Trojan.DownLoader45.40160

Technical Information

Modifies file system

Creates the following files

%TEMP%\is-rpfv5.tmp\<File name>.tmp
%ProgramFiles(x86)%\reg organizer\is-te4qa.tmp
%ProgramFiles(x86)%\reg organizer\languages\is-0mpoc.tmp
%ProgramFiles(x86)%\reg organizer\documentation\russian\is-80bs8.tmp
%ProgramFiles(x86)%\reg organizer\is-tu7nf.tmp
%ProgramFiles(x86)%\reg organizer\is-k1ghi.tmp
%ProgramFiles(x86)%\reg organizer\is-lil6e.tmp
%ProgramFiles(x86)%\reg organizer\documentation\english\is-ev362.tmp
%ProgramFiles(x86)%\reg organizer\is-c2nke.tmp
%ProgramFiles(x86)%\reg organizer\is-rb7so.tmp
%ProgramFiles(x86)%\reg organizer\is-ag0es.tmp
%ProgramFiles(x86)%\reg organizer\is-9rjhu.tmp
%ProgramFiles(x86)%\reg organizer\is-t32rd.tmp
%ProgramFiles(x86)%\reg organizer\is-0mjd5.tmp
%ProgramFiles(x86)%\reg organizer\is-sp21u.tmp
%ProgramFiles(x86)%\reg organizer\is-bs335.tmp
%ProgramFiles(x86)%\reg organizer\is-hcs6l.tmp
%ProgramFiles(x86)%\reg organizer\is-53l80.tmp
%ProgramFiles(x86)%\reg organizer\is-i85jt.tmp
%ProgramFiles(x86)%\reg organizer\is-6vigu.tmp
%ProgramFiles(x86)%\reg organizer\is-4o8kd.tmp
%ProgramFiles(x86)%\reg organizer\is-tgj6h.tmp
%ProgramFiles(x86)%\reg organizer\is-ostt1.tmp
%ProgramFiles(x86)%\reg organizer\is-prn6i.tmp
%TEMP%\is-q7h6u.tmp\_isetup\_iscrypt.dll
%TEMP%\is-q7h6u.tmp\_isetup\_shfoldr.dll
%TEMP%\is-q7h6u.tmp\_isetup\_setup64.tmp
%TEMP%\is-q7h6u.tmp\_isetup\_regdll.tmp
%ProgramFiles(x86)%\reg organizer\unins000.dat
%ProgramFiles(x86)%\reg organizer\regorganizeragent.exe

Moves the following files

from %ProgramFiles(x86)%\reg organizer\is-prn6i.tmp to %ProgramFiles(x86)%\reg organizer\unins000.exe
from %ProgramFiles(x86)%\reg organizer\documentation\russian\is-80bs8.tmp to %ProgramFiles(x86)%\reg organizer\documentation\russian\documentation.chm
from %ProgramFiles(x86)%\reg organizer\is-tu7nf.tmp to %ProgramFiles(x86)%\reg organizer\whatsnew-russian.txt
from %ProgramFiles(x86)%\reg organizer\is-k1ghi.tmp to %ProgramFiles(x86)%\reg organizer\readme-russian.txt
from %ProgramFiles(x86)%\reg organizer\is-lil6e.tmp to %ProgramFiles(x86)%\reg organizer\license-russian.txt
from %ProgramFiles(x86)%\reg organizer\documentation\english\is-ev362.tmp to %ProgramFiles(x86)%\reg organizer\documentation\english\documentation.chm
from %ProgramFiles(x86)%\reg organizer\is-c2nke.tmp to %ProgramFiles(x86)%\reg organizer\whatsnew.txt
from %ProgramFiles(x86)%\reg organizer\is-rb7so.tmp to %ProgramFiles(x86)%\reg organizer\readme.txt
from %ProgramFiles(x86)%\reg organizer\is-ag0es.tmp to %ProgramFiles(x86)%\reg organizer\license.txt
from %ProgramFiles(x86)%\reg organizer\is-9rjhu.tmp to %ProgramFiles(x86)%\reg organizer\updaterdll.dll
from %ProgramFiles(x86)%\reg organizer\languages\is-0mpoc.tmp to %ProgramFiles(x86)%\reg organizer\languages\russian.sib
from %ProgramFiles(x86)%\reg organizer\is-t32rd.tmp to %ProgramFiles(x86)%\reg organizer\updater.exe
from %ProgramFiles(x86)%\reg organizer\is-sp21u.tmp to %ProgramFiles(x86)%\reg organizer\reg64call.exe
from %ProgramFiles(x86)%\reg organizer\is-bs335.tmp to %ProgramFiles(x86)%\reg organizer\optimizationanimation.avi
from %ProgramFiles(x86)%\reg organizer\is-hcs6l.tmp to %ProgramFiles(x86)%\reg organizer\installertracingagent.dll
from %ProgramFiles(x86)%\reg organizer\is-53l80.tmp to %ProgramFiles(x86)%\reg organizer\ignore_dc.first
from %ProgramFiles(x86)%\reg organizer\is-i85jt.tmp to %ProgramFiles(x86)%\reg organizer\ignore_arc.first
from %ProgramFiles(x86)%\reg organizer\is-6vigu.tmp to %ProgramFiles(x86)%\reg organizer\filemasks.first
from %ProgramFiles(x86)%\reg organizer\is-4o8kd.tmp to %ProgramFiles(x86)%\reg organizer\closeapplication.dll
from %ProgramFiles(x86)%\reg organizer\is-tgj6h.tmp to %ProgramFiles(x86)%\reg organizer\cleanfolders.first
from %ProgramFiles(x86)%\reg organizer\is-ostt1.tmp to %ProgramFiles(x86)%\reg organizer\links.xml
from %ProgramFiles(x86)%\reg organizer\is-0mjd5.tmp to %ProgramFiles(x86)%\reg organizer\regorganizeragent.exe
from %ProgramFiles(x86)%\reg organizer\is-te4qa.tmp to %ProgramFiles(x86)%\reg organizer\turbosearch.exe

Network activity

Connects to

'ma####elminobhei.ml':80

TCP

HTTP POST requests

http://ma####elminobhei.ml/new/net_api

UDP

DNS ASK ma####elminobhei.ml

Miscellaneous

Searches for the following windows

ClassName: '{a81cf263c85da620493ab14731a57dak}' WindowName: ''

Creates and executes the following

'%TEMP%\is-rpfv5.tmp\<File name>.tmp' /SL5="$11022C,5135659,50688,<Full path to file>"
'%ProgramFiles(x86)%\reg organizer\regorganizeragent.exe'
'%ProgramFiles(x86)%\reg organizer\regorganizeragent.exe' 5f77ae3831e23195f385700baf9b3d48

Executes the following