Trojan.DownLoader47.285

Technical Information

Modifies file system

Creates the following files

%TEMP%\is-ftunl.tmp\<File name>.tmp
%LOCALAPPDATA%\sound forge audio studio\is-83std.tmp
%LOCALAPPDATA%\sound forge audio studio\is-h8j7m.tmp
%LOCALAPPDATA%\sound forge audio studio\printsupport\is-do2hj.tmp
%LOCALAPPDATA%\sound forge audio studio\platforms\is-uiug1.tmp
%LOCALAPPDATA%\sound forge audio studio\platforms\is-in8nv.tmp
%LOCALAPPDATA%\sound forge audio studio\platforms\is-v42ed.tmp
%LOCALAPPDATA%\sound forge audio studio\imageformats\is-2hrbh.tmp
%LOCALAPPDATA%\sound forge audio studio\imageformats\is-r5587.tmp
%LOCALAPPDATA%\sound forge audio studio\is-9dd0j.tmp
%LOCALAPPDATA%\sound forge audio studio\is-lgcr4.tmp
%LOCALAPPDATA%\sound forge audio studio\is-vlemm.tmp
%LOCALAPPDATA%\sound forge audio studio\is-vbt72.tmp
%LOCALAPPDATA%\sound forge audio studio\is-ijlqi.tmp
%LOCALAPPDATA%\sound forge audio studio\is-lsj84.tmp
%LOCALAPPDATA%\sound forge audio studio\is-89ko9.tmp
%LOCALAPPDATA%\sound forge audio studio\is-hsg0p.tmp
%LOCALAPPDATA%\sound forge audio studio\is-or9t4.tmp
%LOCALAPPDATA%\sound forge audio studio\is-4h8jk.tmp
%LOCALAPPDATA%\sound forge audio studio\is-em99j.tmp
%LOCALAPPDATA%\sound forge audio studio\is-joedk.tmp
%LOCALAPPDATA%\sound forge audio studio\is-a74jg.tmp
%LOCALAPPDATA%\sound forge audio studio\is-o03vt.tmp
%LOCALAPPDATA%\sound forge audio studio\is-eqlnr.tmp
%LOCALAPPDATA%\sound forge audio studio\is-5bi9s.tmp
%LOCALAPPDATA%\sound forge audio studio\is-0ufsu.tmp
%TEMP%\is-tkij6.tmp\_isetup\_iscrypt.dll
%TEMP%\is-tkij6.tmp\_isetup\_isdecmp.dll
%TEMP%\is-tkij6.tmp\_isetup\_shfoldr.dll
%TEMP%\is-tkij6.tmp\_isetup\_setup64.tmp
%LOCALAPPDATA%\sound forge audio studio\unins000.dat
%LOCALAPPDATA%\sound forge audio studio\soundforgeaudiostudio.exe

Moves the following files

from %LOCALAPPDATA%\sound forge audio studio\is-0ufsu.tmp to %LOCALAPPDATA%\sound forge audio studio\unins000.exe
from %LOCALAPPDATA%\sound forge audio studio\printsupport\is-do2hj.tmp to %LOCALAPPDATA%\sound forge audio studio\printsupport\windowsprintersupport.dll
from %LOCALAPPDATA%\sound forge audio studio\platforms\is-uiug1.tmp to %LOCALAPPDATA%\sound forge audio studio\platforms\qwindows.dll
from %LOCALAPPDATA%\sound forge audio studio\platforms\is-in8nv.tmp to %LOCALAPPDATA%\sound forge audio studio\platforms\qoffscreen.dll
from %LOCALAPPDATA%\sound forge audio studio\platforms\is-v42ed.tmp to %LOCALAPPDATA%\sound forge audio studio\platforms\qminimal.dll
from %LOCALAPPDATA%\sound forge audio studio\imageformats\is-2hrbh.tmp to %LOCALAPPDATA%\sound forge audio studio\imageformats\qjpeg.dll
from %LOCALAPPDATA%\sound forge audio studio\imageformats\is-r5587.tmp to %LOCALAPPDATA%\sound forge audio studio\imageformats\qgif.dll
from %LOCALAPPDATA%\sound forge audio studio\is-9dd0j.tmp to %LOCALAPPDATA%\sound forge audio studio\ssleay32.dll
from %LOCALAPPDATA%\sound forge audio studio\is-lgcr4.tmp to %LOCALAPPDATA%\sound forge audio studio\qt5webkitwidgets.dll
from %LOCALAPPDATA%\sound forge audio studio\is-vlemm.tmp to %LOCALAPPDATA%\sound forge audio studio\qt5webchannel.dll
from %LOCALAPPDATA%\sound forge audio studio\is-vbt72.tmp to %LOCALAPPDATA%\sound forge audio studio\qt5sql.dll
from %LOCALAPPDATA%\sound forge audio studio\is-h8j7m.tmp to %LOCALAPPDATA%\sound forge audio studio\firealpaca_mdp.ico
from %LOCALAPPDATA%\sound forge audio studio\is-ijlqi.tmp to %LOCALAPPDATA%\sound forge audio studio\qt5sensors.dll
from %LOCALAPPDATA%\sound forge audio studio\is-89ko9.tmp to %LOCALAPPDATA%\sound forge audio studio\qt5positioning.dll
from %LOCALAPPDATA%\sound forge audio studio\is-hsg0p.tmp to %LOCALAPPDATA%\sound forge audio studio\qt5opengl.dll
from %LOCALAPPDATA%\sound forge audio studio\is-or9t4.tmp to %LOCALAPPDATA%\sound forge audio studio\qt5network.dll
from %LOCALAPPDATA%\sound forge audio studio\is-4h8jk.tmp to %LOCALAPPDATA%\sound forge audio studio\qt5multimediawidgets.dll
from %LOCALAPPDATA%\sound forge audio studio\is-em99j.tmp to %LOCALAPPDATA%\sound forge audio studio\qt5multimedia.dll
from %LOCALAPPDATA%\sound forge audio studio\is-joedk.tmp to %LOCALAPPDATA%\sound forge audio studio\qt5concurrent.dll
from %LOCALAPPDATA%\sound forge audio studio\is-a74jg.tmp to %LOCALAPPDATA%\sound forge audio studio\libwinpthread-1.dll
from %LOCALAPPDATA%\sound forge audio studio\is-o03vt.tmp to %LOCALAPPDATA%\sound forge audio studio\libstdc++-6.dll
from %LOCALAPPDATA%\sound forge audio studio\is-eqlnr.tmp to %LOCALAPPDATA%\sound forge audio studio\libgcc_s_dw2-1.dll
from %LOCALAPPDATA%\sound forge audio studio\is-5bi9s.tmp to %LOCALAPPDATA%\sound forge audio studio\qt.conf
from %LOCALAPPDATA%\sound forge audio studio\is-lsj84.tmp to %LOCALAPPDATA%\sound forge audio studio\qt5printsupport.dll
from %LOCALAPPDATA%\sound forge audio studio\is-83std.tmp to %LOCALAPPDATA%\sound forge audio studio\soundforgeaudiostudio.exe

Network activity

Connects to

'so####rvice.shop':80

TCP

HTTP POST requests

http://so####rvice.shop/new/net_api

UDP

DNS ASK so####rvice.shop

Miscellaneous

Searches for the following windows

ClassName: 'Teeead_Wnd_5161Teeead' WindowName: ''

Creates and executes the following

'%TEMP%\is-ftunl.tmp\<File name>.tmp' /SL5="$F0196,6378385,56832,<Full path to file>"
'%LOCALAPPDATA%\sound forge audio studio\soundforgeaudiostudio.exe' 8e292d1c210d71d5d964fa22bab38337

Executes the following