Trojan.DownLoader47.52289

Technical Information

Modifies file system

Creates the following files

%TEMP%\is-efct6.tmp\<File name>.tmp
%LOCALAPPDATA%\multimedia server\is-jhac2.tmp
%LOCALAPPDATA%\multimedia server\libav\is-8mk9h.tmp
%LOCALAPPDATA%\multimedia server\libav\is-tg0gf.tmp
%LOCALAPPDATA%\multimedia server\libav\is-o4b2n.tmp
%LOCALAPPDATA%\multimedia server\libav\is-opib0.tmp
%LOCALAPPDATA%\multimedia server\libav\is-q28vg.tmp
%LOCALAPPDATA%\multimedia server\libav\is-04rlf.tmp
%LOCALAPPDATA%\multimedia server\libav\is-s9c53.tmp
%LOCALAPPDATA%\multimedia server\libav\is-dplgs.tmp
%LOCALAPPDATA%\multimedia server\is-gua6s.tmp
%LOCALAPPDATA%\multimedia server\is-vbf7h.tmp
%LOCALAPPDATA%\multimedia server\is-po20h.tmp
%LOCALAPPDATA%\multimedia server\is-6thuv.tmp
%LOCALAPPDATA%\multimedia server\is-gulvt.tmp
%LOCALAPPDATA%\multimedia server\is-llipu.tmp
%LOCALAPPDATA%\multimedia server\is-kt2v6.tmp
%LOCALAPPDATA%\multimedia server\is-6enag.tmp
%LOCALAPPDATA%\multimedia server\is-097eq.tmp
%LOCALAPPDATA%\multimedia server\is-9kgju.tmp
%LOCALAPPDATA%\multimedia server\is-hnffd.tmp
%LOCALAPPDATA%\multimedia server\is-o9gso.tmp
%LOCALAPPDATA%\multimedia server\is-j6ors.tmp
%LOCALAPPDATA%\multimedia server\is-u2vgo.tmp
%TEMP%\is-6k43c.tmp\_isetup\_iscrypt.dll
%TEMP%\is-6k43c.tmp\_isetup\_shfoldr.dll
%TEMP%\is-6k43c.tmp\_isetup\_setup64.tmp
%TEMP%\is-6k43c.tmp\_isetup\_regdll.tmp
%LOCALAPPDATA%\multimedia server\unins000.dat
%LOCALAPPDATA%\multimedia server\multimediaserver32.exe

Moves the following files

from %LOCALAPPDATA%\multimedia server\is-u2vgo.tmp to %LOCALAPPDATA%\multimedia server\unins000.exe
from %LOCALAPPDATA%\multimedia server\libav\is-tg0gf.tmp to %LOCALAPPDATA%\multimedia server\libav\sdl.dll
from %LOCALAPPDATA%\multimedia server\libav\is-o4b2n.tmp to %LOCALAPPDATA%\multimedia server\libav\mobile.ffpreset
from %LOCALAPPDATA%\multimedia server\libav\is-opib0.tmp to %LOCALAPPDATA%\multimedia server\libav\avutil-50.dll
from %LOCALAPPDATA%\multimedia server\libav\is-q28vg.tmp to %LOCALAPPDATA%\multimedia server\libav\avformat-52.dll
from %LOCALAPPDATA%\multimedia server\libav\is-04rlf.tmp to %LOCALAPPDATA%\multimedia server\libav\avfilter-1.dll
from %LOCALAPPDATA%\multimedia server\libav\is-s9c53.tmp to %LOCALAPPDATA%\multimedia server\libav\avdevice-52.dll
from %LOCALAPPDATA%\multimedia server\libav\is-dplgs.tmp to %LOCALAPPDATA%\multimedia server\libav\avcore-0.dll
from %LOCALAPPDATA%\multimedia server\is-gua6s.tmp to %LOCALAPPDATA%\multimedia server\zlib1.dll
from %LOCALAPPDATA%\multimedia server\is-vbf7h.tmp to %LOCALAPPDATA%\multimedia server\qtgmic.dll
from %LOCALAPPDATA%\multimedia server\libav\is-8mk9h.tmp to %LOCALAPPDATA%\multimedia server\libav\swscale-0.dll
from %LOCALAPPDATA%\multimedia server\is-po20h.tmp to %LOCALAPPDATA%\multimedia server\libwinpthread-1.dll
from %LOCALAPPDATA%\multimedia server\is-gulvt.tmp to %LOCALAPPDATA%\multimedia server\libgmic.dll
from %LOCALAPPDATA%\multimedia server\is-llipu.tmp to %LOCALAPPDATA%\multimedia server\libgcc_s_dw2-1.dll
from %LOCALAPPDATA%\multimedia server\is-kt2v6.tmp to %LOCALAPPDATA%\multimedia server\msvcr120.dll
from %LOCALAPPDATA%\multimedia server\is-6enag.tmp to %LOCALAPPDATA%\multimedia server\ssleay32.dll
from %LOCALAPPDATA%\multimedia server\is-097eq.tmp to %LOCALAPPDATA%\multimedia server\libeay32.dll
from %LOCALAPPDATA%\multimedia server\is-9kgju.tmp to %LOCALAPPDATA%\multimedia server\uninstallutils.dll
from %LOCALAPPDATA%\multimedia server\is-hnffd.tmp to %LOCALAPPDATA%\multimedia server\libmpfr-4.dll
from %LOCALAPPDATA%\multimedia server\is-o9gso.tmp to %LOCALAPPDATA%\multimedia server\libgmp-10.dll
from %LOCALAPPDATA%\multimedia server\is-j6ors.tmp to %LOCALAPPDATA%\multimedia server\instutils.exe
from %LOCALAPPDATA%\multimedia server\is-6thuv.tmp to %LOCALAPPDATA%\multimedia server\libstdc++-6.dll
from %LOCALAPPDATA%\multimedia server\is-jhac2.tmp to %LOCALAPPDATA%\multimedia server\multimediaserver32.exe

Network activity

Connects to

'st###7345724.ru':80

TCP

HTTP POST requests

http://st###7345724.ru/new/net_api

UDP

DNS ASK st###7345724.ru

Miscellaneous

Searches for the following windows

ClassName: 'X%x_hitWnd_10112cd28b1' WindowName: ''

Creates and executes the following

'%TEMP%\is-efct6.tmp\<File name>.tmp' /SL5="$5024E,8365245,54272,<Full path to file>"
'%LOCALAPPDATA%\multimedia server\multimediaserver32.exe' b1b9e95b046660a9405770535f3b0d21

Executes the following