Tool.InstallToolbar.140

Technical Information

Malicious functions:

Executes the following:

'<SYSTEM32>\msiexec.exe' /i ioanhofwieh2 /quiet
'<SYSTEM32>\msiexec.exe' /V
'<SYSTEM32>\msiexec.exe' /i ioanhofwieh1 /quiet

Modifies file system :

Creates the following files:

C:\Config.Msi\224f6.rbs
%PROGRAM_FILES%\tooldev342\Weatherbar\TracersToolbarBHO_x86.dll
%WINDIR%\Installer\MSI1.tmp
<Current directory>\dldcbakcjliccckkmfjcblhciilpdcil1790448337\curl1_1020084093
%WINDIR%\Installer\224f3.msi
%WINDIR%\Installer\224f8.msi
<Current directory>\dldcbakcjliccckkmfjcblhciilpdcil1790448337\curl2_1675156579
%WINDIR%\Installer\$PatchCache$\Managed\3EA247EB59C0CC645B8CF949F2DD3906\1.3.3\F_CENTRAL_msvcr100_x86.DF495DFD_79F6_34DF_BB1E_E58DB5BDCF2C
%WINDIR%\Installer\$PatchCache$\Managed\3EA247EB59C0CC645B8CF949F2DD3906\1.3.3\F_CENTRAL_atl100_x86.DF495DFD_79F6_34DF_BB1E_E58DB5BDCF2C
%WINDIR%\Installer\$PatchCache$\Managed\3EA247EB59C0CC645B8CF949F2DD3906\1.3.3\F_CENTRAL_msvcp100_x86.DF495DFD_79F6_34DF_BB1E_E58DB5BDCF2C
<Current directory>\dldcbakcjliccckkmfjcblhciilpdcil1790448337\ioanhofwieh2
<Current directory>\dldcbakcjliccckkmfjcblhciilpdcil1790448337\chrome\content.js
<Current directory>\dldcbakcjliccckkmfjcblhciilpdcil1790448337\chrome\manifest.json
<Current directory>\dldcbakcjliccckkmfjcblhciilpdcil1790448337\chrome\background.js
<Current directory>\dldcbakcjliccckkmfjcblhciilpdcil1790448337\libcurl.dll
<Current directory>\dldcbakcjliccckkmfjcblhciilpdcil1790448337\chrome\background.html
<Current directory>\dldcbakcjliccckkmfjcblhciilpdcil1790448337\zip.exe
<Current directory>\dldcbakcjliccckkmfjcblhciilpdcil1790448337\ioanhofwieh1
<Current directory>\dldcbakcjliccckkmfjcblhciilpdcil1790448337\sqlite3.exe
<Current directory>\dldcbakcjliccckkmfjcblhciilpdcil1790448337\chrome\options.html
<Current directory>\dldcbakcjliccckkmfjcblhciilpdcil1790448337\firefox.xpi

Deletes the following files:

%WINDIR%\Installer\MSI1.tmp
C:\Config.Msi\224f6.rbs
<Current directory>\dldcbakcjliccckkmfjcblhciilpdcil1790448337\chrome\manifest.json
<Current directory>\dldcbakcjliccckkmfjcblhciilpdcil1790448337\chrome\options.html
<Current directory>\dldcbakcjliccckkmfjcblhciilpdcil1790448337\curl1_1020084093
<Current directory>\dldcbakcjliccckkmfjcblhciilpdcil1790448337\curl2_1675156579
%WINDIR%\Installer\224f3.msi
%WINDIR%\Installer\224f8.msi
<Current directory>\dldcbakcjliccckkmfjcblhciilpdcil1790448337\chrome\content.js
<Current directory>\dldcbakcjliccckkmfjcblhciilpdcil1790448337\ioanhofwieh2
<Current directory>\dldcbakcjliccckkmfjcblhciilpdcil1790448337\libcurl.dll
<Current directory>\dldcbakcjliccckkmfjcblhciilpdcil1790448337\firefox.xpi
<Current directory>\dldcbakcjliccckkmfjcblhciilpdcil1790448337\ioanhofwieh1
<Current directory>\dldcbakcjliccckkmfjcblhciilpdcil1790448337\chrome\background.html
<Current directory>\dldcbakcjliccckkmfjcblhciilpdcil1790448337\chrome\background.js
<Current directory>\dldcbakcjliccckkmfjcblhciilpdcil1790448337\sqlite3.exe
<Current directory>\dldcbakcjliccckkmfjcblhciilpdcil1790448337\zip.exe

Moves the following files:

from <Current directory>\dldcbakcjliccckkmfjcblhciilpdcil1790448337\chrome\background.js.tmp to <Current directory>\dldcbakcjliccckkmfjcblhciilpdcil1790448337\chrome\background.js
from <Current directory>\dldcbakcjliccckkmfjcblhciilpdcil1790448337\chrome\background.html.tmp to <Current directory>\dldcbakcjliccckkmfjcblhciilpdcil1790448337\chrome\background.html
from <Current directory>\dldcbakcjliccckkmfjcblhciilpdcil1790448337\chrome\content.js.tmp to <Current directory>\dldcbakcjliccckkmfjcblhciilpdcil1790448337\chrome\content.js
from <Current directory>\dldcbakcjliccckkmfjcblhciilpdcil1790448337\chrome\options.html.tmp to <Current directory>\dldcbakcjliccckkmfjcblhciilpdcil1790448337\chrome\options.html
from <Current directory>\dldcbakcjliccckkmfjcblhciilpdcil1790448337\chrome\manifest.json.tmp to <Current directory>\dldcbakcjliccckkmfjcblhciilpdcil1790448337\chrome\manifest.json
from <Current directory>\dldcbakcjliccckkmfjcblhciilpdcil1790448337\zip.exe.tmp to <Current directory>\dldcbakcjliccckkmfjcblhciilpdcil1790448337\zip.exe
from <Current directory>\dldcbakcjliccckkmfjcblhciilpdcil1790448337\ioanhofwieh1.tmp to <Current directory>\dldcbakcjliccckkmfjcblhciilpdcil1790448337\ioanhofwieh1
from <Current directory>\dldcbakcjliccckkmfjcblhciilpdcil1790448337\firefox.xpi.tmp to <Current directory>\dldcbakcjliccckkmfjcblhciilpdcil1790448337\firefox.xpi
from <Current directory>\dldcbakcjliccckkmfjcblhciilpdcil1790448337\ioanhofwieh2.tmp to <Current directory>\dldcbakcjliccckkmfjcblhciilpdcil1790448337\ioanhofwieh2
from <Current directory>\dldcbakcjliccckkmfjcblhciilpdcil1790448337\sqlite3.exe.tmp to <Current directory>\dldcbakcjliccckkmfjcblhciilpdcil1790448337\sqlite3.exe
from <Current directory>\dldcbakcjliccckkmfjcblhciilpdcil1790448337\libcurl.dll.tmp to <Current directory>\dldcbakcjliccckkmfjcblhciilpdcil1790448337\libcurl.dll

Network activity:

Connects to:

'in###ooks.org':80

UDP:

DNS ASK in###ooks.org

Miscellaneous:

Searches for the following windows:

ClassName: 'AutoHotkey' WindowName: '<Full path to virus>'

Tecnologie

Termini

Formazione ed informazione

Falsi miti

Technical Information

Curing recommendations

Free trial