Technical Information
Malicious functions
To complicate detection of its presence in the operating system,
adds antivirus exclusion:
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -Command Set-ExecutionPolicy Unrestricted ; add-MpPreference -ExclusionPath %ALLUSERSPROFILE%,C:\Users\Public\Documents,'C:\Program Files (x86)','C:\Program Files','C:\Users\Public\Videos','C:...
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -Command "Set-ExecutionPolicy Unrestricted ; add-MpPreference -ExclusionPath "C:\Users\Public\Music","C:\Users\Public\Videos","%ALLUSERSPROFILE%","C:\Users\Public\Documents",'C:\Users\Public\Do...
Modifies file system
Creates the following files
- %TEMP%\is-22u1uqkvwr.tmp\<File name>.tmp
- %TEMP%\is-f8jnlomjup.tmp\_isetup\_setup64.tmp
- %APPDATA%\cm_juikukku5723\ca658\64997c6ce\dad11c2770\02da79a\5c68128\is-wjwzqdkl9w.tmp
- C:\users\public\documents\x86-microsoft-winfile\icifevorlqgg\is-nfdf7cxk0g.tmp
- C:\users\public\documents\is-zsbmyvakd1.tmp
- C:\users\public\documents\is-sl0h57mvd6.tmp
- C:\users\public\documents\is-e0ubdgahqs.tmp
- C:\users\public\documents\is-0gxwwj47xy.tmp
- C:\users\public\documents\is-qsyxl0pb2q.tmp
- C:\users\public\documents\is-0drs4e6bof.tmp
- C:\users\public\documents\is-fvf2qe9fga.tmp
- %ALLUSERSPROFILE%\is-6mczh4l01l.tmp
- %ALLUSERSPROFILE%\is-aeuvifu2bi.tmp
- %ALLUSERSPROFILE%\is-kzlgoqtw4d.tmp
- %ALLUSERSPROFILE%\is-bmo3daxjyw.tmp
- C:\users\public\documents\x86-microsoft-winfile\icifevorlqgg\is-ypg4vqid74.tmp
- C:\users\public\documents\x86-microsoft-winfile\icifevorlqgg\is-1pt2huxyaj.tmp
- C:\users\public\documents\x86-microsoft-winfile\icifevorlqgg\is-h9opedk24f.tmp
- C:\users\public\documents\x86-microsoft-winfile\icifevorlqgg\is-l6lrcvxojn.tmp
- C:\users\public\documents\is-soijym2rrl.tmp
- C:\users\public\documents\is-vsg055zzae.tmp
- C:\users\public\documents\is-paklc9b5be.tmp
- C:\users\public\documents\x86-microsoft-winfile\icifevorlqgg\is-2aue4scueh.tmp
- C:\users\public\documents\x86-microsoft-winfile\icifevorlqgg\is-894gnhj4g3.tmp
- C:\users\public\documents\x86-microsoft-winfile\icifevorlqgg\is-0zts8qxlky.tmp
- %APPDATA%\cm_juikukku5723\bd2c55\c7c46\218d88\d1c7b8\1408e593\is-z5n6xpzg3w.tmp
- C:\users\public\documents\x86-microsoft-winfile\icifevorlqgg\dll1.dll
- C:\users\public\documents\x86-microsoft-winfile\icifevorlqgg\libcef.dll
- C:\users\public\documents\x86-microsoft-winfile\icifevorlqgg\agnisubmak.exe
- C:\users\public\documents\dll1.dll
- C:\users\public\documents\libcef.dll
- C:\users\public\documents\taskload.exe
- C:\users\public\pictures\consys21.png
- %ALLUSERSPROFILE%\yybabadefcde.dat
- C:\$recylle.bin\torchwooc
- C:\users\public\pictures\consysfun.png
- C:\users\public\documents\install.ini
- C:\users\public\videos\install.ini
- C:\users\public\pictures\install.ini
- %ALLUSERSPROFILE%\cba.bat
- C:\users\public\documents\recslle.bin\system\update.ini
- %ALLUSERSPROFILE%\a.ini
- %ALLUSERSPROFILE%\dx.vbs
- %ALLUSERSPROFILE%\l.dll
- %ALLUSERSPROFILE%\agghosts.exe
- %ALLUSERSPROFILE%\vcruntime140.dll
- %ALLUSERSPROFILE%\_3.dll
- %ALLUSERSPROFILE%\dll1.dll
Deletes following files that it created itself
- %TEMP%\is-f8jnlomjup.tmp\_isetup\_setup64.tmp
- %TEMP%\is-22u1uqkvwr.tmp\<File name>.tmp
Moves the following files
- from %APPDATA%\cm_juikukku5723\ca658\64997c6ce\dad11c2770\02da79a\5c68128\is-wjwzqdkl9w.tmp to %APPDATA%\cm_juikukku5723\ca658\64997c6ce\dad11c2770\02da79a\5c68128\e3aa5aca0f27af6afbe936.2dc
- from C:\users\public\documents\x86-microsoft-winfile\icifevorlqgg\is-nfdf7cxk0g.tmp to C:\users\public\documents\x86-microsoft-winfile\icifevorlqgg\ws_log.dll
- from C:\users\public\documents\is-zsbmyvakd1.tmp to C:\users\public\documents\ws_log.dll
- from C:\users\public\documents\is-sl0h57mvd6.tmp to C:\users\public\documents\instal.ini
- from C:\users\public\documents\is-e0ubdgahqs.tmp to C:\users\public\documents\_8
- from C:\users\public\documents\is-0gxwwj47xy.tmp to C:\users\public\documents\ins.ini
- from C:\users\public\documents\is-qsyxl0pb2q.tmp to C:\users\public\documents\fouriertransformlib8.dll
- from C:\users\public\documents\is-0drs4e6bof.tmp to C:\users\public\documents\imagerestorelib8.dll
- from C:\users\public\documents\is-fvf2qe9fga.tmp to C:\users\public\documents\wavelet_3_8.dll
- from %ALLUSERSPROFILE%\is-6mczh4l01l.tmp to %ALLUSERSPROFILE%\44
- from %ALLUSERSPROFILE%\is-aeuvifu2bi.tmp to %ALLUSERSPROFILE%\55
- from %ALLUSERSPROFILE%\is-kzlgoqtw4d.tmp to %ALLUSERSPROFILE%\66
- from %ALLUSERSPROFILE%\is-bmo3daxjyw.tmp to %ALLUSERSPROFILE%\77
- from C:\users\public\documents\x86-microsoft-winfile\icifevorlqgg\is-ypg4vqid74.tmp to C:\users\public\documents\x86-microsoft-winfile\icifevorlqgg\fouriertransformlib8.dll
- from C:\users\public\documents\x86-microsoft-winfile\icifevorlqgg\is-1pt2huxyaj.tmp to C:\users\public\documents\x86-microsoft-winfile\icifevorlqgg\imagerestorelib8.dll
- from C:\users\public\documents\x86-microsoft-winfile\icifevorlqgg\is-h9opedk24f.tmp to C:\users\public\documents\x86-microsoft-winfile\icifevorlqgg\wavelet_3_8.dll
- from C:\users\public\documents\x86-microsoft-winfile\icifevorlqgg\is-l6lrcvxojn.tmp to C:\users\public\documents\x86-microsoft-winfile\icifevorlqgg\_8
- from C:\users\public\documents\is-soijym2rrl.tmp to C:\users\public\documents\taskload.exe
- from C:\users\public\documents\is-vsg055zzae.tmp to C:\users\public\documents\libcef.dll
- from C:\users\public\documents\is-paklc9b5be.tmp to C:\users\public\documents\dll1.dll
- from C:\users\public\documents\x86-microsoft-winfile\icifevorlqgg\is-2aue4scueh.tmp to C:\users\public\documents\x86-microsoft-winfile\icifevorlqgg\agnisubmak.exe
- from C:\users\public\documents\x86-microsoft-winfile\icifevorlqgg\is-894gnhj4g3.tmp to C:\users\public\documents\x86-microsoft-winfile\icifevorlqgg\libcef.dll
- from C:\users\public\documents\x86-microsoft-winfile\icifevorlqgg\is-0zts8qxlky.tmp to C:\users\public\documents\x86-microsoft-winfile\icifevorlqgg\dll1.dll
- from %APPDATA%\cm_juikukku5723\bd2c55\c7c46\218d88\d1c7b8\1408e593\is-z5n6xpzg3w.tmp to %APPDATA%\cm_juikukku5723\bd2c55\c7c46\218d88\d1c7b8\1408e593\std_7.0.0.1030
Network activity
Connects to
- '14#.#2.63.179':443
TCP
Other
- '14#.#2.63.179':443
Miscellaneous
Creates and executes the following
- '%TEMP%\is-22u1uqkvwr.tmp\<File name>.tmp' /SL5="$80176,83093047,872448,<Full path to file>"
- 'C:\users\public\documents\x86-microsoft-winfile\icifevorlqgg\agnisubmak.exe'
- 'C:\users\public\documents\taskload.exe'
Executes the following
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -Command Set-ExecutionPolicy Unrestricted
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -NoProfile -Command "(Get-MpPreference).ExclusionPath"
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -Command Set-ExecutionPolicy Unrestricted ; add-MpPreference -ExclusionPath %ALLUSERSPROFILE%,C:\Users\Public\Documents,'C:\Program Files (x86)','C:\Program Files','C:\Users\Public\Videos','C:...' (with hidden window)
- 'C:\users\public\documents\taskload.exe' ' (with hidden window)
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -Command Set-ExecutionPolicy Unrestricted' (with hidden window)
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -Command "Set-ExecutionPolicy Unrestricted ; add-MpPreference -ExclusionPath "C:\Users\Public\Music","C:\Users\Public\Videos","%ALLUSERSPROFILE%","C:\Users\Public\Documents",'C:\Users\Public\Do...' (with hidden window)
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -NoProfile -Command "(Get-MpPreference).ExclusionPath"' (with hidden window)
