Trojan.DownLoader45.1261

Technical Information

Modifies file system

Creates the following files

%TEMP%\is-85ptf.tmp\is-igaq1.tmp
%ProgramFiles(x86)%\fmm drive recovery\unins000.dat
%ProgramFiles(x86)%\fmm drive recovery\is-o6tl2.tmp
%ProgramFiles(x86)%\fmm drive recovery\is-k0df6.tmp
%ProgramFiles(x86)%\fmm drive recovery\is-jtrd8.tmp
%ProgramFiles(x86)%\fmm drive recovery\is-nh8vt.tmp
%ProgramFiles(x86)%\fmm drive recovery\is-vsdhm.tmp
%ProgramFiles(x86)%\fmm drive recovery\is-m648m.tmp
%ProgramFiles(x86)%\fmm drive recovery\is-s090i.tmp
%ProgramFiles(x86)%\fmm drive recovery\is-t6mfi.tmp
%ProgramFiles(x86)%\fmm drive recovery\is-pk9e7.tmp
%ProgramFiles(x86)%\fmm drive recovery\is-053bq.tmp
%ProgramFiles(x86)%\fmm drive recovery\is-eq4vc.tmp
%ProgramFiles(x86)%\fmm drive recovery\is-plonu.tmp
%ProgramFiles(x86)%\fmm drive recovery\is-56oit.tmp
%ProgramFiles(x86)%\fmm drive recovery\frecover.exe
%ProgramFiles(x86)%\fmm drive recovery\is-8eajo.tmp
%ProgramFiles(x86)%\fmm drive recovery\is-dhhm8.tmp
%ProgramFiles(x86)%\fmm drive recovery\is-qjjbv.tmp
%ProgramFiles(x86)%\fmm drive recovery\is-l3gfo.tmp
%ProgramFiles(x86)%\fmm drive recovery\is-9fcci.tmp
%ProgramFiles(x86)%\fmm drive recovery\is-7u2rp.tmp
%ProgramFiles(x86)%\fmm drive recovery\is-st59l.tmp
%ProgramFiles(x86)%\fmm drive recovery\is-72s33.tmp
%ProgramFiles(x86)%\fmm drive recovery\is-h47be.tmp
%ProgramFiles(x86)%\fmm drive recovery\is-akndo.tmp
%ProgramFiles(x86)%\fmm drive recovery\is-dsf08.tmp
%TEMP%\is-5nv50.tmp\_isetup\_iscrypt.dll
%TEMP%\is-5nv50.tmp\_isetup\_shfoldr.dll
%TEMP%\is-5nv50.tmp\_isetup\_setup64.tmp
%TEMP%\is-5nv50.tmp\_isetup\_regdll.tmp
%ProgramFiles(x86)%\fmm drive recovery\is-2g0rv.tmp
%TEMP%\iobit.cab

Moves the following files

from %ProgramFiles(x86)%\fmm drive recovery\is-dsf08.tmp to %ProgramFiles(x86)%\fmm drive recovery\unins000.exe
from %ProgramFiles(x86)%\fmm drive recovery\is-jtrd8.tmp to %ProgramFiles(x86)%\fmm drive recovery\pt.lan
from %ProgramFiles(x86)%\fmm drive recovery\is-nh8vt.tmp to %ProgramFiles(x86)%\fmm drive recovery\ar.lan
from %ProgramFiles(x86)%\fmm drive recovery\is-vsdhm.tmp to %ProgramFiles(x86)%\fmm drive recovery\sk.lan
from %ProgramFiles(x86)%\fmm drive recovery\is-m648m.tmp to %ProgramFiles(x86)%\fmm drive recovery\pl.lan
from %ProgramFiles(x86)%\fmm drive recovery\is-s090i.tmp to %ProgramFiles(x86)%\fmm drive recovery\fa.lan
from %ProgramFiles(x86)%\fmm drive recovery\is-t6mfi.tmp to %ProgramFiles(x86)%\fmm drive recovery\cnt.lan
from %ProgramFiles(x86)%\fmm drive recovery\is-pk9e7.tmp to %ProgramFiles(x86)%\fmm drive recovery\cn.lan
from %ProgramFiles(x86)%\fmm drive recovery\is-053bq.tmp to %ProgramFiles(x86)%\fmm drive recovery\it.lan
from %ProgramFiles(x86)%\fmm drive recovery\is-eq4vc.tmp to %ProgramFiles(x86)%\fmm drive recovery\fin.lan
from %ProgramFiles(x86)%\fmm drive recovery\is-plonu.tmp to %ProgramFiles(x86)%\fmm drive recovery\bg.lan
from %ProgramFiles(x86)%\fmm drive recovery\is-k0df6.tmp to %ProgramFiles(x86)%\fmm drive recovery\turbosearch.exe
from %ProgramFiles(x86)%\fmm drive recovery\is-56oit.tmp to %ProgramFiles(x86)%\fmm drive recovery\tr.lan
from %ProgramFiles(x86)%\fmm drive recovery\is-2g0rv.tmp to %ProgramFiles(x86)%\fmm drive recovery\es.lan
from %ProgramFiles(x86)%\fmm drive recovery\is-dhhm8.tmp to %ProgramFiles(x86)%\fmm drive recovery\ro.lan
from %ProgramFiles(x86)%\fmm drive recovery\is-qjjbv.tmp to %ProgramFiles(x86)%\fmm drive recovery\hu.lan
from %ProgramFiles(x86)%\fmm drive recovery\is-l3gfo.tmp to %ProgramFiles(x86)%\fmm drive recovery\ru.lan
from %ProgramFiles(x86)%\fmm drive recovery\is-9fcci.tmp to %ProgramFiles(x86)%\fmm drive recovery\de.lan
from %ProgramFiles(x86)%\fmm drive recovery\is-7u2rp.tmp to %ProgramFiles(x86)%\fmm drive recovery\fr.lan
from %ProgramFiles(x86)%\fmm drive recovery\is-st59l.tmp to %ProgramFiles(x86)%\fmm drive recovery\en.lan
from %ProgramFiles(x86)%\fmm drive recovery\is-72s33.tmp to %ProgramFiles(x86)%\fmm drive recovery\frecover.exe.manifest
from %ProgramFiles(x86)%\fmm drive recovery\is-h47be.tmp to %ProgramFiles(x86)%\fmm drive recovery\license.txt
from %ProgramFiles(x86)%\fmm drive recovery\is-akndo.tmp to %ProgramFiles(x86)%\fmm drive recovery\readme.txt
from %ProgramFiles(x86)%\fmm drive recovery\is-8eajo.tmp to %ProgramFiles(x86)%\fmm drive recovery\du.lan
from %ProgramFiles(x86)%\fmm drive recovery\is-o6tl2.tmp to %ProgramFiles(x86)%\fmm drive recovery\frecover.exe

Network activity

Connects to

'tu####lotneli.cf':80

TCP

HTTP GET requests

http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?56#######

HTTP POST requests

http://tu####lotneli.cf/new/net_api

UDP

DNS ASK tu####lotneli.cf

Miscellaneous

Searches for the following windows

ClassName: '' WindowName: 'FmmbitsWindowClassFmm16'

Creates and executes the following

'%TEMP%\is-85ptf.tmp\is-igaq1.tmp' /SL4 $D001A "<Full path to file>" 5093345 50176
'%ProgramFiles(x86)%\fmm drive recovery\frecover.exe'
'%ProgramFiles(x86)%\fmm drive recovery\frecover.exe' 8b5f198b418b5c9e98f830f4e351ffeb

Executes the following