Trojan.DownLoader47.2522

Technical Information

Modifies file system

Creates the following files

%TEMP%\is-jl61i.tmp\<File name>.tmp
%LOCALAPPDATA%\free mp3tag\is-h78if.tmp
%LOCALAPPDATA%\free mp3tag\is-pd18a.tmp
%LOCALAPPDATA%\free mp3tag\printsupport\is-gie2u.tmp
%LOCALAPPDATA%\free mp3tag\platforms\is-k3pj3.tmp
%LOCALAPPDATA%\free mp3tag\platforms\is-ure06.tmp
%LOCALAPPDATA%\free mp3tag\platforms\is-97262.tmp
%LOCALAPPDATA%\free mp3tag\imageformats\is-591e9.tmp
%LOCALAPPDATA%\free mp3tag\imageformats\is-5d3ri.tmp
%LOCALAPPDATA%\free mp3tag\is-tcrif.tmp
%LOCALAPPDATA%\free mp3tag\is-lphea.tmp
%LOCALAPPDATA%\free mp3tag\is-1s35a.tmp
%LOCALAPPDATA%\free mp3tag\is-4d036.tmp
%LOCALAPPDATA%\free mp3tag\is-8iakj.tmp
%LOCALAPPDATA%\free mp3tag\is-adc3b.tmp
%LOCALAPPDATA%\free mp3tag\is-msalb.tmp
%LOCALAPPDATA%\free mp3tag\is-h5u66.tmp
%LOCALAPPDATA%\free mp3tag\is-qu35q.tmp
%LOCALAPPDATA%\free mp3tag\is-6g5bc.tmp
%LOCALAPPDATA%\free mp3tag\is-g46vh.tmp
%LOCALAPPDATA%\free mp3tag\is-1ep4q.tmp
%LOCALAPPDATA%\free mp3tag\is-dllpa.tmp
%LOCALAPPDATA%\free mp3tag\is-d5ogm.tmp
%LOCALAPPDATA%\free mp3tag\is-s88p6.tmp
%LOCALAPPDATA%\free mp3tag\is-82p3b.tmp
%LOCALAPPDATA%\free mp3tag\is-eelme.tmp
%TEMP%\is-iqr1g.tmp\_isetup\_iscrypt.dll
%TEMP%\is-iqr1g.tmp\_isetup\_isdecmp.dll
%TEMP%\is-iqr1g.tmp\_isetup\_shfoldr.dll
%TEMP%\is-iqr1g.tmp\_isetup\_setup64.tmp
%LOCALAPPDATA%\free mp3tag\unins000.dat
%LOCALAPPDATA%\free mp3tag\freemp3tag32.exe

Moves the following files

from %LOCALAPPDATA%\free mp3tag\is-eelme.tmp to %LOCALAPPDATA%\free mp3tag\unins000.exe
from %LOCALAPPDATA%\free mp3tag\printsupport\is-gie2u.tmp to %LOCALAPPDATA%\free mp3tag\printsupport\windowsprintersupport.dll
from %LOCALAPPDATA%\free mp3tag\platforms\is-k3pj3.tmp to %LOCALAPPDATA%\free mp3tag\platforms\qwindows.dll
from %LOCALAPPDATA%\free mp3tag\platforms\is-ure06.tmp to %LOCALAPPDATA%\free mp3tag\platforms\qoffscreen.dll
from %LOCALAPPDATA%\free mp3tag\platforms\is-97262.tmp to %LOCALAPPDATA%\free mp3tag\platforms\qminimal.dll
from %LOCALAPPDATA%\free mp3tag\imageformats\is-591e9.tmp to %LOCALAPPDATA%\free mp3tag\imageformats\qjpeg.dll
from %LOCALAPPDATA%\free mp3tag\imageformats\is-5d3ri.tmp to %LOCALAPPDATA%\free mp3tag\imageformats\qgif.dll
from %LOCALAPPDATA%\free mp3tag\is-tcrif.tmp to %LOCALAPPDATA%\free mp3tag\ssleay32.dll
from %LOCALAPPDATA%\free mp3tag\is-lphea.tmp to %LOCALAPPDATA%\free mp3tag\qt5webkitwidgets.dll
from %LOCALAPPDATA%\free mp3tag\is-1s35a.tmp to %LOCALAPPDATA%\free mp3tag\qt5webchannel.dll
from %LOCALAPPDATA%\free mp3tag\is-4d036.tmp to %LOCALAPPDATA%\free mp3tag\qt5sql.dll
from %LOCALAPPDATA%\free mp3tag\is-pd18a.tmp to %LOCALAPPDATA%\free mp3tag\firealpaca_mdp.ico
from %LOCALAPPDATA%\free mp3tag\is-8iakj.tmp to %LOCALAPPDATA%\free mp3tag\qt5sensors.dll
from %LOCALAPPDATA%\free mp3tag\is-msalb.tmp to %LOCALAPPDATA%\free mp3tag\qt5positioning.dll
from %LOCALAPPDATA%\free mp3tag\is-h5u66.tmp to %LOCALAPPDATA%\free mp3tag\qt5opengl.dll
from %LOCALAPPDATA%\free mp3tag\is-qu35q.tmp to %LOCALAPPDATA%\free mp3tag\qt5network.dll
from %LOCALAPPDATA%\free mp3tag\is-6g5bc.tmp to %LOCALAPPDATA%\free mp3tag\qt5multimediawidgets.dll
from %LOCALAPPDATA%\free mp3tag\is-g46vh.tmp to %LOCALAPPDATA%\free mp3tag\qt5multimedia.dll
from %LOCALAPPDATA%\free mp3tag\is-1ep4q.tmp to %LOCALAPPDATA%\free mp3tag\qt5concurrent.dll
from %LOCALAPPDATA%\free mp3tag\is-dllpa.tmp to %LOCALAPPDATA%\free mp3tag\libwinpthread-1.dll
from %LOCALAPPDATA%\free mp3tag\is-d5ogm.tmp to %LOCALAPPDATA%\free mp3tag\libstdc++-6.dll
from %LOCALAPPDATA%\free mp3tag\is-s88p6.tmp to %LOCALAPPDATA%\free mp3tag\libgcc_s_dw2-1.dll
from %LOCALAPPDATA%\free mp3tag\is-82p3b.tmp to %LOCALAPPDATA%\free mp3tag\qt.conf
from %LOCALAPPDATA%\free mp3tag\is-adc3b.tmp to %LOCALAPPDATA%\free mp3tag\qt5printsupport.dll
from %LOCALAPPDATA%\free mp3tag\is-h78if.tmp to %LOCALAPPDATA%\free mp3tag\freemp3tag32.exe

Network activity

Connects to

'so####rvice.shop':80

TCP

HTTP POST requests

http://so####rvice.shop/new/net_api

UDP

DNS ASK so####rvice.shop

Miscellaneous

Searches for the following windows

ClassName: 'b5bef5_Wnd_682b5bef5' WindowName: ''

Creates and executes the following

'%TEMP%\is-jl61i.tmp\<File name>.tmp' /SL5="$50234,6930865,56832,<Full path to file>"
'%LOCALAPPDATA%\free mp3tag\freemp3tag32.exe' b7f8fe071849e51a9919855fe07f30db

Executes the following