Trojan.DownLoader47.1320

Техническая информация

Изменения в файловой системе

Создает следующие файлы

%TEMP%\is-miin1.tmp\<Имя файла>.tmp
%LOCALAPPDATA%\any audio converter\is-gahg6.tmp
%LOCALAPPDATA%\any audio converter\is-8go6d.tmp
%LOCALAPPDATA%\any audio converter\printsupport\is-06jcg.tmp
%LOCALAPPDATA%\any audio converter\platforms\is-4qfj5.tmp
%LOCALAPPDATA%\any audio converter\platforms\is-dv7ho.tmp
%LOCALAPPDATA%\any audio converter\platforms\is-7kjgt.tmp
%LOCALAPPDATA%\any audio converter\imageformats\is-76cpj.tmp
%LOCALAPPDATA%\any audio converter\imageformats\is-0d0b6.tmp
%LOCALAPPDATA%\any audio converter\is-st2vu.tmp
%LOCALAPPDATA%\any audio converter\is-m9tqo.tmp
%LOCALAPPDATA%\any audio converter\is-k1tsv.tmp
%LOCALAPPDATA%\any audio converter\is-nsfnl.tmp
%LOCALAPPDATA%\any audio converter\is-ip8f1.tmp
%LOCALAPPDATA%\any audio converter\is-f1sr5.tmp
%LOCALAPPDATA%\any audio converter\is-grckr.tmp
%LOCALAPPDATA%\any audio converter\is-0fghr.tmp
%LOCALAPPDATA%\any audio converter\is-lejn9.tmp
%LOCALAPPDATA%\any audio converter\is-4aqtd.tmp
%LOCALAPPDATA%\any audio converter\is-7jj3g.tmp
%LOCALAPPDATA%\any audio converter\is-brj6v.tmp
%LOCALAPPDATA%\any audio converter\is-ajpkt.tmp
%LOCALAPPDATA%\any audio converter\is-4r10o.tmp
%LOCALAPPDATA%\any audio converter\is-vihf5.tmp
%LOCALAPPDATA%\any audio converter\is-c0fo9.tmp
%LOCALAPPDATA%\any audio converter\is-hqa85.tmp
%TEMP%\is-rggod.tmp\_isetup\_iscrypt.dll
%TEMP%\is-rggod.tmp\_isetup\_isdecmp.dll
%TEMP%\is-rggod.tmp\_isetup\_shfoldr.dll
%TEMP%\is-rggod.tmp\_isetup\_setup64.tmp
%LOCALAPPDATA%\any audio converter\unins000.dat
%LOCALAPPDATA%\any audio converter\anyaudioconverter32_64.exe

Перемещает следующие файлы

%LOCALAPPDATA%\any audio converter\is-hqa85.tmp в %LOCALAPPDATA%\any audio converter\unins000.exe
%LOCALAPPDATA%\any audio converter\printsupport\is-06jcg.tmp в %LOCALAPPDATA%\any audio converter\printsupport\windowsprintersupport.dll
%LOCALAPPDATA%\any audio converter\platforms\is-4qfj5.tmp в %LOCALAPPDATA%\any audio converter\platforms\qwindows.dll
%LOCALAPPDATA%\any audio converter\platforms\is-dv7ho.tmp в %LOCALAPPDATA%\any audio converter\platforms\qoffscreen.dll
%LOCALAPPDATA%\any audio converter\platforms\is-7kjgt.tmp в %LOCALAPPDATA%\any audio converter\platforms\qminimal.dll
%LOCALAPPDATA%\any audio converter\imageformats\is-76cpj.tmp в %LOCALAPPDATA%\any audio converter\imageformats\qjpeg.dll
%LOCALAPPDATA%\any audio converter\imageformats\is-0d0b6.tmp в %LOCALAPPDATA%\any audio converter\imageformats\qgif.dll
%LOCALAPPDATA%\any audio converter\is-st2vu.tmp в %LOCALAPPDATA%\any audio converter\ssleay32.dll
%LOCALAPPDATA%\any audio converter\is-m9tqo.tmp в %LOCALAPPDATA%\any audio converter\qt5webkitwidgets.dll
%LOCALAPPDATA%\any audio converter\is-k1tsv.tmp в %LOCALAPPDATA%\any audio converter\qt5webchannel.dll
%LOCALAPPDATA%\any audio converter\is-nsfnl.tmp в %LOCALAPPDATA%\any audio converter\qt5sql.dll
%LOCALAPPDATA%\any audio converter\is-8go6d.tmp в %LOCALAPPDATA%\any audio converter\firealpaca_mdp.ico
%LOCALAPPDATA%\any audio converter\is-ip8f1.tmp в %LOCALAPPDATA%\any audio converter\qt5sensors.dll
%LOCALAPPDATA%\any audio converter\is-grckr.tmp в %LOCALAPPDATA%\any audio converter\qt5positioning.dll
%LOCALAPPDATA%\any audio converter\is-0fghr.tmp в %LOCALAPPDATA%\any audio converter\qt5opengl.dll
%LOCALAPPDATA%\any audio converter\is-lejn9.tmp в %LOCALAPPDATA%\any audio converter\qt5network.dll
%LOCALAPPDATA%\any audio converter\is-4aqtd.tmp в %LOCALAPPDATA%\any audio converter\qt5multimediawidgets.dll
%LOCALAPPDATA%\any audio converter\is-7jj3g.tmp в %LOCALAPPDATA%\any audio converter\qt5multimedia.dll
%LOCALAPPDATA%\any audio converter\is-brj6v.tmp в %LOCALAPPDATA%\any audio converter\qt5concurrent.dll
%LOCALAPPDATA%\any audio converter\is-ajpkt.tmp в %LOCALAPPDATA%\any audio converter\libwinpthread-1.dll
%LOCALAPPDATA%\any audio converter\is-4r10o.tmp в %LOCALAPPDATA%\any audio converter\libstdc++-6.dll
%LOCALAPPDATA%\any audio converter\is-vihf5.tmp в %LOCALAPPDATA%\any audio converter\libgcc_s_dw2-1.dll
%LOCALAPPDATA%\any audio converter\is-c0fo9.tmp в %LOCALAPPDATA%\any audio converter\qt.conf
%LOCALAPPDATA%\any audio converter\is-f1sr5.tmp в %LOCALAPPDATA%\any audio converter\qt5printsupport.dll
%LOCALAPPDATA%\any audio converter\is-gahg6.tmp в %LOCALAPPDATA%\any audio converter\anyaudioconverter32_64.exe

Сетевая активность

Подключается к

'so####rvice.shop':80

TCP

Запросы HTTP POST

http://so####rvice.shop/new/net_api

UDP

DNS ASK so####rvice.shop

Другое

Ищет следующие окна

ClassName: 'zd8d9_Wnd_643zd8d9' WindowName: ''

Создает и запускает на исполнение

'%TEMP%\is-miin1.tmp\<Имя файла>.tmp' /SL5="$9024E,6331292,56832,<Полный путь к файлу>"
'%LOCALAPPDATA%\any audio converter\anyaudioconverter32_64.exe' 8f0238b37284f480ad089ab9a9fcd65b

Запускает на исполнение