Technical Information
Modifies file system
Creates the following files
- %TEMP%\is-efct6.tmp\<File name>.tmp
- %LOCALAPPDATA%\multimedia server\is-jhac2.tmp
- %LOCALAPPDATA%\multimedia server\libav\is-8mk9h.tmp
- %LOCALAPPDATA%\multimedia server\libav\is-tg0gf.tmp
- %LOCALAPPDATA%\multimedia server\libav\is-o4b2n.tmp
- %LOCALAPPDATA%\multimedia server\libav\is-opib0.tmp
- %LOCALAPPDATA%\multimedia server\libav\is-q28vg.tmp
- %LOCALAPPDATA%\multimedia server\libav\is-04rlf.tmp
- %LOCALAPPDATA%\multimedia server\libav\is-s9c53.tmp
- %LOCALAPPDATA%\multimedia server\libav\is-dplgs.tmp
- %LOCALAPPDATA%\multimedia server\is-gua6s.tmp
- %LOCALAPPDATA%\multimedia server\is-vbf7h.tmp
- %LOCALAPPDATA%\multimedia server\is-po20h.tmp
- %LOCALAPPDATA%\multimedia server\is-6thuv.tmp
- %LOCALAPPDATA%\multimedia server\is-gulvt.tmp
- %LOCALAPPDATA%\multimedia server\is-llipu.tmp
- %LOCALAPPDATA%\multimedia server\is-kt2v6.tmp
- %LOCALAPPDATA%\multimedia server\is-6enag.tmp
- %LOCALAPPDATA%\multimedia server\is-097eq.tmp
- %LOCALAPPDATA%\multimedia server\is-9kgju.tmp
- %LOCALAPPDATA%\multimedia server\is-hnffd.tmp
- %LOCALAPPDATA%\multimedia server\is-o9gso.tmp
- %LOCALAPPDATA%\multimedia server\is-j6ors.tmp
- %LOCALAPPDATA%\multimedia server\is-u2vgo.tmp
- %TEMP%\is-6k43c.tmp\_isetup\_iscrypt.dll
- %TEMP%\is-6k43c.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-6k43c.tmp\_isetup\_setup64.tmp
- %TEMP%\is-6k43c.tmp\_isetup\_regdll.tmp
- %LOCALAPPDATA%\multimedia server\unins000.dat
- %LOCALAPPDATA%\multimedia server\multimediaserver32.exe
Moves the following files
- from %LOCALAPPDATA%\multimedia server\is-u2vgo.tmp to %LOCALAPPDATA%\multimedia server\unins000.exe
- from %LOCALAPPDATA%\multimedia server\libav\is-tg0gf.tmp to %LOCALAPPDATA%\multimedia server\libav\sdl.dll
- from %LOCALAPPDATA%\multimedia server\libav\is-o4b2n.tmp to %LOCALAPPDATA%\multimedia server\libav\mobile.ffpreset
- from %LOCALAPPDATA%\multimedia server\libav\is-opib0.tmp to %LOCALAPPDATA%\multimedia server\libav\avutil-50.dll
- from %LOCALAPPDATA%\multimedia server\libav\is-q28vg.tmp to %LOCALAPPDATA%\multimedia server\libav\avformat-52.dll
- from %LOCALAPPDATA%\multimedia server\libav\is-04rlf.tmp to %LOCALAPPDATA%\multimedia server\libav\avfilter-1.dll
- from %LOCALAPPDATA%\multimedia server\libav\is-s9c53.tmp to %LOCALAPPDATA%\multimedia server\libav\avdevice-52.dll
- from %LOCALAPPDATA%\multimedia server\libav\is-dplgs.tmp to %LOCALAPPDATA%\multimedia server\libav\avcore-0.dll
- from %LOCALAPPDATA%\multimedia server\is-gua6s.tmp to %LOCALAPPDATA%\multimedia server\zlib1.dll
- from %LOCALAPPDATA%\multimedia server\is-vbf7h.tmp to %LOCALAPPDATA%\multimedia server\qtgmic.dll
- from %LOCALAPPDATA%\multimedia server\libav\is-8mk9h.tmp to %LOCALAPPDATA%\multimedia server\libav\swscale-0.dll
- from %LOCALAPPDATA%\multimedia server\is-po20h.tmp to %LOCALAPPDATA%\multimedia server\libwinpthread-1.dll
- from %LOCALAPPDATA%\multimedia server\is-gulvt.tmp to %LOCALAPPDATA%\multimedia server\libgmic.dll
- from %LOCALAPPDATA%\multimedia server\is-llipu.tmp to %LOCALAPPDATA%\multimedia server\libgcc_s_dw2-1.dll
- from %LOCALAPPDATA%\multimedia server\is-kt2v6.tmp to %LOCALAPPDATA%\multimedia server\msvcr120.dll
- from %LOCALAPPDATA%\multimedia server\is-6enag.tmp to %LOCALAPPDATA%\multimedia server\ssleay32.dll
- from %LOCALAPPDATA%\multimedia server\is-097eq.tmp to %LOCALAPPDATA%\multimedia server\libeay32.dll
- from %LOCALAPPDATA%\multimedia server\is-9kgju.tmp to %LOCALAPPDATA%\multimedia server\uninstallutils.dll
- from %LOCALAPPDATA%\multimedia server\is-hnffd.tmp to %LOCALAPPDATA%\multimedia server\libmpfr-4.dll
- from %LOCALAPPDATA%\multimedia server\is-o9gso.tmp to %LOCALAPPDATA%\multimedia server\libgmp-10.dll
- from %LOCALAPPDATA%\multimedia server\is-j6ors.tmp to %LOCALAPPDATA%\multimedia server\instutils.exe
- from %LOCALAPPDATA%\multimedia server\is-6thuv.tmp to %LOCALAPPDATA%\multimedia server\libstdc++-6.dll
- from %LOCALAPPDATA%\multimedia server\is-jhac2.tmp to %LOCALAPPDATA%\multimedia server\multimediaserver32.exe
Network activity
Connects to
- 'st###7345724.ru':80
TCP
HTTP POST requests
- http://st###7345724.ru/new/net_api
UDP
- DNS ASK st###7345724.ru
Miscellaneous
Searches for the following windows
- ClassName: 'X%x_hitWnd_10112cd28b1' WindowName: ''
Creates and executes the following
- '%TEMP%\is-efct6.tmp\<File name>.tmp' /SL5="$5024E,8365245,54272,<Full path to file>"
- '%LOCALAPPDATA%\multimedia server\multimediaserver32.exe' b1b9e95b046660a9405770535f3b0d21
Executes the following
- '%WINDIR%\syswow64\schtasks.exe' /Delete /F /TN "multi_media_server_10111"
