Trojan.DownLoader47.3721

Техническая информация

Изменения в файловой системе

Создает следующие файлы

%TEMP%\is-gil4r.tmp\<Имя файла>.tmp
%LOCALAPPDATA%\resonic player\is-mm3ik.tmp
%LOCALAPPDATA%\resonic player\is-tolvh.tmp
%LOCALAPPDATA%\resonic player\printsupport\is-i34l5.tmp
%LOCALAPPDATA%\resonic player\platforms\is-guv7h.tmp
%LOCALAPPDATA%\resonic player\platforms\is-qolo9.tmp
%LOCALAPPDATA%\resonic player\platforms\is-5bo8f.tmp
%LOCALAPPDATA%\resonic player\imageformats\is-ih8lv.tmp
%LOCALAPPDATA%\resonic player\imageformats\is-v6eqn.tmp
%LOCALAPPDATA%\resonic player\is-v74pg.tmp
%LOCALAPPDATA%\resonic player\is-2o06t.tmp
%LOCALAPPDATA%\resonic player\is-2vche.tmp
%LOCALAPPDATA%\resonic player\is-phdg0.tmp
%LOCALAPPDATA%\resonic player\is-8u1hi.tmp
%LOCALAPPDATA%\resonic player\is-ltsd4.tmp
%LOCALAPPDATA%\resonic player\is-dpb4s.tmp
%LOCALAPPDATA%\resonic player\is-5nojm.tmp
%LOCALAPPDATA%\resonic player\is-jn3fm.tmp
%LOCALAPPDATA%\resonic player\is-699hb.tmp
%LOCALAPPDATA%\resonic player\is-asf1h.tmp
%LOCALAPPDATA%\resonic player\is-aqgm1.tmp
%LOCALAPPDATA%\resonic player\is-tt2n5.tmp
%LOCALAPPDATA%\resonic player\is-kf4dr.tmp
%LOCALAPPDATA%\resonic player\is-e3sck.tmp
%LOCALAPPDATA%\resonic player\is-pvrb8.tmp
%LOCALAPPDATA%\resonic player\is-o4hv7.tmp
%TEMP%\is-0bs0r.tmp\_isetup\_iscrypt.dll
%TEMP%\is-0bs0r.tmp\_isetup\_isdecmp.dll
%TEMP%\is-0bs0r.tmp\_isetup\_shfoldr.dll
%TEMP%\is-0bs0r.tmp\_isetup\_setup64.tmp
%LOCALAPPDATA%\resonic player\unins000.dat
%LOCALAPPDATA%\resonic player\resonicplayer.exe

Перемещает следующие файлы

%LOCALAPPDATA%\resonic player\is-o4hv7.tmp в %LOCALAPPDATA%\resonic player\unins000.exe
%LOCALAPPDATA%\resonic player\printsupport\is-i34l5.tmp в %LOCALAPPDATA%\resonic player\printsupport\windowsprintersupport.dll
%LOCALAPPDATA%\resonic player\platforms\is-guv7h.tmp в %LOCALAPPDATA%\resonic player\platforms\qwindows.dll
%LOCALAPPDATA%\resonic player\platforms\is-qolo9.tmp в %LOCALAPPDATA%\resonic player\platforms\qoffscreen.dll
%LOCALAPPDATA%\resonic player\platforms\is-5bo8f.tmp в %LOCALAPPDATA%\resonic player\platforms\qminimal.dll
%LOCALAPPDATA%\resonic player\imageformats\is-ih8lv.tmp в %LOCALAPPDATA%\resonic player\imageformats\qjpeg.dll
%LOCALAPPDATA%\resonic player\imageformats\is-v6eqn.tmp в %LOCALAPPDATA%\resonic player\imageformats\qgif.dll
%LOCALAPPDATA%\resonic player\is-v74pg.tmp в %LOCALAPPDATA%\resonic player\ssleay32.dll
%LOCALAPPDATA%\resonic player\is-2o06t.tmp в %LOCALAPPDATA%\resonic player\qt5webkitwidgets.dll
%LOCALAPPDATA%\resonic player\is-2vche.tmp в %LOCALAPPDATA%\resonic player\qt5webchannel.dll
%LOCALAPPDATA%\resonic player\is-phdg0.tmp в %LOCALAPPDATA%\resonic player\qt5sql.dll
%LOCALAPPDATA%\resonic player\is-tolvh.tmp в %LOCALAPPDATA%\resonic player\firealpaca_mdp.ico
%LOCALAPPDATA%\resonic player\is-8u1hi.tmp в %LOCALAPPDATA%\resonic player\qt5sensors.dll
%LOCALAPPDATA%\resonic player\is-dpb4s.tmp в %LOCALAPPDATA%\resonic player\qt5positioning.dll
%LOCALAPPDATA%\resonic player\is-5nojm.tmp в %LOCALAPPDATA%\resonic player\qt5opengl.dll
%LOCALAPPDATA%\resonic player\is-jn3fm.tmp в %LOCALAPPDATA%\resonic player\qt5network.dll
%LOCALAPPDATA%\resonic player\is-699hb.tmp в %LOCALAPPDATA%\resonic player\qt5multimediawidgets.dll
%LOCALAPPDATA%\resonic player\is-asf1h.tmp в %LOCALAPPDATA%\resonic player\qt5multimedia.dll
%LOCALAPPDATA%\resonic player\is-aqgm1.tmp в %LOCALAPPDATA%\resonic player\qt5concurrent.dll
%LOCALAPPDATA%\resonic player\is-tt2n5.tmp в %LOCALAPPDATA%\resonic player\libwinpthread-1.dll
%LOCALAPPDATA%\resonic player\is-kf4dr.tmp в %LOCALAPPDATA%\resonic player\libstdc++-6.dll
%LOCALAPPDATA%\resonic player\is-e3sck.tmp в %LOCALAPPDATA%\resonic player\libgcc_s_dw2-1.dll
%LOCALAPPDATA%\resonic player\is-pvrb8.tmp в %LOCALAPPDATA%\resonic player\qt.conf
%LOCALAPPDATA%\resonic player\is-ltsd4.tmp в %LOCALAPPDATA%\resonic player\qt5printsupport.dll
%LOCALAPPDATA%\resonic player\is-mm3ik.tmp в %LOCALAPPDATA%\resonic player\resonicplayer.exe

Сетевая активность

Подключается к

'so####rvice.shop':80

TCP

Запросы HTTP POST

http://so####rvice.shop/new/net_api

UDP

DNS ASK so####rvice.shop

Другое

Ищет следующие окна

ClassName: 'b1d2f5_Wnd_6121b1d2f5' WindowName: ''

Создает и запускает на исполнение

'%TEMP%\is-gil4r.tmp\<Имя файла>.tmp' /SL5="$B018E,6479944,56832,<Полный путь к файлу>"
'%LOCALAPPDATA%\resonic player\resonicplayer.exe' a6099fd092aadb0e96e67eae01a6a204

Запускает на исполнение