Trojan.DownLoader47.3681

Техническая информация

Изменения в файловой системе

Создает следующие файлы

%TEMP%\is-2bb7f.tmp\<Имя файла>.tmp
%LOCALAPPDATA%\resonic player\is-u5rcb.tmp
%LOCALAPPDATA%\resonic player\is-6e37h.tmp
%LOCALAPPDATA%\resonic player\printsupport\is-olt5d.tmp
%LOCALAPPDATA%\resonic player\platforms\is-s6861.tmp
%LOCALAPPDATA%\resonic player\platforms\is-88pa7.tmp
%LOCALAPPDATA%\resonic player\platforms\is-6jdfn.tmp
%LOCALAPPDATA%\resonic player\imageformats\is-btn3l.tmp
%LOCALAPPDATA%\resonic player\imageformats\is-kj969.tmp
%LOCALAPPDATA%\resonic player\is-vjpus.tmp
%LOCALAPPDATA%\resonic player\is-ad8ir.tmp
%LOCALAPPDATA%\resonic player\is-nken9.tmp
%LOCALAPPDATA%\resonic player\is-udp7k.tmp
%LOCALAPPDATA%\resonic player\is-k0dgh.tmp
%LOCALAPPDATA%\resonic player\is-rusi5.tmp
%LOCALAPPDATA%\resonic player\is-9p40h.tmp
%LOCALAPPDATA%\resonic player\is-h39t9.tmp
%LOCALAPPDATA%\resonic player\is-c0s9f.tmp
%LOCALAPPDATA%\resonic player\is-f632v.tmp
%LOCALAPPDATA%\resonic player\is-blk3n.tmp
%LOCALAPPDATA%\resonic player\is-85veg.tmp
%LOCALAPPDATA%\resonic player\is-5qont.tmp
%LOCALAPPDATA%\resonic player\is-00hee.tmp
%LOCALAPPDATA%\resonic player\is-dvr90.tmp
%LOCALAPPDATA%\resonic player\is-q6ami.tmp
%LOCALAPPDATA%\resonic player\is-uihe4.tmp
%TEMP%\is-be2hs.tmp\_isetup\_iscrypt.dll
%TEMP%\is-be2hs.tmp\_isetup\_isdecmp.dll
%TEMP%\is-be2hs.tmp\_isetup\_shfoldr.dll
%TEMP%\is-be2hs.tmp\_isetup\_setup64.tmp
%LOCALAPPDATA%\resonic player\unins000.dat
%LOCALAPPDATA%\resonic player\resonicplayer32_64.exe

Перемещает следующие файлы

%LOCALAPPDATA%\resonic player\is-uihe4.tmp в %LOCALAPPDATA%\resonic player\unins000.exe
%LOCALAPPDATA%\resonic player\printsupport\is-olt5d.tmp в %LOCALAPPDATA%\resonic player\printsupport\windowsprintersupport.dll
%LOCALAPPDATA%\resonic player\platforms\is-s6861.tmp в %LOCALAPPDATA%\resonic player\platforms\qwindows.dll
%LOCALAPPDATA%\resonic player\platforms\is-88pa7.tmp в %LOCALAPPDATA%\resonic player\platforms\qoffscreen.dll
%LOCALAPPDATA%\resonic player\platforms\is-6jdfn.tmp в %LOCALAPPDATA%\resonic player\platforms\qminimal.dll
%LOCALAPPDATA%\resonic player\imageformats\is-btn3l.tmp в %LOCALAPPDATA%\resonic player\imageformats\qjpeg.dll
%LOCALAPPDATA%\resonic player\imageformats\is-kj969.tmp в %LOCALAPPDATA%\resonic player\imageformats\qgif.dll
%LOCALAPPDATA%\resonic player\is-vjpus.tmp в %LOCALAPPDATA%\resonic player\ssleay32.dll
%LOCALAPPDATA%\resonic player\is-ad8ir.tmp в %LOCALAPPDATA%\resonic player\qt5webkitwidgets.dll
%LOCALAPPDATA%\resonic player\is-nken9.tmp в %LOCALAPPDATA%\resonic player\qt5webchannel.dll
%LOCALAPPDATA%\resonic player\is-udp7k.tmp в %LOCALAPPDATA%\resonic player\qt5sql.dll
%LOCALAPPDATA%\resonic player\is-6e37h.tmp в %LOCALAPPDATA%\resonic player\firealpaca_mdp.ico
%LOCALAPPDATA%\resonic player\is-k0dgh.tmp в %LOCALAPPDATA%\resonic player\qt5sensors.dll
%LOCALAPPDATA%\resonic player\is-9p40h.tmp в %LOCALAPPDATA%\resonic player\qt5positioning.dll
%LOCALAPPDATA%\resonic player\is-h39t9.tmp в %LOCALAPPDATA%\resonic player\qt5opengl.dll
%LOCALAPPDATA%\resonic player\is-c0s9f.tmp в %LOCALAPPDATA%\resonic player\qt5network.dll
%LOCALAPPDATA%\resonic player\is-f632v.tmp в %LOCALAPPDATA%\resonic player\qt5multimediawidgets.dll
%LOCALAPPDATA%\resonic player\is-blk3n.tmp в %LOCALAPPDATA%\resonic player\qt5multimedia.dll
%LOCALAPPDATA%\resonic player\is-85veg.tmp в %LOCALAPPDATA%\resonic player\qt5concurrent.dll
%LOCALAPPDATA%\resonic player\is-5qont.tmp в %LOCALAPPDATA%\resonic player\libwinpthread-1.dll
%LOCALAPPDATA%\resonic player\is-00hee.tmp в %LOCALAPPDATA%\resonic player\libstdc++-6.dll
%LOCALAPPDATA%\resonic player\is-dvr90.tmp в %LOCALAPPDATA%\resonic player\libgcc_s_dw2-1.dll
%LOCALAPPDATA%\resonic player\is-q6ami.tmp в %LOCALAPPDATA%\resonic player\qt.conf
%LOCALAPPDATA%\resonic player\is-rusi5.tmp в %LOCALAPPDATA%\resonic player\qt5printsupport.dll
%LOCALAPPDATA%\resonic player\is-u5rcb.tmp в %LOCALAPPDATA%\resonic player\resonicplayer32_64.exe

Сетевая активность

Подключается к

'so####rvice.shop':80

TCP

Запросы HTTP POST

http://so####rvice.shop/new/net_api

UDP

DNS ASK so####rvice.shop

Другое

Ищет следующие окна

ClassName: 'H3c861_Wnd_6123H3c861' WindowName: ''

Создает и запускает на исполнение

'%TEMP%\is-2bb7f.tmp\<Имя файла>.tmp' /SL5="$B01D6,6645737,56832,<Полный путь к файлу>"
'%LOCALAPPDATA%\resonic player\resonicplayer32_64.exe' a155353a278a987155094541b4eff929

Запускает на исполнение