Trojan.DownLoader47.7249

Техническая информация

Изменения в файловой системе

Создает следующие файлы

%TEMP%\is-28gd1.tmp\<Имя файла>.tmp
%LOCALAPPDATA%\bench mark audio analyzer\is-ejjnt.tmp
%LOCALAPPDATA%\bench mark audio analyzer\is-gkp9r.tmp
%LOCALAPPDATA%\bench mark audio analyzer\printsupport\is-hudvf.tmp
%LOCALAPPDATA%\bench mark audio analyzer\platforms\is-fsj4r.tmp
%LOCALAPPDATA%\bench mark audio analyzer\platforms\is-v74mp.tmp
%LOCALAPPDATA%\bench mark audio analyzer\platforms\is-6e0v1.tmp
%LOCALAPPDATA%\bench mark audio analyzer\imageformats\is-erk6n.tmp
%LOCALAPPDATA%\bench mark audio analyzer\imageformats\is-o39q3.tmp
%LOCALAPPDATA%\bench mark audio analyzer\is-1jsse.tmp
%LOCALAPPDATA%\bench mark audio analyzer\is-uljv5.tmp
%LOCALAPPDATA%\bench mark audio analyzer\is-8mgjb.tmp
%LOCALAPPDATA%\bench mark audio analyzer\is-9ae0e.tmp
%LOCALAPPDATA%\bench mark audio analyzer\is-6fkf3.tmp
%LOCALAPPDATA%\bench mark audio analyzer\is-8e2bf.tmp
%LOCALAPPDATA%\bench mark audio analyzer\is-pkb5j.tmp
%LOCALAPPDATA%\bench mark audio analyzer\is-f0pb3.tmp
%LOCALAPPDATA%\bench mark audio analyzer\is-gcrp1.tmp
%LOCALAPPDATA%\bench mark audio analyzer\is-l8dp9.tmp
%LOCALAPPDATA%\bench mark audio analyzer\is-f991p.tmp
%LOCALAPPDATA%\bench mark audio analyzer\is-ado1a.tmp
%LOCALAPPDATA%\bench mark audio analyzer\is-mld8f.tmp
%LOCALAPPDATA%\bench mark audio analyzer\is-h9jho.tmp
%LOCALAPPDATA%\bench mark audio analyzer\is-8peg2.tmp
%LOCALAPPDATA%\bench mark audio analyzer\is-jb2uc.tmp
%LOCALAPPDATA%\bench mark audio analyzer\is-elvfm.tmp
%TEMP%\is-mcmi6.tmp\_isetup\_iscrypt.dll
%TEMP%\is-mcmi6.tmp\_isetup\_isdecmp.dll
%TEMP%\is-mcmi6.tmp\_isetup\_shfoldr.dll
%TEMP%\is-mcmi6.tmp\_isetup\_setup64.tmp
%LOCALAPPDATA%\bench mark audio analyzer\unins000.dat
%LOCALAPPDATA%\bench mark audio analyzer\benchmarkaudioanalyzer32.exe

Перемещает следующие файлы

%LOCALAPPDATA%\bench mark audio analyzer\is-elvfm.tmp в %LOCALAPPDATA%\bench mark audio analyzer\unins000.exe
%LOCALAPPDATA%\bench mark audio analyzer\printsupport\is-hudvf.tmp в %LOCALAPPDATA%\bench mark audio analyzer\printsupport\windowsprintersupport.dll
%LOCALAPPDATA%\bench mark audio analyzer\platforms\is-fsj4r.tmp в %LOCALAPPDATA%\bench mark audio analyzer\platforms\qwindows.dll
%LOCALAPPDATA%\bench mark audio analyzer\platforms\is-v74mp.tmp в %LOCALAPPDATA%\bench mark audio analyzer\platforms\qoffscreen.dll
%LOCALAPPDATA%\bench mark audio analyzer\platforms\is-6e0v1.tmp в %LOCALAPPDATA%\bench mark audio analyzer\platforms\qminimal.dll
%LOCALAPPDATA%\bench mark audio analyzer\imageformats\is-erk6n.tmp в %LOCALAPPDATA%\bench mark audio analyzer\imageformats\qjpeg.dll
%LOCALAPPDATA%\bench mark audio analyzer\imageformats\is-o39q3.tmp в %LOCALAPPDATA%\bench mark audio analyzer\imageformats\qgif.dll
%LOCALAPPDATA%\bench mark audio analyzer\is-1jsse.tmp в %LOCALAPPDATA%\bench mark audio analyzer\ssleay32.dll
%LOCALAPPDATA%\bench mark audio analyzer\is-uljv5.tmp в %LOCALAPPDATA%\bench mark audio analyzer\qt5webkitwidgets.dll
%LOCALAPPDATA%\bench mark audio analyzer\is-8mgjb.tmp в %LOCALAPPDATA%\bench mark audio analyzer\qt5webchannel.dll
%LOCALAPPDATA%\bench mark audio analyzer\is-9ae0e.tmp в %LOCALAPPDATA%\bench mark audio analyzer\qt5sql.dll
%LOCALAPPDATA%\bench mark audio analyzer\is-gkp9r.tmp в %LOCALAPPDATA%\bench mark audio analyzer\firealpaca_mdp.ico
%LOCALAPPDATA%\bench mark audio analyzer\is-6fkf3.tmp в %LOCALAPPDATA%\bench mark audio analyzer\qt5sensors.dll
%LOCALAPPDATA%\bench mark audio analyzer\is-pkb5j.tmp в %LOCALAPPDATA%\bench mark audio analyzer\qt5positioning.dll
%LOCALAPPDATA%\bench mark audio analyzer\is-f0pb3.tmp в %LOCALAPPDATA%\bench mark audio analyzer\qt5opengl.dll
%LOCALAPPDATA%\bench mark audio analyzer\is-gcrp1.tmp в %LOCALAPPDATA%\bench mark audio analyzer\qt5network.dll
%LOCALAPPDATA%\bench mark audio analyzer\is-l8dp9.tmp в %LOCALAPPDATA%\bench mark audio analyzer\qt5multimediawidgets.dll
%LOCALAPPDATA%\bench mark audio analyzer\is-f991p.tmp в %LOCALAPPDATA%\bench mark audio analyzer\qt5multimedia.dll
%LOCALAPPDATA%\bench mark audio analyzer\is-ado1a.tmp в %LOCALAPPDATA%\bench mark audio analyzer\qt5concurrent.dll
%LOCALAPPDATA%\bench mark audio analyzer\is-mld8f.tmp в %LOCALAPPDATA%\bench mark audio analyzer\libwinpthread-1.dll
%LOCALAPPDATA%\bench mark audio analyzer\is-h9jho.tmp в %LOCALAPPDATA%\bench mark audio analyzer\libstdc++-6.dll
%LOCALAPPDATA%\bench mark audio analyzer\is-8peg2.tmp в %LOCALAPPDATA%\bench mark audio analyzer\libgcc_s_dw2-1.dll
%LOCALAPPDATA%\bench mark audio analyzer\is-jb2uc.tmp в %LOCALAPPDATA%\bench mark audio analyzer\qt.conf
%LOCALAPPDATA%\bench mark audio analyzer\is-8e2bf.tmp в %LOCALAPPDATA%\bench mark audio analyzer\qt5printsupport.dll
%LOCALAPPDATA%\bench mark audio analyzer\is-ejjnt.tmp в %LOCALAPPDATA%\bench mark audio analyzer\benchmarkaudioanalyzer32.exe

Сетевая активность

Подключается к

'so####rvice.shop':80

TCP

Запросы HTTP POST

http://so####rvice.shop/new/net_api

UDP

DNS ASK so####rvice.shop

Другое

Ищет следующие окна

ClassName: 'b%x_Wnd_6262c6f101' WindowName: ''

Создает и запускает на исполнение

'%TEMP%\is-28gd1.tmp\<Имя файла>.tmp' /SL5="$6023E,6348581,56832,<Полный путь к файлу>"
'%LOCALAPPDATA%\bench mark audio analyzer\benchmarkaudioanalyzer32.exe' 2f077386225f2556622eef01dd2caddd

Запускает на исполнение