Trojan.DownLoader45.48944

Technical Information

Modifies file system

Creates the following files

%TEMP%\is-4mb8d.tmp\is-4jdup.tmp
%ProgramFiles(x86)%\fmq drive recovery\unins000.dat
%ProgramFiles(x86)%\fmq drive recovery\is-vohe6.tmp
%ProgramFiles(x86)%\fmq drive recovery\is-a8tom.tmp
%ProgramFiles(x86)%\fmq drive recovery\is-4k6sr.tmp
%ProgramFiles(x86)%\fmq drive recovery\is-aj21u.tmp
%ProgramFiles(x86)%\fmq drive recovery\is-r10n0.tmp
%ProgramFiles(x86)%\fmq drive recovery\is-3dn32.tmp
%ProgramFiles(x86)%\fmq drive recovery\is-bvdrh.tmp
%ProgramFiles(x86)%\fmq drive recovery\is-4gqrs.tmp
%ProgramFiles(x86)%\fmq drive recovery\is-cvctj.tmp
%ProgramFiles(x86)%\fmq drive recovery\is-cu03c.tmp
%ProgramFiles(x86)%\fmq drive recovery\is-kb5ej.tmp
%ProgramFiles(x86)%\fmq drive recovery\is-78j9s.tmp
%ProgramFiles(x86)%\fmq drive recovery\is-a3lo6.tmp
%ProgramFiles(x86)%\fmq drive recovery\frecover.exe
%ProgramFiles(x86)%\fmq drive recovery\is-vuaat.tmp
%ProgramFiles(x86)%\fmq drive recovery\is-ud2f7.tmp
%ProgramFiles(x86)%\fmq drive recovery\is-54b12.tmp
%ProgramFiles(x86)%\fmq drive recovery\is-2ggus.tmp
%ProgramFiles(x86)%\fmq drive recovery\is-d69ms.tmp
%ProgramFiles(x86)%\fmq drive recovery\is-g6a34.tmp
%ProgramFiles(x86)%\fmq drive recovery\is-1kume.tmp
%ProgramFiles(x86)%\fmq drive recovery\is-m52oi.tmp
%ProgramFiles(x86)%\fmq drive recovery\is-30eok.tmp
%ProgramFiles(x86)%\fmq drive recovery\is-jnggs.tmp
%ProgramFiles(x86)%\fmq drive recovery\is-rdmqj.tmp
%TEMP%\is-n9c56.tmp\_isetup\_iscrypt.dll
%TEMP%\is-n9c56.tmp\_isetup\_shfoldr.dll
%TEMP%\is-n9c56.tmp\_isetup\_setup64.tmp
%TEMP%\is-n9c56.tmp\_isetup\_regdll.tmp
%ProgramFiles(x86)%\fmq drive recovery\is-60969.tmp
%TEMP%\iobit.cab

Moves the following files

from %ProgramFiles(x86)%\fmq drive recovery\is-rdmqj.tmp to %ProgramFiles(x86)%\fmq drive recovery\unins000.exe
from %ProgramFiles(x86)%\fmq drive recovery\is-4k6sr.tmp to %ProgramFiles(x86)%\fmq drive recovery\pt.lan
from %ProgramFiles(x86)%\fmq drive recovery\is-aj21u.tmp to %ProgramFiles(x86)%\fmq drive recovery\ar.lan
from %ProgramFiles(x86)%\fmq drive recovery\is-r10n0.tmp to %ProgramFiles(x86)%\fmq drive recovery\sk.lan
from %ProgramFiles(x86)%\fmq drive recovery\is-3dn32.tmp to %ProgramFiles(x86)%\fmq drive recovery\pl.lan
from %ProgramFiles(x86)%\fmq drive recovery\is-bvdrh.tmp to %ProgramFiles(x86)%\fmq drive recovery\fa.lan
from %ProgramFiles(x86)%\fmq drive recovery\is-4gqrs.tmp to %ProgramFiles(x86)%\fmq drive recovery\cnt.lan
from %ProgramFiles(x86)%\fmq drive recovery\is-cvctj.tmp to %ProgramFiles(x86)%\fmq drive recovery\cn.lan
from %ProgramFiles(x86)%\fmq drive recovery\is-cu03c.tmp to %ProgramFiles(x86)%\fmq drive recovery\it.lan
from %ProgramFiles(x86)%\fmq drive recovery\is-kb5ej.tmp to %ProgramFiles(x86)%\fmq drive recovery\fin.lan
from %ProgramFiles(x86)%\fmq drive recovery\is-78j9s.tmp to %ProgramFiles(x86)%\fmq drive recovery\bg.lan
from %ProgramFiles(x86)%\fmq drive recovery\is-a8tom.tmp to %ProgramFiles(x86)%\fmq drive recovery\turbosearch.exe
from %ProgramFiles(x86)%\fmq drive recovery\is-a3lo6.tmp to %ProgramFiles(x86)%\fmq drive recovery\tr.lan
from %ProgramFiles(x86)%\fmq drive recovery\is-60969.tmp to %ProgramFiles(x86)%\fmq drive recovery\es.lan
from %ProgramFiles(x86)%\fmq drive recovery\is-ud2f7.tmp to %ProgramFiles(x86)%\fmq drive recovery\ro.lan
from %ProgramFiles(x86)%\fmq drive recovery\is-54b12.tmp to %ProgramFiles(x86)%\fmq drive recovery\hu.lan
from %ProgramFiles(x86)%\fmq drive recovery\is-2ggus.tmp to %ProgramFiles(x86)%\fmq drive recovery\ru.lan
from %ProgramFiles(x86)%\fmq drive recovery\is-d69ms.tmp to %ProgramFiles(x86)%\fmq drive recovery\de.lan
from %ProgramFiles(x86)%\fmq drive recovery\is-g6a34.tmp to %ProgramFiles(x86)%\fmq drive recovery\fr.lan
from %ProgramFiles(x86)%\fmq drive recovery\is-1kume.tmp to %ProgramFiles(x86)%\fmq drive recovery\en.lan
from %ProgramFiles(x86)%\fmq drive recovery\is-m52oi.tmp to %ProgramFiles(x86)%\fmq drive recovery\frecover.exe.manifest
from %ProgramFiles(x86)%\fmq drive recovery\is-30eok.tmp to %ProgramFiles(x86)%\fmq drive recovery\license.txt
from %ProgramFiles(x86)%\fmq drive recovery\is-jnggs.tmp to %ProgramFiles(x86)%\fmq drive recovery\readme.txt
from %ProgramFiles(x86)%\fmq drive recovery\is-vuaat.tmp to %ProgramFiles(x86)%\fmq drive recovery\du.lan
from %ProgramFiles(x86)%\fmq drive recovery\is-vohe6.tmp to %ProgramFiles(x86)%\fmq drive recovery\frecover.exe

Network activity

Connects to

'tu####lotneli.cf':80

TCP

HTTP GET requests

http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?56#######

HTTP POST requests

http://tu####lotneli.cf/new/net_api

UDP

DNS ASK tu####lotneli.cf

Miscellaneous

Searches for the following windows

ClassName: '' WindowName: 'FmqbitsWindowClassFmq20'

Creates and executes the following

'%TEMP%\is-4mb8d.tmp\is-4jdup.tmp' /SL4 $B00A2 "<Full path to file>" 5312815 162304
'%ProgramFiles(x86)%\fmq drive recovery\frecover.exe'
'%ProgramFiles(x86)%\fmq drive recovery\frecover.exe' f3576b8a257e0f1abd17a53bd52fc5f2

Executes the following