Trojan.DownLoader45.18124

Technical Information

Modifies file system

Creates the following files

%TEMP%\is-09i1t.tmp\is-trpk1.tmp
%ProgramFiles(x86)%\fnc drive recovery\unins000.dat
%ProgramFiles(x86)%\fnc drive recovery\is-6bbfs.tmp
%ProgramFiles(x86)%\fnc drive recovery\is-gv3r9.tmp
%ProgramFiles(x86)%\fnc drive recovery\is-8rtnd.tmp
%ProgramFiles(x86)%\fnc drive recovery\is-4gi9t.tmp
%ProgramFiles(x86)%\fnc drive recovery\is-84lb1.tmp
%ProgramFiles(x86)%\fnc drive recovery\is-fmlda.tmp
%ProgramFiles(x86)%\fnc drive recovery\is-4vni1.tmp
%ProgramFiles(x86)%\fnc drive recovery\is-44mq7.tmp
%ProgramFiles(x86)%\fnc drive recovery\is-srfmt.tmp
%ProgramFiles(x86)%\fnc drive recovery\is-2hivg.tmp
%ProgramFiles(x86)%\fnc drive recovery\is-h4b9f.tmp
%ProgramFiles(x86)%\fnc drive recovery\is-bki0a.tmp
%ProgramFiles(x86)%\fnc drive recovery\is-djogn.tmp
%ProgramFiles(x86)%\fnc drive recovery\frecover.exe
%ProgramFiles(x86)%\fnc drive recovery\is-dj0u2.tmp
%ProgramFiles(x86)%\fnc drive recovery\is-pnvid.tmp
%ProgramFiles(x86)%\fnc drive recovery\is-00d9o.tmp
%ProgramFiles(x86)%\fnc drive recovery\is-96mp8.tmp
%ProgramFiles(x86)%\fnc drive recovery\is-egqvq.tmp
%ProgramFiles(x86)%\fnc drive recovery\is-0rbap.tmp
%ProgramFiles(x86)%\fnc drive recovery\is-h7l77.tmp
%ProgramFiles(x86)%\fnc drive recovery\is-0l15b.tmp
%ProgramFiles(x86)%\fnc drive recovery\is-sk7p7.tmp
%ProgramFiles(x86)%\fnc drive recovery\is-8m37l.tmp
%ProgramFiles(x86)%\fnc drive recovery\is-7kb2d.tmp
%TEMP%\is-203qj.tmp\_isetup\_iscrypt.dll
%TEMP%\is-203qj.tmp\_isetup\_shfoldr.dll
%TEMP%\is-203qj.tmp\_isetup\_setup64.tmp
%TEMP%\is-203qj.tmp\_isetup\_regdll.tmp
%ProgramFiles(x86)%\fnc drive recovery\is-svbcv.tmp
%TEMP%\iobit.cab

Moves the following files

from %ProgramFiles(x86)%\fnc drive recovery\is-7kb2d.tmp to %ProgramFiles(x86)%\fnc drive recovery\unins000.exe
from %ProgramFiles(x86)%\fnc drive recovery\is-8rtnd.tmp to %ProgramFiles(x86)%\fnc drive recovery\pt.lan
from %ProgramFiles(x86)%\fnc drive recovery\is-4gi9t.tmp to %ProgramFiles(x86)%\fnc drive recovery\ar.lan
from %ProgramFiles(x86)%\fnc drive recovery\is-84lb1.tmp to %ProgramFiles(x86)%\fnc drive recovery\sk.lan
from %ProgramFiles(x86)%\fnc drive recovery\is-fmlda.tmp to %ProgramFiles(x86)%\fnc drive recovery\pl.lan
from %ProgramFiles(x86)%\fnc drive recovery\is-4vni1.tmp to %ProgramFiles(x86)%\fnc drive recovery\fa.lan
from %ProgramFiles(x86)%\fnc drive recovery\is-44mq7.tmp to %ProgramFiles(x86)%\fnc drive recovery\cnt.lan
from %ProgramFiles(x86)%\fnc drive recovery\is-srfmt.tmp to %ProgramFiles(x86)%\fnc drive recovery\cn.lan
from %ProgramFiles(x86)%\fnc drive recovery\is-2hivg.tmp to %ProgramFiles(x86)%\fnc drive recovery\it.lan
from %ProgramFiles(x86)%\fnc drive recovery\is-h4b9f.tmp to %ProgramFiles(x86)%\fnc drive recovery\fin.lan
from %ProgramFiles(x86)%\fnc drive recovery\is-bki0a.tmp to %ProgramFiles(x86)%\fnc drive recovery\bg.lan
from %ProgramFiles(x86)%\fnc drive recovery\is-gv3r9.tmp to %ProgramFiles(x86)%\fnc drive recovery\turbosearch.exe
from %ProgramFiles(x86)%\fnc drive recovery\is-djogn.tmp to %ProgramFiles(x86)%\fnc drive recovery\tr.lan
from %ProgramFiles(x86)%\fnc drive recovery\is-svbcv.tmp to %ProgramFiles(x86)%\fnc drive recovery\es.lan
from %ProgramFiles(x86)%\fnc drive recovery\is-pnvid.tmp to %ProgramFiles(x86)%\fnc drive recovery\ro.lan
from %ProgramFiles(x86)%\fnc drive recovery\is-00d9o.tmp to %ProgramFiles(x86)%\fnc drive recovery\hu.lan
from %ProgramFiles(x86)%\fnc drive recovery\is-96mp8.tmp to %ProgramFiles(x86)%\fnc drive recovery\ru.lan
from %ProgramFiles(x86)%\fnc drive recovery\is-egqvq.tmp to %ProgramFiles(x86)%\fnc drive recovery\de.lan
from %ProgramFiles(x86)%\fnc drive recovery\is-0rbap.tmp to %ProgramFiles(x86)%\fnc drive recovery\fr.lan
from %ProgramFiles(x86)%\fnc drive recovery\is-h7l77.tmp to %ProgramFiles(x86)%\fnc drive recovery\en.lan
from %ProgramFiles(x86)%\fnc drive recovery\is-0l15b.tmp to %ProgramFiles(x86)%\fnc drive recovery\frecover.exe.manifest
from %ProgramFiles(x86)%\fnc drive recovery\is-sk7p7.tmp to %ProgramFiles(x86)%\fnc drive recovery\license.txt
from %ProgramFiles(x86)%\fnc drive recovery\is-8m37l.tmp to %ProgramFiles(x86)%\fnc drive recovery\readme.txt
from %ProgramFiles(x86)%\fnc drive recovery\is-dj0u2.tmp to %ProgramFiles(x86)%\fnc drive recovery\du.lan
from %ProgramFiles(x86)%\fnc drive recovery\is-6bbfs.tmp to %ProgramFiles(x86)%\fnc drive recovery\frecover.exe

Network activity

Connects to

'tu####lotneli.cf':80

TCP

HTTP GET requests

http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?56#######

HTTP POST requests

http://tu####lotneli.cf/new/net_api

UDP

DNS ASK tu####lotneli.cf

Miscellaneous

Searches for the following windows

ClassName: '' WindowName: 'FncbitsWindowClassFnc32'

Creates and executes the following

'%TEMP%\is-09i1t.tmp\is-trpk1.tmp' /SL4 $15002A "<Full path to file>" 5128364 92160
'%ProgramFiles(x86)%\fnc drive recovery\frecover.exe'
'%ProgramFiles(x86)%\fnc drive recovery\frecover.exe' 9f183c562007d008276b4d3e7ba60b92

Executes the following