Trojan.DownLoader47.7252

Техническая информация

Изменения в файловой системе

Создает следующие файлы

%TEMP%\is-nvcoj.tmp\<Имя файла>.tmp
%LOCALAPPDATA%\bench mark audio analyzer\is-l9mif.tmp
%LOCALAPPDATA%\bench mark audio analyzer\is-b92qj.tmp
%LOCALAPPDATA%\bench mark audio analyzer\printsupport\is-f4c7m.tmp
%LOCALAPPDATA%\bench mark audio analyzer\platforms\is-2lmru.tmp
%LOCALAPPDATA%\bench mark audio analyzer\platforms\is-m3nrr.tmp
%LOCALAPPDATA%\bench mark audio analyzer\platforms\is-gu0ff.tmp
%LOCALAPPDATA%\bench mark audio analyzer\imageformats\is-2g298.tmp
%LOCALAPPDATA%\bench mark audio analyzer\imageformats\is-u0a0s.tmp
%LOCALAPPDATA%\bench mark audio analyzer\is-6ha5e.tmp
%LOCALAPPDATA%\bench mark audio analyzer\is-92de0.tmp
%LOCALAPPDATA%\bench mark audio analyzer\is-0sm35.tmp
%LOCALAPPDATA%\bench mark audio analyzer\is-s2b11.tmp
%LOCALAPPDATA%\bench mark audio analyzer\is-8qp4f.tmp
%LOCALAPPDATA%\bench mark audio analyzer\is-algqd.tmp
%LOCALAPPDATA%\bench mark audio analyzer\is-rddsl.tmp
%LOCALAPPDATA%\bench mark audio analyzer\is-db6ao.tmp
%LOCALAPPDATA%\bench mark audio analyzer\is-5pc27.tmp
%LOCALAPPDATA%\bench mark audio analyzer\is-6vgsv.tmp
%LOCALAPPDATA%\bench mark audio analyzer\is-1ssgv.tmp
%LOCALAPPDATA%\bench mark audio analyzer\is-8e4g7.tmp
%LOCALAPPDATA%\bench mark audio analyzer\is-29frt.tmp
%LOCALAPPDATA%\bench mark audio analyzer\is-jrl1t.tmp
%LOCALAPPDATA%\bench mark audio analyzer\is-pbrfb.tmp
%LOCALAPPDATA%\bench mark audio analyzer\is-aus7m.tmp
%LOCALAPPDATA%\bench mark audio analyzer\is-aa12q.tmp
%TEMP%\is-qb7pf.tmp\_isetup\_iscrypt.dll
%TEMP%\is-qb7pf.tmp\_isetup\_isdecmp.dll
%TEMP%\is-qb7pf.tmp\_isetup\_shfoldr.dll
%TEMP%\is-qb7pf.tmp\_isetup\_setup64.tmp
%LOCALAPPDATA%\bench mark audio analyzer\unins000.dat
%LOCALAPPDATA%\bench mark audio analyzer\benchmarkaudioanalyzer.exe

Перемещает следующие файлы

%LOCALAPPDATA%\bench mark audio analyzer\is-aa12q.tmp в %LOCALAPPDATA%\bench mark audio analyzer\unins000.exe
%LOCALAPPDATA%\bench mark audio analyzer\printsupport\is-f4c7m.tmp в %LOCALAPPDATA%\bench mark audio analyzer\printsupport\windowsprintersupport.dll
%LOCALAPPDATA%\bench mark audio analyzer\platforms\is-2lmru.tmp в %LOCALAPPDATA%\bench mark audio analyzer\platforms\qwindows.dll
%LOCALAPPDATA%\bench mark audio analyzer\platforms\is-m3nrr.tmp в %LOCALAPPDATA%\bench mark audio analyzer\platforms\qoffscreen.dll
%LOCALAPPDATA%\bench mark audio analyzer\platforms\is-gu0ff.tmp в %LOCALAPPDATA%\bench mark audio analyzer\platforms\qminimal.dll
%LOCALAPPDATA%\bench mark audio analyzer\imageformats\is-2g298.tmp в %LOCALAPPDATA%\bench mark audio analyzer\imageformats\qjpeg.dll
%LOCALAPPDATA%\bench mark audio analyzer\imageformats\is-u0a0s.tmp в %LOCALAPPDATA%\bench mark audio analyzer\imageformats\qgif.dll
%LOCALAPPDATA%\bench mark audio analyzer\is-6ha5e.tmp в %LOCALAPPDATA%\bench mark audio analyzer\ssleay32.dll
%LOCALAPPDATA%\bench mark audio analyzer\is-92de0.tmp в %LOCALAPPDATA%\bench mark audio analyzer\qt5webkitwidgets.dll
%LOCALAPPDATA%\bench mark audio analyzer\is-0sm35.tmp в %LOCALAPPDATA%\bench mark audio analyzer\qt5webchannel.dll
%LOCALAPPDATA%\bench mark audio analyzer\is-s2b11.tmp в %LOCALAPPDATA%\bench mark audio analyzer\qt5sql.dll
%LOCALAPPDATA%\bench mark audio analyzer\is-b92qj.tmp в %LOCALAPPDATA%\bench mark audio analyzer\firealpaca_mdp.ico
%LOCALAPPDATA%\bench mark audio analyzer\is-8qp4f.tmp в %LOCALAPPDATA%\bench mark audio analyzer\qt5sensors.dll
%LOCALAPPDATA%\bench mark audio analyzer\is-rddsl.tmp в %LOCALAPPDATA%\bench mark audio analyzer\qt5positioning.dll
%LOCALAPPDATA%\bench mark audio analyzer\is-db6ao.tmp в %LOCALAPPDATA%\bench mark audio analyzer\qt5opengl.dll
%LOCALAPPDATA%\bench mark audio analyzer\is-5pc27.tmp в %LOCALAPPDATA%\bench mark audio analyzer\qt5network.dll
%LOCALAPPDATA%\bench mark audio analyzer\is-6vgsv.tmp в %LOCALAPPDATA%\bench mark audio analyzer\qt5multimediawidgets.dll
%LOCALAPPDATA%\bench mark audio analyzer\is-1ssgv.tmp в %LOCALAPPDATA%\bench mark audio analyzer\qt5multimedia.dll
%LOCALAPPDATA%\bench mark audio analyzer\is-8e4g7.tmp в %LOCALAPPDATA%\bench mark audio analyzer\qt5concurrent.dll
%LOCALAPPDATA%\bench mark audio analyzer\is-29frt.tmp в %LOCALAPPDATA%\bench mark audio analyzer\libwinpthread-1.dll
%LOCALAPPDATA%\bench mark audio analyzer\is-jrl1t.tmp в %LOCALAPPDATA%\bench mark audio analyzer\libstdc++-6.dll
%LOCALAPPDATA%\bench mark audio analyzer\is-pbrfb.tmp в %LOCALAPPDATA%\bench mark audio analyzer\libgcc_s_dw2-1.dll
%LOCALAPPDATA%\bench mark audio analyzer\is-aus7m.tmp в %LOCALAPPDATA%\bench mark audio analyzer\qt.conf
%LOCALAPPDATA%\bench mark audio analyzer\is-algqd.tmp в %LOCALAPPDATA%\bench mark audio analyzer\qt5printsupport.dll
%LOCALAPPDATA%\bench mark audio analyzer\is-l9mif.tmp в %LOCALAPPDATA%\bench mark audio analyzer\benchmarkaudioanalyzer.exe

Сетевая активность

Подключается к

'so####rvice.shop':80

TCP

Запросы HTTP POST

http://so####rvice.shop/new/net_api

UDP

DNS ASK so####rvice.shop

Другое

Ищет следующие окна

ClassName: 'X8f1f1_Wnd_6261X8f1f1' WindowName: ''

Создает и запускает на исполнение

'%TEMP%\is-nvcoj.tmp\<Имя файла>.tmp' /SL5="$A0258,6541999,56832,<Полный путь к файлу>"
'%LOCALAPPDATA%\bench mark audio analyzer\benchmarkaudioanalyzer.exe' 53ad0f4857184dbe6c9be372cdd8e7cc

Запускает на исполнение