Trojan.DownLoader47.3582

Technical Information

Modifies file system

Creates the following files

%TEMP%\is-08s04.tmp\is-n2l6g.tmp
%LOCALAPPDATA%\free audio recorder\is-mhbg5.tmp
%LOCALAPPDATA%\free audio recorder\is-c16pm.tmp
%LOCALAPPDATA%\free audio recorder\printsupport\is-0h4b8.tmp
%LOCALAPPDATA%\free audio recorder\platforms\is-jbu3q.tmp
%LOCALAPPDATA%\free audio recorder\platforms\is-4cdac.tmp
%LOCALAPPDATA%\free audio recorder\platforms\is-ko6h4.tmp
%LOCALAPPDATA%\free audio recorder\imageformats\is-6vm2u.tmp
%LOCALAPPDATA%\free audio recorder\imageformats\is-ive5u.tmp
%LOCALAPPDATA%\free audio recorder\is-bca2j.tmp
%LOCALAPPDATA%\free audio recorder\is-rbdhp.tmp
%LOCALAPPDATA%\free audio recorder\is-3eep9.tmp
%LOCALAPPDATA%\free audio recorder\is-7ddhd.tmp
%LOCALAPPDATA%\free audio recorder\is-c2uj3.tmp
%LOCALAPPDATA%\free audio recorder\is-0f00s.tmp
%LOCALAPPDATA%\free audio recorder\unins000.dat
%LOCALAPPDATA%\free audio recorder\is-38k2g.tmp
%LOCALAPPDATA%\free audio recorder\is-8ppq3.tmp
%LOCALAPPDATA%\free audio recorder\is-pu5nm.tmp
%LOCALAPPDATA%\free audio recorder\is-2jimr.tmp
%LOCALAPPDATA%\free audio recorder\is-2mplb.tmp
%LOCALAPPDATA%\free audio recorder\is-s1eps.tmp
%LOCALAPPDATA%\free audio recorder\is-8hk3e.tmp
%LOCALAPPDATA%\free audio recorder\is-gd0ij.tmp
%LOCALAPPDATA%\free audio recorder\is-273o9.tmp
%LOCALAPPDATA%\free audio recorder\is-k26ol.tmp
%TEMP%\is-l2o5d.tmp\_isetup\_iscrypt.dll
%TEMP%\is-l2o5d.tmp\_isetup\_isdecmp.dll
%TEMP%\is-l2o5d.tmp\_isetup\_shfoldr.dll
%TEMP%\is-l2o5d.tmp\_isetup\_setup64.tmp
%TEMP%\is-l2o5d.tmp\_isetup\_regdll.tmp
%LOCALAPPDATA%\free audio recorder\is-dbetf.tmp
%LOCALAPPDATA%\free audio recorder\freeaudiorecorder.exe

Moves the following files

from %LOCALAPPDATA%\free audio recorder\is-k26ol.tmp to %LOCALAPPDATA%\free audio recorder\unins000.exe
from %LOCALAPPDATA%\free audio recorder\printsupport\is-0h4b8.tmp to %LOCALAPPDATA%\free audio recorder\printsupport\windowsprintersupport.dll
from %LOCALAPPDATA%\free audio recorder\platforms\is-jbu3q.tmp to %LOCALAPPDATA%\free audio recorder\platforms\qwindows.dll
from %LOCALAPPDATA%\free audio recorder\platforms\is-4cdac.tmp to %LOCALAPPDATA%\free audio recorder\platforms\qoffscreen.dll
from %LOCALAPPDATA%\free audio recorder\platforms\is-ko6h4.tmp to %LOCALAPPDATA%\free audio recorder\platforms\qminimal.dll
from %LOCALAPPDATA%\free audio recorder\imageformats\is-6vm2u.tmp to %LOCALAPPDATA%\free audio recorder\imageformats\qjpeg.dll
from %LOCALAPPDATA%\free audio recorder\imageformats\is-ive5u.tmp to %LOCALAPPDATA%\free audio recorder\imageformats\qgif.dll
from %LOCALAPPDATA%\free audio recorder\is-bca2j.tmp to %LOCALAPPDATA%\free audio recorder\ssleay32.dll
from %LOCALAPPDATA%\free audio recorder\is-rbdhp.tmp to %LOCALAPPDATA%\free audio recorder\qt5webkitwidgets.dll
from %LOCALAPPDATA%\free audio recorder\is-3eep9.tmp to %LOCALAPPDATA%\free audio recorder\qt5webchannel.dll
from %LOCALAPPDATA%\free audio recorder\is-7ddhd.tmp to %LOCALAPPDATA%\free audio recorder\qt5sql.dll
from %LOCALAPPDATA%\free audio recorder\is-c16pm.tmp to %LOCALAPPDATA%\free audio recorder\firealpaca_mdp.ico
from %LOCALAPPDATA%\free audio recorder\is-c2uj3.tmp to %LOCALAPPDATA%\free audio recorder\qt5sensors.dll
from %LOCALAPPDATA%\free audio recorder\is-38k2g.tmp to %LOCALAPPDATA%\free audio recorder\qt5positioning.dll
from %LOCALAPPDATA%\free audio recorder\is-dbetf.tmp to %LOCALAPPDATA%\free audio recorder\qt5opengl.dll
from %LOCALAPPDATA%\free audio recorder\is-8ppq3.tmp to %LOCALAPPDATA%\free audio recorder\qt5network.dll
from %LOCALAPPDATA%\free audio recorder\is-pu5nm.tmp to %LOCALAPPDATA%\free audio recorder\qt5multimediawidgets.dll
from %LOCALAPPDATA%\free audio recorder\is-2jimr.tmp to %LOCALAPPDATA%\free audio recorder\qt5multimedia.dll
from %LOCALAPPDATA%\free audio recorder\is-2mplb.tmp to %LOCALAPPDATA%\free audio recorder\qt5concurrent.dll
from %LOCALAPPDATA%\free audio recorder\is-s1eps.tmp to %LOCALAPPDATA%\free audio recorder\libwinpthread-1.dll
from %LOCALAPPDATA%\free audio recorder\is-8hk3e.tmp to %LOCALAPPDATA%\free audio recorder\libstdc++-6.dll
from %LOCALAPPDATA%\free audio recorder\is-gd0ij.tmp to %LOCALAPPDATA%\free audio recorder\libgcc_s_dw2-1.dll
from %LOCALAPPDATA%\free audio recorder\is-273o9.tmp to %LOCALAPPDATA%\free audio recorder\qt.conf
from %LOCALAPPDATA%\free audio recorder\is-0f00s.tmp to %LOCALAPPDATA%\free audio recorder\qt5printsupport.dll
from %LOCALAPPDATA%\free audio recorder\is-mhbg5.tmp to %LOCALAPPDATA%\free audio recorder\freeaudiorecorder.exe

Network activity

Connects to

'so####rvice.shop':80

TCP

HTTP POST requests

http://so####rvice.shop/new/net_api

UDP

DNS ASK so####rvice.shop

Miscellaneous

Searches for the following windows

ClassName: 'b26001_Wnd_4162b26001' WindowName: ''

Creates and executes the following

'%TEMP%\is-08s04.tmp\is-n2l6g.tmp' /SL4 $1C023A "<Full path to file>" 6734339 52224
'%LOCALAPPDATA%\free audio recorder\freeaudiorecorder.exe' 53220d4dfc5132734248bdf29aa98f89

Executes the following