Trojan.Zadved.1700

Technical Information

Modifies file system

Creates the following files

%TEMP%\is-s307b.tmp\is-tfp1n.tmp
%ProgramFiles(x86)%\fnb drive recovery\unins000.dat
%ProgramFiles(x86)%\fnb drive recovery\is-j6dnd.tmp
%ProgramFiles(x86)%\fnb drive recovery\is-9p29t.tmp
%ProgramFiles(x86)%\fnb drive recovery\is-vj5b1.tmp
%ProgramFiles(x86)%\fnb drive recovery\is-nj5da.tmp
%ProgramFiles(x86)%\fnb drive recovery\is-mi7i1.tmp
%ProgramFiles(x86)%\fnb drive recovery\is-nl6q7.tmp
%ProgramFiles(x86)%\fnb drive recovery\is-thvmt.tmp
%ProgramFiles(x86)%\fnb drive recovery\is-im2vg.tmp
%ProgramFiles(x86)%\fnb drive recovery\is-tur9f.tmp
%ProgramFiles(x86)%\fnb drive recovery\is-hd20a.tmp
%ProgramFiles(x86)%\fnb drive recovery\is-bi8gn.tmp
%ProgramFiles(x86)%\fnb drive recovery\is-9vgu2.tmp
%ProgramFiles(x86)%\fnb drive recovery\is-p1rcv.tmp
%ProgramFiles(x86)%\fnb drive recovery\frecover.exe
%ProgramFiles(x86)%\fnb drive recovery\is-lofid.tmp
%ProgramFiles(x86)%\fnb drive recovery\is-lr6p8.tmp
%ProgramFiles(x86)%\fnb drive recovery\is-dravq.tmp
%ProgramFiles(x86)%\fnb drive recovery\is-n3rap.tmp
%ProgramFiles(x86)%\fnb drive recovery\is-5m577.tmp
%ProgramFiles(x86)%\fnb drive recovery\is-1hh5b.tmp
%ProgramFiles(x86)%\fnb drive recovery\is-j6np7.tmp
%ProgramFiles(x86)%\fnb drive recovery\is-t6j7l.tmp
%ProgramFiles(x86)%\fnb drive recovery\is-lar2d.tmp
%ProgramFiles(x86)%\fnb drive recovery\is-r4jqj.tmp
%ProgramFiles(x86)%\fnb drive recovery\is-20k4f.tmp
%TEMP%\is-bapba.tmp\_isetup\_iscrypt.dll
%TEMP%\is-bapba.tmp\_isetup\_shfoldr.dll
%TEMP%\is-bapba.tmp\_isetup\_setup64.tmp
%TEMP%\is-bapba.tmp\_isetup\_regdll.tmp
%ProgramFiles(x86)%\fnb drive recovery\is-f6t9o.tmp
%TEMP%\iobit.cab

Moves the following files

from %ProgramFiles(x86)%\fnb drive recovery\is-20k4f.tmp to %ProgramFiles(x86)%\fnb drive recovery\unins000.exe
from %ProgramFiles(x86)%\fnb drive recovery\is-vj5b1.tmp to %ProgramFiles(x86)%\fnb drive recovery\pt.lan
from %ProgramFiles(x86)%\fnb drive recovery\is-nj5da.tmp to %ProgramFiles(x86)%\fnb drive recovery\ar.lan
from %ProgramFiles(x86)%\fnb drive recovery\is-mi7i1.tmp to %ProgramFiles(x86)%\fnb drive recovery\sk.lan
from %ProgramFiles(x86)%\fnb drive recovery\is-nl6q7.tmp to %ProgramFiles(x86)%\fnb drive recovery\pl.lan
from %ProgramFiles(x86)%\fnb drive recovery\is-thvmt.tmp to %ProgramFiles(x86)%\fnb drive recovery\fa.lan
from %ProgramFiles(x86)%\fnb drive recovery\is-im2vg.tmp to %ProgramFiles(x86)%\fnb drive recovery\cnt.lan
from %ProgramFiles(x86)%\fnb drive recovery\is-tur9f.tmp to %ProgramFiles(x86)%\fnb drive recovery\cn.lan
from %ProgramFiles(x86)%\fnb drive recovery\is-hd20a.tmp to %ProgramFiles(x86)%\fnb drive recovery\it.lan
from %ProgramFiles(x86)%\fnb drive recovery\is-bi8gn.tmp to %ProgramFiles(x86)%\fnb drive recovery\fin.lan
from %ProgramFiles(x86)%\fnb drive recovery\is-9vgu2.tmp to %ProgramFiles(x86)%\fnb drive recovery\bg.lan
from %ProgramFiles(x86)%\fnb drive recovery\is-9p29t.tmp to %ProgramFiles(x86)%\fnb drive recovery\turbosearch.exe
from %ProgramFiles(x86)%\fnb drive recovery\is-p1rcv.tmp to %ProgramFiles(x86)%\fnb drive recovery\tr.lan
from %ProgramFiles(x86)%\fnb drive recovery\is-f6t9o.tmp to %ProgramFiles(x86)%\fnb drive recovery\es.lan
from %ProgramFiles(x86)%\fnb drive recovery\is-lr6p8.tmp to %ProgramFiles(x86)%\fnb drive recovery\ro.lan
from %ProgramFiles(x86)%\fnb drive recovery\is-dravq.tmp to %ProgramFiles(x86)%\fnb drive recovery\hu.lan
from %ProgramFiles(x86)%\fnb drive recovery\is-n3rap.tmp to %ProgramFiles(x86)%\fnb drive recovery\ru.lan
from %ProgramFiles(x86)%\fnb drive recovery\is-5m577.tmp to %ProgramFiles(x86)%\fnb drive recovery\de.lan
from %ProgramFiles(x86)%\fnb drive recovery\is-1hh5b.tmp to %ProgramFiles(x86)%\fnb drive recovery\fr.lan
from %ProgramFiles(x86)%\fnb drive recovery\is-j6np7.tmp to %ProgramFiles(x86)%\fnb drive recovery\en.lan
from %ProgramFiles(x86)%\fnb drive recovery\is-t6j7l.tmp to %ProgramFiles(x86)%\fnb drive recovery\frecover.exe.manifest
from %ProgramFiles(x86)%\fnb drive recovery\is-lar2d.tmp to %ProgramFiles(x86)%\fnb drive recovery\license.txt
from %ProgramFiles(x86)%\fnb drive recovery\is-r4jqj.tmp to %ProgramFiles(x86)%\fnb drive recovery\readme.txt
from %ProgramFiles(x86)%\fnb drive recovery\is-lofid.tmp to %ProgramFiles(x86)%\fnb drive recovery\du.lan
from %ProgramFiles(x86)%\fnb drive recovery\is-j6dnd.tmp to %ProgramFiles(x86)%\fnb drive recovery\frecover.exe

Network activity

Connects to

'tu####lotneli.cf':80

TCP

HTTP GET requests

http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?56#######

HTTP POST requests

http://tu####lotneli.cf/new/net_api

UDP

DNS ASK tu####lotneli.cf

Miscellaneous

Searches for the following windows

ClassName: '' WindowName: 'FnbbitsWindowClassFnb31'

Creates and executes the following

'%TEMP%\is-s307b.tmp\is-tfp1n.tmp' /SL4 $C0118 "<Full path to file>" 4618604 70656
'%ProgramFiles(x86)%\fnb drive recovery\frecover.exe'
'%ProgramFiles(x86)%\fnb drive recovery\frecover.exe' 663121df7df779d3cf768f3cd9d7fb9e

Executes the following