Trojan.DownLoader45.7613

Technical Information

Modifies file system

Creates the following files

%TEMP%\is-94a1j.tmp\is-4fp4c.tmp
%ProgramFiles(x86)%\fnc drive recovery\unins000.dat
%ProgramFiles(x86)%\fnc drive recovery\is-jp4cc.tmp
%ProgramFiles(x86)%\fnc drive recovery\is-sc6rg.tmp
%ProgramFiles(x86)%\fnc drive recovery\is-95a35.tmp
%ProgramFiles(x86)%\fnc drive recovery\is-jm0nh.tmp
%ProgramFiles(x86)%\fnc drive recovery\is-e3ajs.tmp
%ProgramFiles(x86)%\fnc drive recovery\is-gi6uc.tmp
%ProgramFiles(x86)%\fnc drive recovery\is-q13fh.tmp
%ProgramFiles(x86)%\fnc drive recovery\is-2g9jd.tmp
%ProgramFiles(x86)%\fnc drive recovery\is-1tsge.tmp
%ProgramFiles(x86)%\fnc drive recovery\is-6j62a.tmp
%ProgramFiles(x86)%\fnc drive recovery\is-4fbc4.tmp
%ProgramFiles(x86)%\fnc drive recovery\is-lt18u.tmp
%ProgramFiles(x86)%\fnc drive recovery\is-8t5lb.tmp
%ProgramFiles(x86)%\fnc drive recovery\frecover.exe
%ProgramFiles(x86)%\fnc drive recovery\is-eluhf.tmp
%ProgramFiles(x86)%\fnc drive recovery\is-ch6sb.tmp
%ProgramFiles(x86)%\fnc drive recovery\is-af49r.tmp
%ProgramFiles(x86)%\fnc drive recovery\is-c5kq6.tmp
%ProgramFiles(x86)%\fnc drive recovery\is-skgut.tmp
%ProgramFiles(x86)%\fnc drive recovery\is-l6olt.tmp
%ProgramFiles(x86)%\fnc drive recovery\is-h5395.tmp
%ProgramFiles(x86)%\fnc drive recovery\is-9d9el.tmp
%ProgramFiles(x86)%\fnc drive recovery\is-2uirj.tmp
%ProgramFiles(x86)%\fnc drive recovery\is-76m1r.tmp
%ProgramFiles(x86)%\fnc drive recovery\is-n2k2h.tmp
%TEMP%\is-mkb54.tmp\_isetup\_iscrypt.dll
%TEMP%\is-mkb54.tmp\_isetup\_shfoldr.dll
%TEMP%\is-mkb54.tmp\_isetup\_setup64.tmp
%TEMP%\is-mkb54.tmp\_isetup\_regdll.tmp
%ProgramFiles(x86)%\fnc drive recovery\is-955e5.tmp
%TEMP%\iobit.cab

Moves the following files

from %ProgramFiles(x86)%\fnc drive recovery\is-n2k2h.tmp to %ProgramFiles(x86)%\fnc drive recovery\unins000.exe
from %ProgramFiles(x86)%\fnc drive recovery\is-95a35.tmp to %ProgramFiles(x86)%\fnc drive recovery\pt.lan
from %ProgramFiles(x86)%\fnc drive recovery\is-jm0nh.tmp to %ProgramFiles(x86)%\fnc drive recovery\ar.lan
from %ProgramFiles(x86)%\fnc drive recovery\is-e3ajs.tmp to %ProgramFiles(x86)%\fnc drive recovery\sk.lan
from %ProgramFiles(x86)%\fnc drive recovery\is-gi6uc.tmp to %ProgramFiles(x86)%\fnc drive recovery\pl.lan
from %ProgramFiles(x86)%\fnc drive recovery\is-q13fh.tmp to %ProgramFiles(x86)%\fnc drive recovery\fa.lan
from %ProgramFiles(x86)%\fnc drive recovery\is-2g9jd.tmp to %ProgramFiles(x86)%\fnc drive recovery\cnt.lan
from %ProgramFiles(x86)%\fnc drive recovery\is-1tsge.tmp to %ProgramFiles(x86)%\fnc drive recovery\cn.lan
from %ProgramFiles(x86)%\fnc drive recovery\is-6j62a.tmp to %ProgramFiles(x86)%\fnc drive recovery\it.lan
from %ProgramFiles(x86)%\fnc drive recovery\is-4fbc4.tmp to %ProgramFiles(x86)%\fnc drive recovery\fin.lan
from %ProgramFiles(x86)%\fnc drive recovery\is-lt18u.tmp to %ProgramFiles(x86)%\fnc drive recovery\bg.lan
from %ProgramFiles(x86)%\fnc drive recovery\is-sc6rg.tmp to %ProgramFiles(x86)%\fnc drive recovery\turbosearch.exe
from %ProgramFiles(x86)%\fnc drive recovery\is-8t5lb.tmp to %ProgramFiles(x86)%\fnc drive recovery\tr.lan
from %ProgramFiles(x86)%\fnc drive recovery\is-955e5.tmp to %ProgramFiles(x86)%\fnc drive recovery\es.lan
from %ProgramFiles(x86)%\fnc drive recovery\is-ch6sb.tmp to %ProgramFiles(x86)%\fnc drive recovery\ro.lan
from %ProgramFiles(x86)%\fnc drive recovery\is-af49r.tmp to %ProgramFiles(x86)%\fnc drive recovery\hu.lan
from %ProgramFiles(x86)%\fnc drive recovery\is-c5kq6.tmp to %ProgramFiles(x86)%\fnc drive recovery\ru.lan
from %ProgramFiles(x86)%\fnc drive recovery\is-skgut.tmp to %ProgramFiles(x86)%\fnc drive recovery\de.lan
from %ProgramFiles(x86)%\fnc drive recovery\is-l6olt.tmp to %ProgramFiles(x86)%\fnc drive recovery\fr.lan
from %ProgramFiles(x86)%\fnc drive recovery\is-h5395.tmp to %ProgramFiles(x86)%\fnc drive recovery\en.lan
from %ProgramFiles(x86)%\fnc drive recovery\is-9d9el.tmp to %ProgramFiles(x86)%\fnc drive recovery\frecover.exe.manifest
from %ProgramFiles(x86)%\fnc drive recovery\is-2uirj.tmp to %ProgramFiles(x86)%\fnc drive recovery\license.txt
from %ProgramFiles(x86)%\fnc drive recovery\is-76m1r.tmp to %ProgramFiles(x86)%\fnc drive recovery\readme.txt
from %ProgramFiles(x86)%\fnc drive recovery\is-eluhf.tmp to %ProgramFiles(x86)%\fnc drive recovery\du.lan
from %ProgramFiles(x86)%\fnc drive recovery\is-jp4cc.tmp to %ProgramFiles(x86)%\fnc drive recovery\frecover.exe

Network activity

Connects to

'tu####lotneli.cf':80

TCP

HTTP GET requests

http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?56#######

HTTP POST requests

http://tu####lotneli.cf/new/net_api

UDP

DNS ASK tu####lotneli.cf

Miscellaneous

Searches for the following windows

ClassName: '' WindowName: 'FncbitsWindowClassFnc32'

Creates and executes the following

'%TEMP%\is-94a1j.tmp\is-4fp4c.tmp' /SL4 $100140 "<Full path to file>" 5126931 92160
'%ProgramFiles(x86)%\fnc drive recovery\frecover.exe'
'%ProgramFiles(x86)%\fnc drive recovery\frecover.exe' 91840f1342d196fa5e0e38e242066672

Executes the following