Technical Information
Malicious functions
Executes the following
- '%WINDIR%\syswow64\taskkill.exe' /im "ReiSpacer71.exe" /f
Modifies file system
Creates the following files
- %TEMP%\is-6f2d7.tmp\is-cch4b.tmp
- %ProgramFiles(x86)%\reispacer71\skins\blue\is-mfi93.tmp
- %ProgramFiles(x86)%\reispacer71\skins\blue\is-fr7mu.tmp
- %ProgramFiles(x86)%\reispacer71\skins\blue\is-frjfi.tmp
- %ProgramFiles(x86)%\reispacer71\skins\blue\is-or3q4.tmp
- %ProgramFiles(x86)%\reispacer71\skins\blue\is-q4rf9.tmp
- %ProgramFiles(x86)%\reispacer71\skins\blue\is-sni1i.tmp
- %ProgramFiles(x86)%\reispacer71\skins\blue\is-p4lv2.tmp
- %ProgramFiles(x86)%\reispacer71\skins\blue\is-gbdbe.tmp
- %ProgramFiles(x86)%\reispacer71\skins\blue\is-08p2b.tmp
- %ProgramFiles(x86)%\reispacer71\skins\blue\is-vpa63.tmp
- %ProgramFiles(x86)%\reispacer71\skins\blue\is-9ojo6.tmp
- %ProgramFiles(x86)%\reispacer71\skins\blue\is-k9s88.tmp
- %ProgramFiles(x86)%\reispacer71\skins\blue\is-bakja.tmp
- %ProgramFiles(x86)%\reispacer71\skins\blue\is-v2uup.tmp
- %ProgramFiles(x86)%\reispacer71\skins\blue\is-1tsm4.tmp
- %ProgramFiles(x86)%\reispacer71\skins\blue\is-pii2r.tmp
- %ProgramFiles(x86)%\reispacer71\skins\blue\is-q2ink.tmp
- %ProgramFiles(x86)%\reispacer71\skins\blue\is-8p15r.tmp
- %ProgramFiles(x86)%\reispacer71\skins\blue\is-l284u.tmp
- %ProgramFiles(x86)%\reispacer71\skins\blue\is-e9e7r.tmp
- %ProgramFiles(x86)%\reispacer71\skins\blue\is-j307u.tmp
- %ProgramFiles(x86)%\reispacer71\unins000.dat
- %ProgramFiles(x86)%\reispacer71\is-sbkth.tmp
- %ProgramFiles(x86)%\reispacer71\is-0auu4.tmp
- %ProgramFiles(x86)%\reispacer71\skins\blue\is-pvo63.tmp
- %ProgramFiles(x86)%\reispacer71\skins\blue\is-l5tnb.tmp
- %ProgramFiles(x86)%\reispacer71\skins\blue\is-2opfr.tmp
- %ProgramFiles(x86)%\reispacer71\skins\blue\is-9ve9j.tmp
- %ProgramFiles(x86)%\reispacer71\skins\blue\is-2mvdp.tmp
- %ProgramFiles(x86)%\reispacer71\skins\blue\is-vv2i9.tmp
- %ProgramFiles(x86)%\reispacer71\skins\blue\is-u15c7.tmp
- %ProgramFiles(x86)%\reispacer71\skins\blue\is-pk272.tmp
- %ProgramFiles(x86)%\reispacer71\skins\blue\is-0f32m.tmp
- %ProgramFiles(x86)%\reispacer71\skins\blue\is-orovr.tmp
- %ProgramFiles(x86)%\reispacer71\skins\blue\is-hn2lu.tmp
- %ProgramFiles(x86)%\reispacer71\skins\blue\is-lc1gq.tmp
- %ProgramFiles(x86)%\reispacer71\skins\blue\is-7p9a1.tmp
- %ProgramFiles(x86)%\reispacer71\skins\blue\is-id0ka.tmp
- %ProgramFiles(x86)%\reispacer71\skins\blue\is-4nm47.tmp
- %ProgramFiles(x86)%\reispacer71\skins\blue\is-5v552.tmp
- %ProgramFiles(x86)%\reispacer71\skins\blue\is-a3n84.tmp
- %ProgramFiles(x86)%\reispacer71\skins\blue\is-ce7c3.tmp
- %ProgramFiles(x86)%\reispacer71\skins\blue\is-32ehe.tmp
- %ProgramFiles(x86)%\reispacer71\skins\blue\is-3nk35.tmp
- %ProgramFiles(x86)%\reispacer71\skins\blue\is-0e9hh.tmp
- %ProgramFiles(x86)%\reispacer71\is-7i4cq.tmp
- %ProgramFiles(x86)%\reispacer71\skins\blue\is-ikq1d.tmp
- %ProgramFiles(x86)%\reispacer71\skins\blue\is-os7t3.tmp
- %ProgramFiles(x86)%\reispacer71\skins\blue\is-o9mef.tmp
- %ProgramFiles(x86)%\reispacer71\config\is-6t32d.tmp
- %ProgramFiles(x86)%\reispacer71\config\is-vn9p1.tmp
- %ProgramFiles(x86)%\reispacer71\config\is-9b00k.tmp
- %ProgramFiles(x86)%\reispacer71\config\is-nh5s8.tmp
- %ProgramFiles(x86)%\reispacer71\config\is-bq1i0.tmp
- %ProgramFiles(x86)%\reispacer71\is-41bp7.tmp
- %ProgramFiles(x86)%\reispacer71\skins\blue\is-b4uth.tmp
- %ProgramFiles(x86)%\reispacer71\is-46d0v.tmp
- %ProgramFiles(x86)%\reispacer71\is-2603i.tmp
- %ProgramFiles(x86)%\reispacer71\is-rjrra.tmp
- %ProgramFiles(x86)%\reispacer71\is-h2dhh.tmp
- %TEMP%\is-k118q.tmp\_isetup\_iscrypt.dll
- %TEMP%\is-k118q.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-k118q.tmp\_isetup\_setup64.tmp
- %TEMP%\is-k118q.tmp\_isetup\_regdll.tmp
- %ProgramFiles(x86)%\reispacer71\reispacer71.exe
- %ProgramFiles(x86)%\reispacer71\skins\blue\is-s6rt2.tmp
- %ProgramFiles(x86)%\reispacer71\skins\blue\is-biv3c.tmp
- %ProgramFiles(x86)%\reispacer71\skins\blue\is-r82si.tmp
- %ProgramFiles(x86)%\reispacer71\skins\blue\is-fu2v7.tmp
- %ProgramFiles(x86)%\reispacer71\skins\blue\is-adqhf.tmp
- %ProgramFiles(x86)%\reispacer71\skins\blue\is-sd1ea.tmp
- %ProgramFiles(x86)%\reispacer71\skins\blue\is-04jr4.tmp
- %ProgramFiles(x86)%\reispacer71\skins\blue\is-ff8m4.tmp
- %ProgramFiles(x86)%\reispacer71\skins\blue\is-2589c.tmp
- %ProgramFiles(x86)%\reispacer71\skins\blue\is-kisnm.tmp
- %ProgramFiles(x86)%\reispacer71\skins\blue\is-j30oq.tmp
- %ProgramFiles(x86)%\reispacer71\skins\blue\is-2k6bs.tmp
- %ProgramFiles(x86)%\reispacer71\skins\blue\is-5u6r4.tmp
- %ProgramFiles(x86)%\reispacer71\skins\blue\is-d96fr.tmp
- %ProgramFiles(x86)%\reispacer71\skins\blue\is-jp79e.tmp
- %ProgramFiles(x86)%\reispacer71\skins\blue\is-4n3f0.tmp
- %ProgramFiles(x86)%\reispacer71\skins\blue\is-j2r5v.tmp
- %ProgramFiles(x86)%\reispacer71\skins\blue\is-r2at0.tmp
- %ProgramFiles(x86)%\reispacer71\skins\blue\is-nlre8.tmp
- %ProgramFiles(x86)%\reispacer71\skins\blue\is-jirvo.tmp
- %ProgramFiles(x86)%\reispacer71\skins\blue\is-ej2t4.tmp
- %ProgramFiles(x86)%\reispacer71\skins\blue\is-r7e9e.tmp
- %ProgramFiles(x86)%\reispacer71\skins\blue\is-7r92e.tmp
- %APPDATA%\{846ee340-7039-11de-9d20-806e6f6e6963}\akuzf16bnvykr.exe
Deletes the following files
- %ProgramFiles(x86)%\reispacer71\readme.txt
- %TEMP%\is-6f2d7.tmp\is-cch4b.tmp
- %ProgramFiles(x86)%\reispacer71\reispacer71.exe
Moves the following files
- from %ProgramFiles(x86)%\reispacer71\is-h2dhh.tmp to %ProgramFiles(x86)%\reispacer71\unins000.exe
- from %ProgramFiles(x86)%\reispacer71\skins\blue\is-frjfi.tmp to %ProgramFiles(x86)%\reispacer71\skins\blue\label.jpg
- from %ProgramFiles(x86)%\reispacer71\skins\blue\is-or3q4.tmp to %ProgramFiles(x86)%\reispacer71\skins\blue\info_usual.jpg
- from %ProgramFiles(x86)%\reispacer71\skins\blue\is-q4rf9.tmp to %ProgramFiles(x86)%\reispacer71\skins\blue\info_hover.jpg
- from %ProgramFiles(x86)%\reispacer71\skins\blue\is-sni1i.tmp to %ProgramFiles(x86)%\reispacer71\skins\blue\info_disabled.jpg
- from %ProgramFiles(x86)%\reispacer71\skins\blue\is-p4lv2.tmp to %ProgramFiles(x86)%\reispacer71\skins\blue\hvost.jpg
- from %ProgramFiles(x86)%\reispacer71\skins\blue\is-gbdbe.tmp to %ProgramFiles(x86)%\reispacer71\skins\blue\gradient_vert.jpg
- from %ProgramFiles(x86)%\reispacer71\skins\blue\is-l284u.tmp to %ProgramFiles(x86)%\reispacer71\skins\blue\gradient_horiz.jpg
- from %ProgramFiles(x86)%\reispacer71\skins\blue\is-fr7mu.tmp to %ProgramFiles(x86)%\reispacer71\skins\blue\label_a_1.jpg
- from %ProgramFiles(x86)%\reispacer71\skins\blue\is-ce7c3.tmp to %ProgramFiles(x86)%\reispacer71\skins\blue\fon_statistic_hover.jpg
- from %ProgramFiles(x86)%\reispacer71\skins\blue\is-k9s88.tmp to %ProgramFiles(x86)%\reispacer71\skins\blue\fon.jpg
- from %ProgramFiles(x86)%\reispacer71\skins\blue\is-bakja.tmp to %ProgramFiles(x86)%\reispacer71\skins\blue\edit_usual.jpg
- from %ProgramFiles(x86)%\reispacer71\skins\blue\is-v2uup.tmp to %ProgramFiles(x86)%\reispacer71\skins\blue\edit_hover.jpg
- from %ProgramFiles(x86)%\reispacer71\skins\blue\is-1tsm4.tmp to %ProgramFiles(x86)%\reispacer71\skins\blue\edit_disabled.jpg
- from %ProgramFiles(x86)%\reispacer71\skins\blue\is-pii2r.tmp to %ProgramFiles(x86)%\reispacer71\skins\blue\delete_usual.jpg
- from %ProgramFiles(x86)%\reispacer71\skins\blue\is-q2ink.tmp to %ProgramFiles(x86)%\reispacer71\skins\blue\delete_hover.jpg
- from %ProgramFiles(x86)%\reispacer71\skins\blue\is-8p15r.tmp to %ProgramFiles(x86)%\reispacer71\skins\blue\delete_disabled.jpg
- from %ProgramFiles(x86)%\reispacer71\skins\blue\is-9ojo6.tmp to %ProgramFiles(x86)%\reispacer71\skins\blue\fon_statistic.jpg
- from %ProgramFiles(x86)%\reispacer71\skins\blue\is-mfi93.tmp to %ProgramFiles(x86)%\reispacer71\skins\blue\label_a_2.jpg
- from %ProgramFiles(x86)%\reispacer71\skins\blue\is-vpa63.tmp to %ProgramFiles(x86)%\reispacer71\skins\blue\label_sel.jpg
- from %ProgramFiles(x86)%\reispacer71\skins\blue\is-08p2b.tmp to %ProgramFiles(x86)%\reispacer71\skins\blue\leftandright.jpg
- from %ProgramFiles(x86)%\reispacer71\skins\blue\is-l5tnb.tmp to %ProgramFiles(x86)%\reispacer71\skins\blue\unselect_disabled.jpg
- from %ProgramFiles(x86)%\reispacer71\skins\blue\is-2opfr.tmp to %ProgramFiles(x86)%\reispacer71\skins\blue\ugol_left_top.jpg
- from %ProgramFiles(x86)%\reispacer71\skins\blue\is-9ve9j.tmp to %ProgramFiles(x86)%\reispacer71\skins\blue\ugol2_right_top.jpg
- from %ProgramFiles(x86)%\reispacer71\skins\blue\is-2mvdp.tmp to %ProgramFiles(x86)%\reispacer71\skins\blue\ugol2_right_bottom.jpg
- from %ProgramFiles(x86)%\reispacer71\skins\blue\is-vv2i9.tmp to %ProgramFiles(x86)%\reispacer71\skins\blue\ugol2_left_top.jpg
- from %ProgramFiles(x86)%\reispacer71\skins\blue\is-u15c7.tmp to %ProgramFiles(x86)%\reispacer71\skins\blue\ugol2_left_bottom.jpg
- from %ProgramFiles(x86)%\reispacer71\skins\blue\is-pk272.tmp to %ProgramFiles(x86)%\reispacer71\skins\blue\topanddown2.jpg
- from %ProgramFiles(x86)%\reispacer71\skins\blue\is-0f32m.tmp to %ProgramFiles(x86)%\reispacer71\skins\blue\topanddown.jpg
- from %ProgramFiles(x86)%\reispacer71\skins\blue\is-orovr.tmp to %ProgramFiles(x86)%\reispacer71\skins\blue\select_usual.jpg
- from %ProgramFiles(x86)%\reispacer71\skins\blue\is-hn2lu.tmp to %ProgramFiles(x86)%\reispacer71\skins\blue\select_hover.jpg
- from %ProgramFiles(x86)%\reispacer71\skins\blue\is-lc1gq.tmp to %ProgramFiles(x86)%\reispacer71\skins\blue\select_disabled.jpg
- from %ProgramFiles(x86)%\reispacer71\skins\blue\is-7p9a1.tmp to %ProgramFiles(x86)%\reispacer71\skins\blue\progress.jpg
- from %ProgramFiles(x86)%\reispacer71\skins\blue\is-id0ka.tmp to %ProgramFiles(x86)%\reispacer71\skins\blue\point3.jpg
- from %ProgramFiles(x86)%\reispacer71\skins\blue\is-4nm47.tmp to %ProgramFiles(x86)%\reispacer71\skins\blue\point2.jpg
- from %ProgramFiles(x86)%\reispacer71\skins\blue\is-5v552.tmp to %ProgramFiles(x86)%\reispacer71\skins\blue\point.jpg
- from %ProgramFiles(x86)%\reispacer71\skins\blue\is-s6rt2.tmp to %ProgramFiles(x86)%\reispacer71\skins\blue\logo.jpg
- from %ProgramFiles(x86)%\reispacer71\skins\blue\is-j307u.tmp to %ProgramFiles(x86)%\reispacer71\skins\blue\leftandright2.jpg
- from %ProgramFiles(x86)%\reispacer71\skins\blue\is-a3n84.tmp to %ProgramFiles(x86)%\reispacer71\skins\blue\btn_ok_usual.jpg
- from %ProgramFiles(x86)%\reispacer71\skins\blue\is-pvo63.tmp to %ProgramFiles(x86)%\reispacer71\skins\blue\unselect_hover.jpg
- from %ProgramFiles(x86)%\reispacer71\skins\blue\is-32ehe.tmp to %ProgramFiles(x86)%\reispacer71\skins\blue\btn_ok_hover.jpg
- from %ProgramFiles(x86)%\reispacer71\skins\blue\is-0e9hh.tmp to %ProgramFiles(x86)%\reispacer71\skins\blue\btn_cancel_hover.jpg
- from %ProgramFiles(x86)%\reispacer71\skins\blue\is-biv3c.tmp to %ProgramFiles(x86)%\reispacer71\skins\blue\btncleanstop_hover.jpg
- from %ProgramFiles(x86)%\reispacer71\skins\blue\is-b4uth.tmp to %ProgramFiles(x86)%\reispacer71\skins\blue\btnabout_usual.jpg
- from %ProgramFiles(x86)%\reispacer71\skins\blue\is-fu2v7.tmp to %ProgramFiles(x86)%\reispacer71\skins\blue\btnabout_hover.jpg
- from %ProgramFiles(x86)%\reispacer71\skins\blue\is-ikq1d.tmp to %ProgramFiles(x86)%\reispacer71\skins\blue\btnabout_disabled.jpg
- from %ProgramFiles(x86)%\reispacer71\skins\blue\is-os7t3.tmp to %ProgramFiles(x86)%\reispacer71\skins\blue\add_usual.jpg
- from %ProgramFiles(x86)%\reispacer71\skins\blue\is-o9mef.tmp to %ProgramFiles(x86)%\reispacer71\skins\blue\add_hover.jpg
- from %ProgramFiles(x86)%\reispacer71\config\is-6t32d.tmp to %ProgramFiles(x86)%\reispacer71\config\usrtempdirs.dat
- from %ProgramFiles(x86)%\reispacer71\skins\blue\is-e9e7r.tmp to %ProgramFiles(x86)%\reispacer71\skins\blue\btncleanstop_usual.jpg
- from %ProgramFiles(x86)%\reispacer71\config\is-vn9p1.tmp to %ProgramFiles(x86)%\reispacer71\config\settings.dat
- from %ProgramFiles(x86)%\reispacer71\config\is-nh5s8.tmp to %ProgramFiles(x86)%\reispacer71\config\exclusions.dat
- from %ProgramFiles(x86)%\reispacer71\config\is-bq1i0.tmp to %ProgramFiles(x86)%\reispacer71\config\exclusiondirs.dat
- from %ProgramFiles(x86)%\reispacer71\is-7i4cq.tmp to %ProgramFiles(x86)%\reispacer71\readme.txt
- from %ProgramFiles(x86)%\reispacer71\is-41bp7.tmp to %ProgramFiles(x86)%\reispacer71\notify.wav
- from %ProgramFiles(x86)%\reispacer71\is-46d0v.tmp to %ProgramFiles(x86)%\reispacer71\history.txt
- from %ProgramFiles(x86)%\reispacer71\is-2603i.tmp to %ProgramFiles(x86)%\reispacer71\backup_u.dll
- from %ProgramFiles(x86)%\reispacer71\is-rjrra.tmp to %ProgramFiles(x86)%\reispacer71\backup_c.dll
- from %ProgramFiles(x86)%\reispacer71\config\is-9b00k.tmp to %ProgramFiles(x86)%\reispacer71\config\filemask.dat
- from %ProgramFiles(x86)%\reispacer71\skins\blue\is-7r92e.tmp to %ProgramFiles(x86)%\reispacer71\skins\blue\btnclean_disabled.jpg
- from %ProgramFiles(x86)%\reispacer71\skins\blue\is-r82si.tmp to %ProgramFiles(x86)%\reispacer71\skins\blue\btnclean_hover.jpg
- from %ProgramFiles(x86)%\reispacer71\skins\blue\is-r7e9e.tmp to %ProgramFiles(x86)%\reispacer71\skins\blue\btnclean_usual.jpg
- from %ProgramFiles(x86)%\reispacer71\skins\blue\is-adqhf.tmp to %ProgramFiles(x86)%\reispacer71\skins\blue\btnstop_usual.jpg
- from %ProgramFiles(x86)%\reispacer71\skins\blue\is-sd1ea.tmp to %ProgramFiles(x86)%\reispacer71\skins\blue\btnstop_hover.jpg
- from %ProgramFiles(x86)%\reispacer71\skins\blue\is-04jr4.tmp to %ProgramFiles(x86)%\reispacer71\skins\blue\btnstatistic_usual.jpg
- from %ProgramFiles(x86)%\reispacer71\skins\blue\is-ff8m4.tmp to %ProgramFiles(x86)%\reispacer71\skins\blue\btnstatistic_hover.jpg
- from %ProgramFiles(x86)%\reispacer71\skins\blue\is-2589c.tmp to %ProgramFiles(x86)%\reispacer71\skins\blue\btnstatistic_disabled.jpg
- from %ProgramFiles(x86)%\reispacer71\skins\blue\is-kisnm.tmp to %ProgramFiles(x86)%\reispacer71\skins\blue\btnsettings_usual.jpg
- from %ProgramFiles(x86)%\reispacer71\skins\blue\is-j30oq.tmp to %ProgramFiles(x86)%\reispacer71\skins\blue\btnsettings_hover.jpg
- from %ProgramFiles(x86)%\reispacer71\skins\blue\is-2k6bs.tmp to %ProgramFiles(x86)%\reispacer71\skins\blue\btnsettings_disabled.jpg
- from %ProgramFiles(x86)%\reispacer71\skins\blue\is-5u6r4.tmp to %ProgramFiles(x86)%\reispacer71\skins\blue\btnsearch_usual.jpg
- from %ProgramFiles(x86)%\reispacer71\skins\blue\is-d96fr.tmp to %ProgramFiles(x86)%\reispacer71\skins\blue\btnsearch_hover.jpg
- from %ProgramFiles(x86)%\reispacer71\skins\blue\is-jp79e.tmp to %ProgramFiles(x86)%\reispacer71\skins\blue\btnsearch_disabled.jpg
- from %ProgramFiles(x86)%\reispacer71\skins\blue\is-4n3f0.tmp to %ProgramFiles(x86)%\reispacer71\skins\blue\btnexit_usual.jpg
- from %ProgramFiles(x86)%\reispacer71\skins\blue\is-j2r5v.tmp to %ProgramFiles(x86)%\reispacer71\skins\blue\btnexit_hover.jpg
- from %ProgramFiles(x86)%\reispacer71\skins\blue\is-r2at0.tmp to %ProgramFiles(x86)%\reispacer71\skins\blue\btnexclus_usual.jpg
- from %ProgramFiles(x86)%\reispacer71\skins\blue\is-nlre8.tmp to %ProgramFiles(x86)%\reispacer71\skins\blue\btnexclus_hover.jpg
- from %ProgramFiles(x86)%\reispacer71\skins\blue\is-jirvo.tmp to %ProgramFiles(x86)%\reispacer71\skins\blue\btnclose_usual.jpg
- from %ProgramFiles(x86)%\reispacer71\skins\blue\is-ej2t4.tmp to %ProgramFiles(x86)%\reispacer71\skins\blue\btnclose_hover.jpg
- from %ProgramFiles(x86)%\reispacer71\skins\blue\is-3nk35.tmp to %ProgramFiles(x86)%\reispacer71\skins\blue\btn_cancel_usual.jpg
- from %ProgramFiles(x86)%\reispacer71\is-sbkth.tmp to %ProgramFiles(x86)%\reispacer71\reispacer71.exe
Substitutes the following files
- %ProgramFiles(x86)%\reispacer71\readme.txt
Network activity
Connects to
- '45.##.253.56':80
- '45.##.253.72':80
- '45.##.253.75':80
TCP
HTTP GET requests
- http://45.##.253.56/advertisting/plus.php?s=###############################
- http://45.##.253.72/default/stuk.php
- http://45.##.253.72/default/puk.php
- http://45.##.253.75/dll.php
Miscellaneous
Searches for the following windows
- ClassName: 'z9d919_ReiSpacer71Class_z9d919' WindowName: ''
- ClassName: '' WindowName: ''
Creates and executes the following
- '%TEMP%\is-6f2d7.tmp\is-cch4b.tmp' /SL4 $F0248 "<Full path to file>" 989431 139776
- '%ProgramFiles(x86)%\reispacer71\reispacer71.exe'
- '%APPDATA%\{846ee340-7039-11de-9d20-806e6f6e6963}\akuzf16bnvykr.exe'
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /im "ReiSpacer71.exe" /f & erase "%ProgramFiles(x86)%\ReiSpacer71\ReiSpacer71.exe" & exit' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\net.exe' helpmsg 1
- '%WINDIR%\syswow64\net1.exe' helpmsg 1
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /im "ReiSpacer71.exe" /f & erase "%ProgramFiles(x86)%\ReiSpacer71\ReiSpacer71.exe" & exit
