Trojan.DownLoader47.7215

Техническая информация

Изменения в файловой системе

Создает следующие файлы

%TEMP%\is-6gs07.tmp\<Имя файла>.tmp
%LOCALAPPDATA%\shampine music studio\is-v8v0r.tmp
%LOCALAPPDATA%\shampine music studio\is-d8bgk.tmp
%LOCALAPPDATA%\shampine music studio\printsupport\is-g7ol1.tmp
%LOCALAPPDATA%\shampine music studio\platforms\is-1imm5.tmp
%LOCALAPPDATA%\shampine music studio\platforms\is-19v9l.tmp
%LOCALAPPDATA%\shampine music studio\platforms\is-h2cnp.tmp
%LOCALAPPDATA%\shampine music studio\imageformats\is-bd232.tmp
%LOCALAPPDATA%\shampine music studio\imageformats\is-kgesp.tmp
%LOCALAPPDATA%\shampine music studio\is-8tmlv.tmp
%LOCALAPPDATA%\shampine music studio\is-bt4fl.tmp
%LOCALAPPDATA%\shampine music studio\is-v35h8.tmp
%LOCALAPPDATA%\shampine music studio\is-dhn07.tmp
%LOCALAPPDATA%\shampine music studio\is-3k2o2.tmp
%LOCALAPPDATA%\shampine music studio\unins000.dat
%LOCALAPPDATA%\shampine music studio\is-a7glf.tmp
%LOCALAPPDATA%\shampine music studio\is-5f1fn.tmp
%LOCALAPPDATA%\shampine music studio\is-obv65.tmp
%LOCALAPPDATA%\shampine music studio\is-6feqg.tmp
%LOCALAPPDATA%\shampine music studio\is-e2v30.tmp
%LOCALAPPDATA%\shampine music studio\is-orhei.tmp
%LOCALAPPDATA%\shampine music studio\is-h8nqh.tmp
%LOCALAPPDATA%\shampine music studio\is-s663v.tmp
%LOCALAPPDATA%\shampine music studio\is-aepb3.tmp
%LOCALAPPDATA%\shampine music studio\is-qlkjv.tmp
%LOCALAPPDATA%\shampine music studio\is-l8qjd.tmp
%TEMP%\is-hhhb5.tmp\_isetup\_iscrypt.dll
%TEMP%\is-hhhb5.tmp\_isetup\_shfoldr.dll
%TEMP%\is-hhhb5.tmp\_isetup\_setup64.tmp
%LOCALAPPDATA%\shampine music studio\is-ss7bq.tmp
%LOCALAPPDATA%\shampine music studio\shampinemusicstudio.exe

Перемещает следующие файлы

%LOCALAPPDATA%\shampine music studio\is-l8qjd.tmp в %LOCALAPPDATA%\shampine music studio\unins000.exe
%LOCALAPPDATA%\shampine music studio\printsupport\is-g7ol1.tmp в %LOCALAPPDATA%\shampine music studio\printsupport\windowsprintersupport.dll
%LOCALAPPDATA%\shampine music studio\platforms\is-1imm5.tmp в %LOCALAPPDATA%\shampine music studio\platforms\qwindows.dll
%LOCALAPPDATA%\shampine music studio\platforms\is-19v9l.tmp в %LOCALAPPDATA%\shampine music studio\platforms\qoffscreen.dll
%LOCALAPPDATA%\shampine music studio\platforms\is-h2cnp.tmp в %LOCALAPPDATA%\shampine music studio\platforms\qminimal.dll
%LOCALAPPDATA%\shampine music studio\imageformats\is-bd232.tmp в %LOCALAPPDATA%\shampine music studio\imageformats\qjpeg.dll
%LOCALAPPDATA%\shampine music studio\imageformats\is-kgesp.tmp в %LOCALAPPDATA%\shampine music studio\imageformats\qgif.dll
%LOCALAPPDATA%\shampine music studio\is-8tmlv.tmp в %LOCALAPPDATA%\shampine music studio\ssleay32.dll
%LOCALAPPDATA%\shampine music studio\is-bt4fl.tmp в %LOCALAPPDATA%\shampine music studio\qt5webkitwidgets.dll
%LOCALAPPDATA%\shampine music studio\is-v35h8.tmp в %LOCALAPPDATA%\shampine music studio\qt5webchannel.dll
%LOCALAPPDATA%\shampine music studio\is-dhn07.tmp в %LOCALAPPDATA%\shampine music studio\qt5sql.dll
%LOCALAPPDATA%\shampine music studio\is-d8bgk.tmp в %LOCALAPPDATA%\shampine music studio\firealpaca_mdp.ico
%LOCALAPPDATA%\shampine music studio\is-3k2o2.tmp в %LOCALAPPDATA%\shampine music studio\qt5sensors.dll
%LOCALAPPDATA%\shampine music studio\is-ss7bq.tmp в %LOCALAPPDATA%\shampine music studio\qt5positioning.dll
%LOCALAPPDATA%\shampine music studio\is-5f1fn.tmp в %LOCALAPPDATA%\shampine music studio\qt5opengl.dll
%LOCALAPPDATA%\shampine music studio\is-obv65.tmp в %LOCALAPPDATA%\shampine music studio\qt5network.dll
%LOCALAPPDATA%\shampine music studio\is-6feqg.tmp в %LOCALAPPDATA%\shampine music studio\qt5multimediawidgets.dll
%LOCALAPPDATA%\shampine music studio\is-e2v30.tmp в %LOCALAPPDATA%\shampine music studio\qt5multimedia.dll
%LOCALAPPDATA%\shampine music studio\is-orhei.tmp в %LOCALAPPDATA%\shampine music studio\qt5concurrent.dll
%LOCALAPPDATA%\shampine music studio\is-h8nqh.tmp в %LOCALAPPDATA%\shampine music studio\libwinpthread-1.dll
%LOCALAPPDATA%\shampine music studio\is-s663v.tmp в %LOCALAPPDATA%\shampine music studio\libstdc++-6.dll
%LOCALAPPDATA%\shampine music studio\is-aepb3.tmp в %LOCALAPPDATA%\shampine music studio\libgcc_s_dw2-1.dll
%LOCALAPPDATA%\shampine music studio\is-qlkjv.tmp в %LOCALAPPDATA%\shampine music studio\qt.conf
%LOCALAPPDATA%\shampine music studio\is-a7glf.tmp в %LOCALAPPDATA%\shampine music studio\qt5printsupport.dll
%LOCALAPPDATA%\shampine music studio\is-v8v0r.tmp в %LOCALAPPDATA%\shampine music studio\shampinemusicstudio.exe

Сетевая активность

Подключается к

'so####rvice.shop':80

TCP

Запросы HTTP POST

http://so####rvice.shop/new/net_api

UDP

DNS ASK so####rvice.shop

Другое

Ищет следующие окна

ClassName: '' WindowName: 'H%x_Wnd_6281c18be1'

Создает и запускает на исполнение

'%TEMP%\is-6gs07.tmp\<Имя файла>.tmp' /SL5="$D0242,6144864,56832,<Полный путь к файлу>"
'%LOCALAPPDATA%\shampine music studio\shampinemusicstudio.exe' 1711ffcc0e5f884af0fe6d30f1442634

Запускает на исполнение