Trojan.DownLoader45.38030

Technical Information

Modifies file system

Creates the following files

%TEMP%\is-u69fj.tmp\<File name>.tmp
%ProgramFiles(x86)%\reg organizer\is-4v2g0.tmp
%ProgramFiles(x86)%\reg organizer\languages\is-g7s2o.tmp
%ProgramFiles(x86)%\reg organizer\documentation\russian\is-4khmi.tmp
%ProgramFiles(x86)%\reg organizer\is-vq37v.tmp
%ProgramFiles(x86)%\reg organizer\is-lg6gn.tmp
%ProgramFiles(x86)%\reg organizer\is-53q0a.tmp
%ProgramFiles(x86)%\reg organizer\documentation\english\is-iq912.tmp
%ProgramFiles(x86)%\reg organizer\is-r6bc9.tmp
%ProgramFiles(x86)%\reg organizer\is-mqlki.tmp
%ProgramFiles(x86)%\reg organizer\is-mmo1m.tmp
%ProgramFiles(x86)%\reg organizer\is-a7hsb.tmp
%ProgramFiles(x86)%\reg organizer\is-st0th.tmp
%ProgramFiles(x86)%\reg organizer\is-2g1nq.tmp
%ProgramFiles(x86)%\reg organizer\is-p2o64.tmp
%ProgramFiles(x86)%\reg organizer\is-ojhek.tmp
%ProgramFiles(x86)%\reg organizer\is-o0st0.tmp
%ProgramFiles(x86)%\reg organizer\is-2f7qn.tmp
%ProgramFiles(x86)%\reg organizer\is-h250t.tmp
%ProgramFiles(x86)%\reg organizer\is-pcl26.tmp
%ProgramFiles(x86)%\reg organizer\is-arpvt.tmp
%ProgramFiles(x86)%\reg organizer\is-p4i1g.tmp
%ProgramFiles(x86)%\reg organizer\is-gkbp8.tmp
%ProgramFiles(x86)%\reg organizer\is-nr458.tmp
%TEMP%\is-tbufg.tmp\_isetup\_iscrypt.dll
%TEMP%\is-tbufg.tmp\_isetup\_shfoldr.dll
%TEMP%\is-tbufg.tmp\_isetup\_setup64.tmp
%TEMP%\is-tbufg.tmp\_isetup\_regdll.tmp
%ProgramFiles(x86)%\reg organizer\unins000.dat
%ProgramFiles(x86)%\reg organizer\regorganizeragent.exe

Moves the following files

from %ProgramFiles(x86)%\reg organizer\is-nr458.tmp to %ProgramFiles(x86)%\reg organizer\unins000.exe
from %ProgramFiles(x86)%\reg organizer\documentation\russian\is-4khmi.tmp to %ProgramFiles(x86)%\reg organizer\documentation\russian\documentation.chm
from %ProgramFiles(x86)%\reg organizer\is-vq37v.tmp to %ProgramFiles(x86)%\reg organizer\whatsnew-russian.txt
from %ProgramFiles(x86)%\reg organizer\is-lg6gn.tmp to %ProgramFiles(x86)%\reg organizer\readme-russian.txt
from %ProgramFiles(x86)%\reg organizer\is-53q0a.tmp to %ProgramFiles(x86)%\reg organizer\license-russian.txt
from %ProgramFiles(x86)%\reg organizer\documentation\english\is-iq912.tmp to %ProgramFiles(x86)%\reg organizer\documentation\english\documentation.chm
from %ProgramFiles(x86)%\reg organizer\is-r6bc9.tmp to %ProgramFiles(x86)%\reg organizer\whatsnew.txt
from %ProgramFiles(x86)%\reg organizer\is-mqlki.tmp to %ProgramFiles(x86)%\reg organizer\readme.txt
from %ProgramFiles(x86)%\reg organizer\is-mmo1m.tmp to %ProgramFiles(x86)%\reg organizer\license.txt
from %ProgramFiles(x86)%\reg organizer\is-a7hsb.tmp to %ProgramFiles(x86)%\reg organizer\updaterdll.dll
from %ProgramFiles(x86)%\reg organizer\languages\is-g7s2o.tmp to %ProgramFiles(x86)%\reg organizer\languages\russian.sib
from %ProgramFiles(x86)%\reg organizer\is-st0th.tmp to %ProgramFiles(x86)%\reg organizer\updater.exe
from %ProgramFiles(x86)%\reg organizer\is-p2o64.tmp to %ProgramFiles(x86)%\reg organizer\reg64call.exe
from %ProgramFiles(x86)%\reg organizer\is-ojhek.tmp to %ProgramFiles(x86)%\reg organizer\optimizationanimation.avi
from %ProgramFiles(x86)%\reg organizer\is-o0st0.tmp to %ProgramFiles(x86)%\reg organizer\installertracingagent.dll
from %ProgramFiles(x86)%\reg organizer\is-2f7qn.tmp to %ProgramFiles(x86)%\reg organizer\ignore_dc.first
from %ProgramFiles(x86)%\reg organizer\is-h250t.tmp to %ProgramFiles(x86)%\reg organizer\ignore_arc.first
from %ProgramFiles(x86)%\reg organizer\is-pcl26.tmp to %ProgramFiles(x86)%\reg organizer\filemasks.first
from %ProgramFiles(x86)%\reg organizer\is-arpvt.tmp to %ProgramFiles(x86)%\reg organizer\closeapplication.dll
from %ProgramFiles(x86)%\reg organizer\is-p4i1g.tmp to %ProgramFiles(x86)%\reg organizer\cleanfolders.first
from %ProgramFiles(x86)%\reg organizer\is-gkbp8.tmp to %ProgramFiles(x86)%\reg organizer\links.xml
from %ProgramFiles(x86)%\reg organizer\is-2g1nq.tmp to %ProgramFiles(x86)%\reg organizer\regorganizeragent.exe
from %ProgramFiles(x86)%\reg organizer\is-4v2g0.tmp to %ProgramFiles(x86)%\reg organizer\turbosearch.exe

Network activity

Connects to

'ma####elminobhei.ml':80

TCP

HTTP POST requests

http://ma####elminobhei.ml/new/net_api

UDP

DNS ASK ma####elminobhei.ml

Miscellaneous

Searches for the following windows

ClassName: '{1ca8f2c8-6a63-35d4-4091-5ba1d7aa3752}' WindowName: ''

Creates and executes the following

'%TEMP%\is-u69fj.tmp\<File name>.tmp' /SL5="$11022C,5106608,67072,<Full path to file>"
'%ProgramFiles(x86)%\reg organizer\regorganizeragent.exe'
'%ProgramFiles(x86)%\reg organizer\regorganizeragent.exe' acacb1fb78af3ef7242c150c758f2831

Executes the following