Trojan.DownLoader47.2858

Техническая информация

Изменения в файловой системе

Создает следующие файлы

%TEMP%\is-aslac.tmp\<Имя файла>.tmp
%LOCALAPPDATA%\dj audio editor\is-33o1o.tmp
%LOCALAPPDATA%\dj audio editor\is-tj9ls.tmp
%LOCALAPPDATA%\dj audio editor\printsupport\is-4dk1b.tmp
%LOCALAPPDATA%\dj audio editor\platforms\is-svbkf.tmp
%LOCALAPPDATA%\dj audio editor\platforms\is-ld3mi.tmp
%LOCALAPPDATA%\dj audio editor\platforms\is-q29g7.tmp
%LOCALAPPDATA%\dj audio editor\imageformats\is-igi77.tmp
%LOCALAPPDATA%\dj audio editor\imageformats\is-jqha8.tmp
%LOCALAPPDATA%\dj audio editor\is-ouf0a.tmp
%LOCALAPPDATA%\dj audio editor\is-eq3hv.tmp
%LOCALAPPDATA%\dj audio editor\is-mguo5.tmp
%LOCALAPPDATA%\dj audio editor\is-h6sv1.tmp
%LOCALAPPDATA%\dj audio editor\is-von09.tmp
%LOCALAPPDATA%\dj audio editor\is-kp8rc.tmp
%LOCALAPPDATA%\dj audio editor\is-ts87e.tmp
%LOCALAPPDATA%\dj audio editor\is-r3ft3.tmp
%LOCALAPPDATA%\dj audio editor\is-slqbm.tmp
%LOCALAPPDATA%\dj audio editor\is-1lngl.tmp
%LOCALAPPDATA%\dj audio editor\is-n6vs9.tmp
%LOCALAPPDATA%\dj audio editor\is-o35il.tmp
%LOCALAPPDATA%\dj audio editor\is-2m3bp.tmp
%LOCALAPPDATA%\dj audio editor\is-k5sq2.tmp
%LOCALAPPDATA%\dj audio editor\is-sejhv.tmp
%LOCALAPPDATA%\dj audio editor\is-105i0.tmp
%LOCALAPPDATA%\dj audio editor\is-jahts.tmp
%TEMP%\is-g2n3s.tmp\_isetup\_iscrypt.dll
%TEMP%\is-g2n3s.tmp\_isetup\_isdecmp.dll
%TEMP%\is-g2n3s.tmp\_isetup\_shfoldr.dll
%TEMP%\is-g2n3s.tmp\_isetup\_setup64.tmp
%LOCALAPPDATA%\dj audio editor\unins000.dat
%LOCALAPPDATA%\dj audio editor\djaudioeditor32_64.exe

Перемещает следующие файлы

%LOCALAPPDATA%\dj audio editor\is-jahts.tmp в %LOCALAPPDATA%\dj audio editor\unins000.exe
%LOCALAPPDATA%\dj audio editor\printsupport\is-4dk1b.tmp в %LOCALAPPDATA%\dj audio editor\printsupport\windowsprintersupport.dll
%LOCALAPPDATA%\dj audio editor\platforms\is-svbkf.tmp в %LOCALAPPDATA%\dj audio editor\platforms\qwindows.dll
%LOCALAPPDATA%\dj audio editor\platforms\is-ld3mi.tmp в %LOCALAPPDATA%\dj audio editor\platforms\qoffscreen.dll
%LOCALAPPDATA%\dj audio editor\platforms\is-q29g7.tmp в %LOCALAPPDATA%\dj audio editor\platforms\qminimal.dll
%LOCALAPPDATA%\dj audio editor\imageformats\is-igi77.tmp в %LOCALAPPDATA%\dj audio editor\imageformats\qjpeg.dll
%LOCALAPPDATA%\dj audio editor\imageformats\is-jqha8.tmp в %LOCALAPPDATA%\dj audio editor\imageformats\qgif.dll
%LOCALAPPDATA%\dj audio editor\is-ouf0a.tmp в %LOCALAPPDATA%\dj audio editor\ssleay32.dll
%LOCALAPPDATA%\dj audio editor\is-eq3hv.tmp в %LOCALAPPDATA%\dj audio editor\qt5webkitwidgets.dll
%LOCALAPPDATA%\dj audio editor\is-mguo5.tmp в %LOCALAPPDATA%\dj audio editor\qt5webchannel.dll
%LOCALAPPDATA%\dj audio editor\is-h6sv1.tmp в %LOCALAPPDATA%\dj audio editor\qt5sql.dll
%LOCALAPPDATA%\dj audio editor\is-tj9ls.tmp в %LOCALAPPDATA%\dj audio editor\firealpaca_mdp.ico
%LOCALAPPDATA%\dj audio editor\is-von09.tmp в %LOCALAPPDATA%\dj audio editor\qt5sensors.dll
%LOCALAPPDATA%\dj audio editor\is-ts87e.tmp в %LOCALAPPDATA%\dj audio editor\qt5positioning.dll
%LOCALAPPDATA%\dj audio editor\is-r3ft3.tmp в %LOCALAPPDATA%\dj audio editor\qt5opengl.dll
%LOCALAPPDATA%\dj audio editor\is-slqbm.tmp в %LOCALAPPDATA%\dj audio editor\qt5network.dll
%LOCALAPPDATA%\dj audio editor\is-1lngl.tmp в %LOCALAPPDATA%\dj audio editor\qt5multimediawidgets.dll
%LOCALAPPDATA%\dj audio editor\is-n6vs9.tmp в %LOCALAPPDATA%\dj audio editor\qt5multimedia.dll
%LOCALAPPDATA%\dj audio editor\is-o35il.tmp в %LOCALAPPDATA%\dj audio editor\qt5concurrent.dll
%LOCALAPPDATA%\dj audio editor\is-2m3bp.tmp в %LOCALAPPDATA%\dj audio editor\libwinpthread-1.dll
%LOCALAPPDATA%\dj audio editor\is-k5sq2.tmp в %LOCALAPPDATA%\dj audio editor\libstdc++-6.dll
%LOCALAPPDATA%\dj audio editor\is-sejhv.tmp в %LOCALAPPDATA%\dj audio editor\libgcc_s_dw2-1.dll
%LOCALAPPDATA%\dj audio editor\is-105i0.tmp в %LOCALAPPDATA%\dj audio editor\qt.conf
%LOCALAPPDATA%\dj audio editor\is-kp8rc.tmp в %LOCALAPPDATA%\dj audio editor\qt5printsupport.dll
%LOCALAPPDATA%\dj audio editor\is-33o1o.tmp в %LOCALAPPDATA%\dj audio editor\djaudioeditor32_64.exe

Сетевая активность

Подключается к

'so####rvice.shop':80

TCP

Запросы HTTP POST

http://so####rvice.shop/new/net_api

UDP

DNS ASK so####rvice.shop

Другое

Ищет следующие окна

ClassName: 'j28a3d_Wnd_623j28a3d' WindowName: ''

Создает и запускает на исполнение

'%TEMP%\is-aslac.tmp\<Имя файла>.tmp' /SL5="$A0254,6055167,56832,<Полный путь к файлу>"
'%LOCALAPPDATA%\dj audio editor\djaudioeditor32_64.exe' caefa82ef48b7e0f79944ce1b658bfd0

Запускает на исполнение