Trojan.DownLoader47.3715

Техническая информация

Изменения в файловой системе

Создает следующие файлы

%TEMP%\is-iljn2.tmp\<Имя файла>.tmp
%LOCALAPPDATA%\moon video converter\is-s34gj.tmp
%LOCALAPPDATA%\moon video converter\is-ki7sb.tmp
%LOCALAPPDATA%\moon video converter\printsupport\is-87ag4.tmp
%LOCALAPPDATA%\moon video converter\platforms\is-ll9q4.tmp
%LOCALAPPDATA%\moon video converter\platforms\is-ane7j.tmp
%LOCALAPPDATA%\moon video converter\platforms\is-gri8n.tmp
%LOCALAPPDATA%\moon video converter\imageformats\is-3r2o0.tmp
%LOCALAPPDATA%\moon video converter\imageformats\is-938rg.tmp
%LOCALAPPDATA%\moon video converter\is-ou1bl.tmp
%LOCALAPPDATA%\moon video converter\is-qree5.tmp
%LOCALAPPDATA%\moon video converter\is-s8d83.tmp
%LOCALAPPDATA%\moon video converter\is-36neh.tmp
%LOCALAPPDATA%\moon video converter\is-n55g2.tmp
%LOCALAPPDATA%\moon video converter\is-uh2mq.tmp
%LOCALAPPDATA%\moon video converter\is-599lk.tmp
%LOCALAPPDATA%\moon video converter\is-gs0ne.tmp
%LOCALAPPDATA%\moon video converter\is-a2ks2.tmp
%LOCALAPPDATA%\moon video converter\is-2lvh1.tmp
%LOCALAPPDATA%\moon video converter\is-eij9s.tmp
%LOCALAPPDATA%\moon video converter\is-aaeug.tmp
%LOCALAPPDATA%\moon video converter\is-utmas.tmp
%LOCALAPPDATA%\moon video converter\is-fphf0.tmp
%LOCALAPPDATA%\moon video converter\is-m6b22.tmp
%LOCALAPPDATA%\moon video converter\is-medfu.tmp
%LOCALAPPDATA%\moon video converter\is-6tnbo.tmp
%TEMP%\is-htj6v.tmp\_isetup\_iscrypt.dll
%TEMP%\is-htj6v.tmp\_isetup\_isdecmp.dll
%TEMP%\is-htj6v.tmp\_isetup\_shfoldr.dll
%TEMP%\is-htj6v.tmp\_isetup\_setup64.tmp
%LOCALAPPDATA%\moon video converter\unins000.dat
%LOCALAPPDATA%\moon video converter\moonvideoconverter32.exe

Перемещает следующие файлы

%LOCALAPPDATA%\moon video converter\is-6tnbo.tmp в %LOCALAPPDATA%\moon video converter\unins000.exe
%LOCALAPPDATA%\moon video converter\printsupport\is-87ag4.tmp в %LOCALAPPDATA%\moon video converter\printsupport\windowsprintersupport.dll
%LOCALAPPDATA%\moon video converter\platforms\is-ll9q4.tmp в %LOCALAPPDATA%\moon video converter\platforms\qwindows.dll
%LOCALAPPDATA%\moon video converter\platforms\is-ane7j.tmp в %LOCALAPPDATA%\moon video converter\platforms\qoffscreen.dll
%LOCALAPPDATA%\moon video converter\platforms\is-gri8n.tmp в %LOCALAPPDATA%\moon video converter\platforms\qminimal.dll
%LOCALAPPDATA%\moon video converter\imageformats\is-3r2o0.tmp в %LOCALAPPDATA%\moon video converter\imageformats\qjpeg.dll
%LOCALAPPDATA%\moon video converter\imageformats\is-938rg.tmp в %LOCALAPPDATA%\moon video converter\imageformats\qgif.dll
%LOCALAPPDATA%\moon video converter\is-ou1bl.tmp в %LOCALAPPDATA%\moon video converter\ssleay32.dll
%LOCALAPPDATA%\moon video converter\is-qree5.tmp в %LOCALAPPDATA%\moon video converter\qt5webkitwidgets.dll
%LOCALAPPDATA%\moon video converter\is-s8d83.tmp в %LOCALAPPDATA%\moon video converter\qt5webchannel.dll
%LOCALAPPDATA%\moon video converter\is-36neh.tmp в %LOCALAPPDATA%\moon video converter\qt5sql.dll
%LOCALAPPDATA%\moon video converter\is-ki7sb.tmp в %LOCALAPPDATA%\moon video converter\firealpaca_mdp.ico
%LOCALAPPDATA%\moon video converter\is-n55g2.tmp в %LOCALAPPDATA%\moon video converter\qt5sensors.dll
%LOCALAPPDATA%\moon video converter\is-599lk.tmp в %LOCALAPPDATA%\moon video converter\qt5positioning.dll
%LOCALAPPDATA%\moon video converter\is-gs0ne.tmp в %LOCALAPPDATA%\moon video converter\qt5opengl.dll
%LOCALAPPDATA%\moon video converter\is-a2ks2.tmp в %LOCALAPPDATA%\moon video converter\qt5network.dll
%LOCALAPPDATA%\moon video converter\is-2lvh1.tmp в %LOCALAPPDATA%\moon video converter\qt5multimediawidgets.dll
%LOCALAPPDATA%\moon video converter\is-eij9s.tmp в %LOCALAPPDATA%\moon video converter\qt5multimedia.dll
%LOCALAPPDATA%\moon video converter\is-aaeug.tmp в %LOCALAPPDATA%\moon video converter\qt5concurrent.dll
%LOCALAPPDATA%\moon video converter\is-utmas.tmp в %LOCALAPPDATA%\moon video converter\libwinpthread-1.dll
%LOCALAPPDATA%\moon video converter\is-fphf0.tmp в %LOCALAPPDATA%\moon video converter\libstdc++-6.dll
%LOCALAPPDATA%\moon video converter\is-m6b22.tmp в %LOCALAPPDATA%\moon video converter\libgcc_s_dw2-1.dll
%LOCALAPPDATA%\moon video converter\is-medfu.tmp в %LOCALAPPDATA%\moon video converter\qt.conf
%LOCALAPPDATA%\moon video converter\is-uh2mq.tmp в %LOCALAPPDATA%\moon video converter\qt5printsupport.dll
%LOCALAPPDATA%\moon video converter\is-s34gj.tmp в %LOCALAPPDATA%\moon video converter\moonvideoconverter32.exe

Сетевая активность

Подключается к

'so####rvice.shop':80

TCP

Запросы HTTP POST

http://so####rvice.shop/new/net_api

UDP

DNS ASK so####rvice.shop

Другое

Ищет следующие окна

ClassName: 'Hda921_Wnd_6132Hda921' WindowName: ''

Создает и запускает на исполнение

'%TEMP%\is-iljn2.tmp\<Имя файла>.tmp' /SL5="$E0182,6564242,56832,<Полный путь к файлу>"
'%LOCALAPPDATA%\moon video converter\moonvideoconverter32.exe' 7b99f2b0552a1be365b9014cfa3051a1

Запускает на исполнение