-windows-networkprofile%4operational.evtx
- D:\windows\system32\winevt\logs\security.evtx
- D:\windows\system32\winevt\logs\system.evtx
- D:\windows\system32\config\system
- D:\windows\system32\config\system.log1
- D:\users\user\appdata\local\temp\license.txt
- D:\system volume information\syscache.hve
- D:\system volume information\syscache.hve.log1
- D:\users\user\appdata\local\microsoft\windows\usrclass.dat
- D:\users\user\appdata\local\microsoft\windows\usrclass.dat.log1
- D:\windows\appcompat\programs\recentfilecache.bcf
- D:\program files (x86)\vlitesort\vlitesort323.exe
- D:\program files (x86)\vlitesort\unins000.dat
- D:\program files (x86)\vlitesort\is-6gvb0.tmp
- D:\program files (x86)\vlitesort\is-93o3n.tmp
- D:\program files (x86)\vlitesort\is-8te03.tmp
- D:\program files (x86)\vlitesort\is-g7o07.tmp
- D:\program files (x86)\vlitesort\is-slo83.tmp
- D:\program files (x86)\vlitesort\is-afq64.tmp
- D:\users\user\ntuser.dat
- D:\users\user\appdata\local\temp\is-tmdqp.tmp\_isetup\_iscrypt.dll
- D:\users\user\ntuser.dat.log1
- D:\users\user\appdata\local\temp\is-tmdqp.tmp\_isetup\_shfoldr.dll
- D:\users\user\appdata\local\temp\is-tmdqp.tmp\_isetup\_setup64.tmp
- D:\users\user\appdata\local\temp\is-tmdqp.tmp\_isetup\_regdll.tmp
- D:\users\user\appdata\local\temp\is-2jkbr.tmp\is-oe3mk.tmp
- D:\windows\system32\config\software
- D:\windows\system32\winevt\logs\application.evtx
- D:\windows\serviceprofiles\localservice\appdata\local\lastalive1.dat
Moves the following files
- from D:\program files (x86)\vlitesort\is-afq64.tmp to D:\program files (x86)\vlitesort\unins000.exe
- from D:\program files (x86)\vlitesort\is-slo83.tmp to D:\program files (x86)\vlitesort\vlitesort323.exe
- from D:\program files (x86)\vlitesort\is-g7o07.tmp to D:\program files (x86)\vlitesort\settings.ini
- from D:\program files (x86)\vlitesort\is-8te03.tmp to D:\program files (x86)\vlitesort\langs.ini
- from D:\program files (x86)\vlitesort\is-93o3n.tmp to D:\program files (x86)\vlitesort\help.html
- from D:\program files (x86)\vlitesort\is-6gvb0.tmp to D:\program files (x86)\vlitesort\license.txt
Network activity
Connects to
- 'jo####rdmust.sbs':80
TCP
HTTP GET requests
- http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?64########
HTTP POST requests
- http://jo####rdmust.sbs/new/net_api
UDP
- DNS ASK jo####rdmust.sbs
Miscellaneous
Searches for the following windows
- ClassName: 'be7481_vLiteSort323Class_be7481' WindowName: ''
- ClassName: 'SystemTray_Main' WindowName: ''
Creates and executes the following
- 'D:\users\user\appdata\local\temp\is-2jkbr.tmp\is-oe3mk.tmp' /SL4 $6023A "<Full path to file>" 3392077 48128
- 'D:\program files (x86)\vlitesort\vlitesort323.exe'
- 'D:\program files (x86)\vlitesort\vlitesort323.exe' 8d97490bab411b407279c336fad3ef8b
