Trojan.DownLoader47.4424

Техническая информация

Изменения в файловой системе

Создает следующие файлы

%TEMP%\is-os6t1.tmp\<Имя файла>.tmp
%LOCALAPPDATA%\resonic player\is-sfnl6.tmp
%LOCALAPPDATA%\resonic player\is-9hunj.tmp
%LOCALAPPDATA%\resonic player\printsupport\is-0u18u.tmp
%LOCALAPPDATA%\resonic player\platforms\is-lbone.tmp
%LOCALAPPDATA%\resonic player\platforms\is-pbd6q.tmp
%LOCALAPPDATA%\resonic player\platforms\is-isirn.tmp
%LOCALAPPDATA%\resonic player\imageformats\is-d79nv.tmp
%LOCALAPPDATA%\resonic player\imageformats\is-epfpf.tmp
%LOCALAPPDATA%\resonic player\is-q51jq.tmp
%LOCALAPPDATA%\resonic player\is-2r9eu.tmp
%LOCALAPPDATA%\resonic player\is-68lq0.tmp
%LOCALAPPDATA%\resonic player\is-q3sll.tmp
%LOCALAPPDATA%\resonic player\is-o5vse.tmp
%LOCALAPPDATA%\resonic player\is-g434e.tmp
%LOCALAPPDATA%\resonic player\is-hsgpa.tmp
%LOCALAPPDATA%\resonic player\is-g401a.tmp
%LOCALAPPDATA%\resonic player\is-5404v.tmp
%LOCALAPPDATA%\resonic player\is-o533i.tmp
%LOCALAPPDATA%\resonic player\is-4e044.tmp
%LOCALAPPDATA%\resonic player\is-ci65m.tmp
%LOCALAPPDATA%\resonic player\is-lq9ll.tmp
%LOCALAPPDATA%\resonic player\is-lm97g.tmp
%LOCALAPPDATA%\resonic player\is-kslcn.tmp
%LOCALAPPDATA%\resonic player\is-t0h00.tmp
%LOCALAPPDATA%\resonic player\is-4rkqn.tmp
%TEMP%\is-2gbvg.tmp\_isetup\_iscrypt.dll
%TEMP%\is-2gbvg.tmp\_isetup\_isdecmp.dll
%TEMP%\is-2gbvg.tmp\_isetup\_shfoldr.dll
%TEMP%\is-2gbvg.tmp\_isetup\_setup64.tmp
%LOCALAPPDATA%\resonic player\unins000.dat
%LOCALAPPDATA%\resonic player\resonicplayer.exe

Перемещает следующие файлы

%LOCALAPPDATA%\resonic player\is-4rkqn.tmp в %LOCALAPPDATA%\resonic player\unins000.exe
%LOCALAPPDATA%\resonic player\printsupport\is-0u18u.tmp в %LOCALAPPDATA%\resonic player\printsupport\windowsprintersupport.dll
%LOCALAPPDATA%\resonic player\platforms\is-lbone.tmp в %LOCALAPPDATA%\resonic player\platforms\qwindows.dll
%LOCALAPPDATA%\resonic player\platforms\is-pbd6q.tmp в %LOCALAPPDATA%\resonic player\platforms\qoffscreen.dll
%LOCALAPPDATA%\resonic player\platforms\is-isirn.tmp в %LOCALAPPDATA%\resonic player\platforms\qminimal.dll
%LOCALAPPDATA%\resonic player\imageformats\is-d79nv.tmp в %LOCALAPPDATA%\resonic player\imageformats\qjpeg.dll
%LOCALAPPDATA%\resonic player\imageformats\is-epfpf.tmp в %LOCALAPPDATA%\resonic player\imageformats\qgif.dll
%LOCALAPPDATA%\resonic player\is-q51jq.tmp в %LOCALAPPDATA%\resonic player\ssleay32.dll
%LOCALAPPDATA%\resonic player\is-2r9eu.tmp в %LOCALAPPDATA%\resonic player\qt5webkitwidgets.dll
%LOCALAPPDATA%\resonic player\is-68lq0.tmp в %LOCALAPPDATA%\resonic player\qt5webchannel.dll
%LOCALAPPDATA%\resonic player\is-q3sll.tmp в %LOCALAPPDATA%\resonic player\qt5sql.dll
%LOCALAPPDATA%\resonic player\is-9hunj.tmp в %LOCALAPPDATA%\resonic player\firealpaca_mdp.ico
%LOCALAPPDATA%\resonic player\is-o5vse.tmp в %LOCALAPPDATA%\resonic player\qt5sensors.dll
%LOCALAPPDATA%\resonic player\is-hsgpa.tmp в %LOCALAPPDATA%\resonic player\qt5positioning.dll
%LOCALAPPDATA%\resonic player\is-g401a.tmp в %LOCALAPPDATA%\resonic player\qt5opengl.dll
%LOCALAPPDATA%\resonic player\is-5404v.tmp в %LOCALAPPDATA%\resonic player\qt5network.dll
%LOCALAPPDATA%\resonic player\is-o533i.tmp в %LOCALAPPDATA%\resonic player\qt5multimediawidgets.dll
%LOCALAPPDATA%\resonic player\is-4e044.tmp в %LOCALAPPDATA%\resonic player\qt5multimedia.dll
%LOCALAPPDATA%\resonic player\is-ci65m.tmp в %LOCALAPPDATA%\resonic player\qt5concurrent.dll
%LOCALAPPDATA%\resonic player\is-lq9ll.tmp в %LOCALAPPDATA%\resonic player\libwinpthread-1.dll
%LOCALAPPDATA%\resonic player\is-lm97g.tmp в %LOCALAPPDATA%\resonic player\libstdc++-6.dll
%LOCALAPPDATA%\resonic player\is-kslcn.tmp в %LOCALAPPDATA%\resonic player\libgcc_s_dw2-1.dll
%LOCALAPPDATA%\resonic player\is-t0h00.tmp в %LOCALAPPDATA%\resonic player\qt.conf
%LOCALAPPDATA%\resonic player\is-g434e.tmp в %LOCALAPPDATA%\resonic player\qt5printsupport.dll
%LOCALAPPDATA%\resonic player\is-sfnl6.tmp в %LOCALAPPDATA%\resonic player\resonicplayer.exe

Сетевая активность

Подключается к

'so####rvice.shop':80

TCP

Запросы HTTP POST

http://so####rvice.shop/new/net_api

UDP

DNS ASK so####rvice.shop

Другое

Ищет следующие окна

ClassName: 'H1d561_Wnd_6121H1d561' WindowName: ''

Создает и запускает на исполнение

'%TEMP%\is-os6t1.tmp\<Имя файла>.tmp' /SL5="$6025E,6655239,56832,<Полный путь к файлу>"
'%LOCALAPPDATA%\resonic player\resonicplayer.exe' 424451befc4d90ccca247811055fd236

Запускает на исполнение