Trojan.DownLoader45.8770

Technical Information

Modifies file system

Creates the following files

%TEMP%\is-pn14j.tmp\is-vokiv.tmp
%ProgramFiles(x86)%\fmn drive recovery\unins000.dat
%ProgramFiles(x86)%\fmn drive recovery\is-gipup.tmp
%ProgramFiles(x86)%\fmn drive recovery\is-8obb7.tmp
%ProgramFiles(x86)%\fmn drive recovery\is-fqopb.tmp
%ProgramFiles(x86)%\fmn drive recovery\is-skit7.tmp
%ProgramFiles(x86)%\fmn drive recovery\is-m5brl.tmp
%ProgramFiles(x86)%\fmn drive recovery\is-kmj6d.tmp
%ProgramFiles(x86)%\fmn drive recovery\is-6m5ej.tmp
%ProgramFiles(x86)%\fmn drive recovery\is-tmh8f.tmp
%ProgramFiles(x86)%\fmn drive recovery\is-lubva.tmp
%ProgramFiles(x86)%\fmn drive recovery\is-5p1ch.tmp
%ProgramFiles(x86)%\fmn drive recovery\is-ed797.tmp
%ProgramFiles(x86)%\fmn drive recovery\is-kog4q.tmp
%ProgramFiles(x86)%\fmn drive recovery\is-sj2fv.tmp
%ProgramFiles(x86)%\fmn drive recovery\frecover.exe
%ProgramFiles(x86)%\fmn drive recovery\is-jrlur.tmp
%ProgramFiles(x86)%\fmn drive recovery\is-5up5f.tmp
%ProgramFiles(x86)%\fmn drive recovery\is-edfnt.tmp
%ProgramFiles(x86)%\fmn drive recovery\is-k12il.tmp
%ProgramFiles(x86)%\fmn drive recovery\is-5o7jl.tmp
%ProgramFiles(x86)%\fmn drive recovery\is-ju8hm.tmp
%ProgramFiles(x86)%\fmn drive recovery\is-66u5b.tmp
%ProgramFiles(x86)%\fmn drive recovery\is-snkh4.tmp
%ProgramFiles(x86)%\fmn drive recovery\is-o3ffu.tmp
%ProgramFiles(x86)%\fmn drive recovery\is-cm74o.tmp
%ProgramFiles(x86)%\fmn drive recovery\is-qjkai.tmp
%TEMP%\is-4runi.tmp\_isetup\_iscrypt.dll
%TEMP%\is-4runi.tmp\_isetup\_shfoldr.dll
%TEMP%\is-4runi.tmp\_isetup\_setup64.tmp
%TEMP%\is-4runi.tmp\_isetup\_regdll.tmp
%ProgramFiles(x86)%\fmn drive recovery\is-cgm9f.tmp
%TEMP%\iobit.cab

Moves the following files

from %ProgramFiles(x86)%\fmn drive recovery\is-qjkai.tmp to %ProgramFiles(x86)%\fmn drive recovery\unins000.exe
from %ProgramFiles(x86)%\fmn drive recovery\is-fqopb.tmp to %ProgramFiles(x86)%\fmn drive recovery\pt.lan
from %ProgramFiles(x86)%\fmn drive recovery\is-skit7.tmp to %ProgramFiles(x86)%\fmn drive recovery\ar.lan
from %ProgramFiles(x86)%\fmn drive recovery\is-m5brl.tmp to %ProgramFiles(x86)%\fmn drive recovery\sk.lan
from %ProgramFiles(x86)%\fmn drive recovery\is-kmj6d.tmp to %ProgramFiles(x86)%\fmn drive recovery\pl.lan
from %ProgramFiles(x86)%\fmn drive recovery\is-6m5ej.tmp to %ProgramFiles(x86)%\fmn drive recovery\fa.lan
from %ProgramFiles(x86)%\fmn drive recovery\is-tmh8f.tmp to %ProgramFiles(x86)%\fmn drive recovery\cnt.lan
from %ProgramFiles(x86)%\fmn drive recovery\is-lubva.tmp to %ProgramFiles(x86)%\fmn drive recovery\cn.lan
from %ProgramFiles(x86)%\fmn drive recovery\is-5p1ch.tmp to %ProgramFiles(x86)%\fmn drive recovery\it.lan
from %ProgramFiles(x86)%\fmn drive recovery\is-ed797.tmp to %ProgramFiles(x86)%\fmn drive recovery\fin.lan
from %ProgramFiles(x86)%\fmn drive recovery\is-kog4q.tmp to %ProgramFiles(x86)%\fmn drive recovery\bg.lan
from %ProgramFiles(x86)%\fmn drive recovery\is-8obb7.tmp to %ProgramFiles(x86)%\fmn drive recovery\turbosearch.exe
from %ProgramFiles(x86)%\fmn drive recovery\is-sj2fv.tmp to %ProgramFiles(x86)%\fmn drive recovery\tr.lan
from %ProgramFiles(x86)%\fmn drive recovery\is-cgm9f.tmp to %ProgramFiles(x86)%\fmn drive recovery\es.lan
from %ProgramFiles(x86)%\fmn drive recovery\is-5up5f.tmp to %ProgramFiles(x86)%\fmn drive recovery\ro.lan
from %ProgramFiles(x86)%\fmn drive recovery\is-edfnt.tmp to %ProgramFiles(x86)%\fmn drive recovery\hu.lan
from %ProgramFiles(x86)%\fmn drive recovery\is-k12il.tmp to %ProgramFiles(x86)%\fmn drive recovery\ru.lan
from %ProgramFiles(x86)%\fmn drive recovery\is-5o7jl.tmp to %ProgramFiles(x86)%\fmn drive recovery\de.lan
from %ProgramFiles(x86)%\fmn drive recovery\is-ju8hm.tmp to %ProgramFiles(x86)%\fmn drive recovery\fr.lan
from %ProgramFiles(x86)%\fmn drive recovery\is-66u5b.tmp to %ProgramFiles(x86)%\fmn drive recovery\en.lan
from %ProgramFiles(x86)%\fmn drive recovery\is-snkh4.tmp to %ProgramFiles(x86)%\fmn drive recovery\frecover.exe.manifest
from %ProgramFiles(x86)%\fmn drive recovery\is-o3ffu.tmp to %ProgramFiles(x86)%\fmn drive recovery\license.txt
from %ProgramFiles(x86)%\fmn drive recovery\is-cm74o.tmp to %ProgramFiles(x86)%\fmn drive recovery\readme.txt
from %ProgramFiles(x86)%\fmn drive recovery\is-jrlur.tmp to %ProgramFiles(x86)%\fmn drive recovery\du.lan
from %ProgramFiles(x86)%\fmn drive recovery\is-gipup.tmp to %ProgramFiles(x86)%\fmn drive recovery\frecover.exe

Network activity

Connects to

'tu####lotneli.cf':80

TCP

HTTP GET requests

http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?56#######

HTTP POST requests

http://tu####lotneli.cf/new/net_api

UDP

DNS ASK tu####lotneli.cf

Miscellaneous

Searches for the following windows

ClassName: '' WindowName: 'FmnbitsWindowClassFmn17'

Creates and executes the following

'%TEMP%\is-pn14j.tmp\is-vokiv.tmp' /SL4 $110140 "<Full path to file>" 4946043 50176
'%ProgramFiles(x86)%\fmn drive recovery\frecover.exe'
'%ProgramFiles(x86)%\fmn drive recovery\frecover.exe' aa9a9b6194a1c38253864d0dc0797826

Executes the following