Trojan.DownLoader32.60705

Technical Information

Modifies file system

Creates the following files

%TEMP%\is-qtt7d.tmp\<File name>.tmp
%ProgramFiles(x86)%\complex\jetbee\plugins\is-6skdj.tmp
%ProgramFiles(x86)%\complex\jetbee\plugins\is-nrfss.tmp
%ProgramFiles(x86)%\complex\jetbee\plugins\is-u2rf6.tmp
%ProgramFiles(x86)%\complex\jetbee\plugins\is-0rult.tmp
%ProgramFiles(x86)%\complex\jetbee\plugins\is-49jl9.tmp
%ProgramFiles(x86)%\complex\jetbee\plugins\is-pr4i7.tmp
%ProgramFiles(x86)%\complex\jetbee\images\is-g5o82.tmp
%ProgramFiles(x86)%\complex\jetbee\images\is-no6ps.tmp
%ProgramFiles(x86)%\complex\jetbee\images\is-er7ls.tmp
%ProgramFiles(x86)%\complex\jetbee\language\is-g09m4.tmp
%ProgramFiles(x86)%\complex\jetbee\is-42bde.tmp
%ProgramFiles(x86)%\complex\jetbee\is-e5i3i.tmp
%ProgramFiles(x86)%\complex\jetbee\is-cgo7k.tmp
%ProgramFiles(x86)%\complex\jetbee\is-0q5js.tmp
%ProgramFiles(x86)%\complex\jetbee\is-5cr1j.tmp
%ProgramFiles(x86)%\complex\jetbee\is-mtd06.tmp
%ProgramFiles(x86)%\complex\jetbee\is-0r66o.tmp
%ProgramFiles(x86)%\complex\jetbee\is-kttan.tmp
%ProgramFiles(x86)%\complex\jetbee\is-u6jao.tmp
%TEMP%\is-ohbh0.tmp\_isetup\_shfoldr.dll
%TEMP%\is-ohbh0.tmp\_isetup\_setup64.tmp
%PROGRAMDATA%\microsoft\windows\start menu\programs\complex\jetbee.exe.lnk
%ProgramFiles(x86)%\complex\jetbee\unins000.dat

Moves the following files

from %ProgramFiles(x86)%\complex\jetbee\is-u6jao.tmp to %ProgramFiles(x86)%\complex\jetbee\unins000.exe
from %ProgramFiles(x86)%\complex\jetbee\plugins\is-u2rf6.tmp to %ProgramFiles(x86)%\complex\jetbee\plugins\bass_mpc.dll
from %ProgramFiles(x86)%\complex\jetbee\plugins\is-0rult.tmp to %ProgramFiles(x86)%\complex\jetbee\plugins\bass_flac.dll
from %ProgramFiles(x86)%\complex\jetbee\plugins\is-49jl9.tmp to %ProgramFiles(x86)%\complex\jetbee\plugins\bass_ape.dll
from %ProgramFiles(x86)%\complex\jetbee\plugins\is-pr4i7.tmp to %ProgramFiles(x86)%\complex\jetbee\plugins\bass.dll
from %ProgramFiles(x86)%\complex\jetbee\images\is-g5o82.tmp to %ProgramFiles(x86)%\complex\jetbee\images\erase.png
from %ProgramFiles(x86)%\complex\jetbee\images\is-no6ps.tmp to %ProgramFiles(x86)%\complex\jetbee\images\burn.png
from %ProgramFiles(x86)%\complex\jetbee\images\is-er7ls.tmp to %ProgramFiles(x86)%\complex\jetbee\images\add.png
from %ProgramFiles(x86)%\complex\jetbee\plugins\is-nrfss.tmp to %ProgramFiles(x86)%\complex\jetbee\plugins\bass_wma.dll
from %ProgramFiles(x86)%\complex\jetbee\language\is-g09m4.tmp to %ProgramFiles(x86)%\complex\jetbee\language\english.lng
from %ProgramFiles(x86)%\complex\jetbee\is-e5i3i.tmp to %ProgramFiles(x86)%\complex\jetbee\vorbis.dll
from %ProgramFiles(x86)%\complex\jetbee\is-cgo7k.tmp to %ProgramFiles(x86)%\complex\jetbee\vorbisfile.dll
from %ProgramFiles(x86)%\complex\jetbee\is-0q5js.tmp to %ProgramFiles(x86)%\complex\jetbee\complex.dll
from %ProgramFiles(x86)%\complex\jetbee\is-5cr1j.tmp to %ProgramFiles(x86)%\complex\jetbee\discography.d
from %ProgramFiles(x86)%\complex\jetbee\is-mtd06.tmp to %ProgramFiles(x86)%\complex\jetbee\history.txt
from %ProgramFiles(x86)%\complex\jetbee\is-0r66o.tmp to %ProgramFiles(x86)%\complex\jetbee\jetbee.chm
from %ProgramFiles(x86)%\complex\jetbee\is-kttan.tmp to %ProgramFiles(x86)%\complex\jetbee\jetbee.exe
from %ProgramFiles(x86)%\complex\jetbee\is-42bde.tmp to %ProgramFiles(x86)%\complex\jetbee\ogg.dll
from %ProgramFiles(x86)%\complex\jetbee\plugins\is-6skdj.tmp to %ProgramFiles(x86)%\complex\jetbee\plugins\bass_wv.dll

Network activity

Connects to

'gi####undation.life':80

TCP

HTTP POST requests

http://gi####undation.life/v2/events

UDP

DNS ASK gi####undation.life

Miscellaneous

Creates and executes the following

'%TEMP%\is-qtt7d.tmp\<File name>.tmp' /SL5="$6023E,6125431,121344,<Full path to file>"
'%ProgramFiles(x86)%\complex\jetbee\jetbee.exe' 58766fbdaa7917488d79b6638e8a6850