Trojan.DownLoader47.61998

Technical Information

Modifies file system

Creates the following files

%TEMP%\is-r0gcn.tmp\is-ddfv1.tmp
%LOCALAPPDATA%\flvplayer 3.7.0.2\is-0q9i0.tmp
%LOCALAPPDATA%\flvplayer 3.7.0.2\is-6eq0g.tmp
%LOCALAPPDATA%\flvplayer 3.7.0.2\is-f1tms.tmp
%LOCALAPPDATA%\flvplayer 3.7.0.2\is-4il86.tmp
%LOCALAPPDATA%\flvplayer 3.7.0.2\is-mv5sa.tmp
%LOCALAPPDATA%\flvplayer 3.7.0.2\is-guuf6.tmp
%LOCALAPPDATA%\flvplayer 3.7.0.2\is-s10tj.tmp
%LOCALAPPDATA%\flvplayer 3.7.0.2\is-8n4e4.tmp
%LOCALAPPDATA%\flvplayer 3.7.0.2\is-1ekp9.tmp
%LOCALAPPDATA%\flvplayer 3.7.0.2\is-2slnv.tmp
%LOCALAPPDATA%\flvplayer 3.7.0.2\is-riij5.tmp
%LOCALAPPDATA%\flvplayer 3.7.0.2\is-rc1jr.tmp
%LOCALAPPDATA%\flvplayer 3.7.0.2\is-pst67.tmp
%LOCALAPPDATA%\flvplayer 3.7.0.2\is-ikp75.tmp
%LOCALAPPDATA%\flvplayer 3.7.0.2\is-n7m6p.tmp
%LOCALAPPDATA%\flvplayer 3.7.0.2\is-ql5fi.tmp
%LOCALAPPDATA%\flvplayer 3.7.0.2\is-75lkc.tmp
%LOCALAPPDATA%\flvplayer 3.7.0.2\is-nr5d0.tmp
%LOCALAPPDATA%\flvplayer 3.7.0.2\is-e8fro.tmp
%LOCALAPPDATA%\flvplayer 3.7.0.2\is-rd8ri.tmp
%LOCALAPPDATA%\flvplayer 3.7.0.2\is-uoe8v.tmp
%LOCALAPPDATA%\flvplayer 3.7.0.2\is-b6rtn.tmp
%LOCALAPPDATA%\flvplayer 3.7.0.2\uninstall\is-gcu9a.tmp
%TEMP%\is-u4mm2.tmp\_isetup\_iscrypt.dll
%TEMP%\is-u4mm2.tmp\_isetup\_shfoldr.dll
%TEMP%\is-u4mm2.tmp\_isetup\_setup64.tmp
%TEMP%\is-u4mm2.tmp\_isetup\_regdll.tmp
%LOCALAPPDATA%\flvplayer 3.7.0.2\uninstall\unins000.dat
%LOCALAPPDATA%\flvplayer 3.7.0.2\flvplayerfree23.exe

Moves the following files

from %LOCALAPPDATA%\flvplayer 3.7.0.2\uninstall\is-gcu9a.tmp to %LOCALAPPDATA%\flvplayer 3.7.0.2\uninstall\unins000.exe
from %LOCALAPPDATA%\flvplayer 3.7.0.2\is-f1tms.tmp to %LOCALAPPDATA%\flvplayer 3.7.0.2\vcruntime140_1.dll
from %LOCALAPPDATA%\flvplayer 3.7.0.2\is-4il86.tmp to %LOCALAPPDATA%\flvplayer 3.7.0.2\vcruntime140.dll
from %LOCALAPPDATA%\flvplayer 3.7.0.2\is-mv5sa.tmp to %LOCALAPPDATA%\flvplayer 3.7.0.2\vccorlib140.dll
from %LOCALAPPDATA%\flvplayer 3.7.0.2\is-guuf6.tmp to %LOCALAPPDATA%\flvplayer 3.7.0.2\valuetransformers.dll
from %LOCALAPPDATA%\flvplayer 3.7.0.2\is-s10tj.tmp to %LOCALAPPDATA%\flvplayer 3.7.0.2\ucrtbase.dll
from %LOCALAPPDATA%\flvplayer 3.7.0.2\is-8n4e4.tmp to %LOCALAPPDATA%\flvplayer 3.7.0.2\netstandard.dll
from %LOCALAPPDATA%\flvplayer 3.7.0.2\is-1ekp9.tmp to %LOCALAPPDATA%\flvplayer 3.7.0.2\netsparkle.dll
from %LOCALAPPDATA%\flvplayer 3.7.0.2\is-2slnv.tmp to %LOCALAPPDATA%\flvplayer 3.7.0.2\msvcp140_2.dll
from %LOCALAPPDATA%\flvplayer 3.7.0.2\is-riij5.tmp to %LOCALAPPDATA%\flvplayer 3.7.0.2\msvcp140_1.dll
from %LOCALAPPDATA%\flvplayer 3.7.0.2\is-6eq0g.tmp to %LOCALAPPDATA%\flvplayer 3.7.0.2\sqlite3.dll
from %LOCALAPPDATA%\flvplayer 3.7.0.2\is-rc1jr.tmp to %LOCALAPPDATA%\flvplayer 3.7.0.2\msvcp140.dll
from %LOCALAPPDATA%\flvplayer 3.7.0.2\is-ikp75.tmp to %LOCALAPPDATA%\flvplayer 3.7.0.2\microsoft.appcenter.crashes.dll
from %LOCALAPPDATA%\flvplayer 3.7.0.2\is-n7m6p.tmp to %LOCALAPPDATA%\flvplayer 3.7.0.2\microsoft.appcenter.analytics.dll
from %LOCALAPPDATA%\flvplayer 3.7.0.2\is-ql5fi.tmp to %LOCALAPPDATA%\flvplayer 3.7.0.2\devkit.dll
from %LOCALAPPDATA%\flvplayer 3.7.0.2\is-75lkc.tmp to %LOCALAPPDATA%\flvplayer 3.7.0.2\concrt140.dll
from %LOCALAPPDATA%\flvplayer 3.7.0.2\is-nr5d0.tmp to %LOCALAPPDATA%\flvplayer 3.7.0.2\colorsetkit.dll
from %LOCALAPPDATA%\flvplayer 3.7.0.2\is-e8fro.tmp to %LOCALAPPDATA%\flvplayer 3.7.0.2\avutil-57.dll
from %LOCALAPPDATA%\flvplayer 3.7.0.2\is-rd8ri.tmp to %LOCALAPPDATA%\flvplayer 3.7.0.2\avformat-59.dll
from %LOCALAPPDATA%\flvplayer 3.7.0.2\is-uoe8v.tmp to %LOCALAPPDATA%\flvplayer 3.7.0.2\avfilter-8.dll
from %LOCALAPPDATA%\flvplayer 3.7.0.2\is-b6rtn.tmp to %LOCALAPPDATA%\flvplayer 3.7.0.2\avdevice-59.dll
from %LOCALAPPDATA%\flvplayer 3.7.0.2\is-pst67.tmp to %LOCALAPPDATA%\flvplayer 3.7.0.2\microsoft.appcenter.dll
from %LOCALAPPDATA%\flvplayer 3.7.0.2\is-0q9i0.tmp to %LOCALAPPDATA%\flvplayer 3.7.0.2\flvplayerfree23.exe

Network activity

Connects to

'st###7345724.ru':80

TCP

HTTP POST requests

http://st###7345724.ru/new/net_api

UDP

DNS ASK st###7345724.ru

Miscellaneous

Searches for the following windows

ClassName: 'jbf6fd_FLVPlayer_12273_jbf6fd' WindowName: ''

Creates and executes the following

'%TEMP%\is-r0gcn.tmp\is-ddfv1.tmp' /SL4 $5024A "<Full path to file>" 6746058 190976
'%LOCALAPPDATA%\flvplayer 3.7.0.2\flvplayerfree23.exe' f73742bd6e6d9f2d2f4840c78fa356b9

Executes the following