Trojan.DownLoader47.9176

Техническая информация

Изменения в файловой системе

Создает следующие файлы

%TEMP%\is-5kqcn.tmp\<Имя файла>.tmp
%LOCALAPPDATA%\streaming audio recorder\is-arbnr.tmp
%LOCALAPPDATA%\streaming audio recorder\is-pinek.tmp
%LOCALAPPDATA%\streaming audio recorder\printsupport\is-kn758.tmp
%LOCALAPPDATA%\streaming audio recorder\platforms\is-rv7h7.tmp
%LOCALAPPDATA%\streaming audio recorder\platforms\is-ns0ar.tmp
%LOCALAPPDATA%\streaming audio recorder\platforms\is-jhf1e.tmp
%LOCALAPPDATA%\streaming audio recorder\imageformats\is-efm5j.tmp
%LOCALAPPDATA%\streaming audio recorder\imageformats\is-hkf53.tmp
%LOCALAPPDATA%\streaming audio recorder\is-f9kmk.tmp
%LOCALAPPDATA%\streaming audio recorder\is-a6t96.tmp
%LOCALAPPDATA%\streaming audio recorder\is-jqadb.tmp
%LOCALAPPDATA%\streaming audio recorder\is-u2k41.tmp
%LOCALAPPDATA%\streaming audio recorder\is-j7i1d.tmp
%LOCALAPPDATA%\streaming audio recorder\is-abf75.tmp
%LOCALAPPDATA%\streaming audio recorder\is-674so.tmp
%LOCALAPPDATA%\streaming audio recorder\is-6ql1a.tmp
%LOCALAPPDATA%\streaming audio recorder\is-o29lf.tmp
%LOCALAPPDATA%\streaming audio recorder\is-j8jgi.tmp
%LOCALAPPDATA%\streaming audio recorder\is-qljo1.tmp
%LOCALAPPDATA%\streaming audio recorder\is-acj45.tmp
%LOCALAPPDATA%\streaming audio recorder\is-ni711.tmp
%LOCALAPPDATA%\streaming audio recorder\is-i64el.tmp
%LOCALAPPDATA%\streaming audio recorder\is-htk7e.tmp
%LOCALAPPDATA%\streaming audio recorder\is-69c7r.tmp
%LOCALAPPDATA%\streaming audio recorder\is-ef1mc.tmp
%TEMP%\is-ckhuo.tmp\_isetup\_iscrypt.dll
%TEMP%\is-ckhuo.tmp\_isetup\_isdecmp.dll
%TEMP%\is-ckhuo.tmp\_isetup\_shfoldr.dll
%TEMP%\is-ckhuo.tmp\_isetup\_setup64.tmp
%LOCALAPPDATA%\streaming audio recorder\unins000.dat
%LOCALAPPDATA%\streaming audio recorder\streamingaudiorecorder32.exe

Перемещает следующие файлы

%LOCALAPPDATA%\streaming audio recorder\is-ef1mc.tmp в %LOCALAPPDATA%\streaming audio recorder\unins000.exe
%LOCALAPPDATA%\streaming audio recorder\printsupport\is-kn758.tmp в %LOCALAPPDATA%\streaming audio recorder\printsupport\windowsprintersupport.dll
%LOCALAPPDATA%\streaming audio recorder\platforms\is-rv7h7.tmp в %LOCALAPPDATA%\streaming audio recorder\platforms\qwindows.dll
%LOCALAPPDATA%\streaming audio recorder\platforms\is-ns0ar.tmp в %LOCALAPPDATA%\streaming audio recorder\platforms\qoffscreen.dll
%LOCALAPPDATA%\streaming audio recorder\platforms\is-jhf1e.tmp в %LOCALAPPDATA%\streaming audio recorder\platforms\qminimal.dll
%LOCALAPPDATA%\streaming audio recorder\imageformats\is-efm5j.tmp в %LOCALAPPDATA%\streaming audio recorder\imageformats\qjpeg.dll
%LOCALAPPDATA%\streaming audio recorder\imageformats\is-hkf53.tmp в %LOCALAPPDATA%\streaming audio recorder\imageformats\qgif.dll
%LOCALAPPDATA%\streaming audio recorder\is-f9kmk.tmp в %LOCALAPPDATA%\streaming audio recorder\ssleay32.dll
%LOCALAPPDATA%\streaming audio recorder\is-a6t96.tmp в %LOCALAPPDATA%\streaming audio recorder\qt5webkitwidgets.dll
%LOCALAPPDATA%\streaming audio recorder\is-jqadb.tmp в %LOCALAPPDATA%\streaming audio recorder\qt5webchannel.dll
%LOCALAPPDATA%\streaming audio recorder\is-u2k41.tmp в %LOCALAPPDATA%\streaming audio recorder\qt5sql.dll
%LOCALAPPDATA%\streaming audio recorder\is-pinek.tmp в %LOCALAPPDATA%\streaming audio recorder\firealpaca_mdp.ico
%LOCALAPPDATA%\streaming audio recorder\is-j7i1d.tmp в %LOCALAPPDATA%\streaming audio recorder\qt5sensors.dll
%LOCALAPPDATA%\streaming audio recorder\is-674so.tmp в %LOCALAPPDATA%\streaming audio recorder\qt5positioning.dll
%LOCALAPPDATA%\streaming audio recorder\is-6ql1a.tmp в %LOCALAPPDATA%\streaming audio recorder\qt5opengl.dll
%LOCALAPPDATA%\streaming audio recorder\is-o29lf.tmp в %LOCALAPPDATA%\streaming audio recorder\qt5network.dll
%LOCALAPPDATA%\streaming audio recorder\is-j8jgi.tmp в %LOCALAPPDATA%\streaming audio recorder\qt5multimediawidgets.dll
%LOCALAPPDATA%\streaming audio recorder\is-qljo1.tmp в %LOCALAPPDATA%\streaming audio recorder\qt5multimedia.dll
%LOCALAPPDATA%\streaming audio recorder\is-acj45.tmp в %LOCALAPPDATA%\streaming audio recorder\qt5concurrent.dll
%LOCALAPPDATA%\streaming audio recorder\is-ni711.tmp в %LOCALAPPDATA%\streaming audio recorder\libwinpthread-1.dll
%LOCALAPPDATA%\streaming audio recorder\is-i64el.tmp в %LOCALAPPDATA%\streaming audio recorder\libstdc++-6.dll
%LOCALAPPDATA%\streaming audio recorder\is-htk7e.tmp в %LOCALAPPDATA%\streaming audio recorder\libgcc_s_dw2-1.dll
%LOCALAPPDATA%\streaming audio recorder\is-69c7r.tmp в %LOCALAPPDATA%\streaming audio recorder\qt.conf
%LOCALAPPDATA%\streaming audio recorder\is-abf75.tmp в %LOCALAPPDATA%\streaming audio recorder\qt5printsupport.dll
%LOCALAPPDATA%\streaming audio recorder\is-arbnr.tmp в %LOCALAPPDATA%\streaming audio recorder\streamingaudiorecorder32.exe

Сетевая активность

Подключается к

'so####rvice.shop':80

TCP

Запросы HTTP POST

http://so####rvice.shop/new/net_api

UDP

DNS ASK so####rvice.shop

Другое

Ищет следующие окна

ClassName: 'j%x_Wnd_782c94209' WindowName: ''

Создает и запускает на исполнение

'%TEMP%\is-5kqcn.tmp\<Имя файла>.tmp' /SL5="$40254,6972949,56832,<Полный путь к файлу>"
'%LOCALAPPDATA%\streaming audio recorder\streamingaudiorecorder32.exe' 8ad1732bb1716c575abcc48f61bd0623

Запускает на исполнение