Trojan.DownLoader32.60747

Technical Information

Modifies file system

Creates the following files

%TEMP%\is-ngjns.tmp\<File name>.tmp
%ProgramFiles(x86)%\complex\jetbee\plugins\is-0etc7.tmp
%ProgramFiles(x86)%\complex\jetbee\plugins\is-ekogn.tmp
%ProgramFiles(x86)%\complex\jetbee\plugins\is-3sei2.tmp
%ProgramFiles(x86)%\complex\jetbee\plugins\is-ovn86.tmp
%ProgramFiles(x86)%\complex\jetbee\plugins\is-p9gi8.tmp
%ProgramFiles(x86)%\complex\jetbee\plugins\is-hpq0t.tmp
%ProgramFiles(x86)%\complex\jetbee\images\is-hrgum.tmp
%ProgramFiles(x86)%\complex\jetbee\images\is-fguhm.tmp
%ProgramFiles(x86)%\complex\jetbee\images\is-44kli.tmp
%ProgramFiles(x86)%\complex\jetbee\language\is-0nc0i.tmp
%ProgramFiles(x86)%\complex\jetbee\is-ho7b7.tmp
%ProgramFiles(x86)%\complex\jetbee\is-vdm4q.tmp
%ProgramFiles(x86)%\complex\jetbee\is-rkf4c.tmp
%ProgramFiles(x86)%\complex\jetbee\is-uqqou.tmp
%ProgramFiles(x86)%\complex\jetbee\is-puovt.tmp
%ProgramFiles(x86)%\complex\jetbee\is-tatso.tmp
%ProgramFiles(x86)%\complex\jetbee\is-lhhgv.tmp
%ProgramFiles(x86)%\complex\jetbee\is-vr878.tmp
%ProgramFiles(x86)%\complex\jetbee\is-j2u8v.tmp
%TEMP%\is-vec8o.tmp\_isetup\_shfoldr.dll
%TEMP%\is-vec8o.tmp\_isetup\_setup64.tmp
%PROGRAMDATA%\microsoft\windows\start menu\programs\complex\jetbee.exe.lnk
%ProgramFiles(x86)%\complex\jetbee\unins000.dat

Moves the following files

from %ProgramFiles(x86)%\complex\jetbee\is-j2u8v.tmp to %ProgramFiles(x86)%\complex\jetbee\unins000.exe
from %ProgramFiles(x86)%\complex\jetbee\plugins\is-3sei2.tmp to %ProgramFiles(x86)%\complex\jetbee\plugins\bass_mpc.dll
from %ProgramFiles(x86)%\complex\jetbee\plugins\is-ovn86.tmp to %ProgramFiles(x86)%\complex\jetbee\plugins\bass_flac.dll
from %ProgramFiles(x86)%\complex\jetbee\plugins\is-p9gi8.tmp to %ProgramFiles(x86)%\complex\jetbee\plugins\bass_ape.dll
from %ProgramFiles(x86)%\complex\jetbee\plugins\is-hpq0t.tmp to %ProgramFiles(x86)%\complex\jetbee\plugins\bass.dll
from %ProgramFiles(x86)%\complex\jetbee\images\is-hrgum.tmp to %ProgramFiles(x86)%\complex\jetbee\images\erase.png
from %ProgramFiles(x86)%\complex\jetbee\images\is-fguhm.tmp to %ProgramFiles(x86)%\complex\jetbee\images\burn.png
from %ProgramFiles(x86)%\complex\jetbee\images\is-44kli.tmp to %ProgramFiles(x86)%\complex\jetbee\images\add.png
from %ProgramFiles(x86)%\complex\jetbee\plugins\is-ekogn.tmp to %ProgramFiles(x86)%\complex\jetbee\plugins\bass_wma.dll
from %ProgramFiles(x86)%\complex\jetbee\language\is-0nc0i.tmp to %ProgramFiles(x86)%\complex\jetbee\language\english.lng
from %ProgramFiles(x86)%\complex\jetbee\is-vdm4q.tmp to %ProgramFiles(x86)%\complex\jetbee\vorbis.dll
from %ProgramFiles(x86)%\complex\jetbee\is-rkf4c.tmp to %ProgramFiles(x86)%\complex\jetbee\vorbisfile.dll
from %ProgramFiles(x86)%\complex\jetbee\is-uqqou.tmp to %ProgramFiles(x86)%\complex\jetbee\complex.dll
from %ProgramFiles(x86)%\complex\jetbee\is-puovt.tmp to %ProgramFiles(x86)%\complex\jetbee\discography.d
from %ProgramFiles(x86)%\complex\jetbee\is-tatso.tmp to %ProgramFiles(x86)%\complex\jetbee\history.txt
from %ProgramFiles(x86)%\complex\jetbee\is-lhhgv.tmp to %ProgramFiles(x86)%\complex\jetbee\jetbee.chm
from %ProgramFiles(x86)%\complex\jetbee\is-vr878.tmp to %ProgramFiles(x86)%\complex\jetbee\jetbee.exe
from %ProgramFiles(x86)%\complex\jetbee\is-ho7b7.tmp to %ProgramFiles(x86)%\complex\jetbee\ogg.dll
from %ProgramFiles(x86)%\complex\jetbee\plugins\is-0etc7.tmp to %ProgramFiles(x86)%\complex\jetbee\plugins\bass_wv.dll

Network activity

Connects to

'gi####undation.life':80

TCP

HTTP POST requests

http://gi####undation.life/v2/events

Miscellaneous

Creates and executes the following

'%TEMP%\is-ngjns.tmp\<File name>.tmp' /SL5="$110278,6089352,121344,<Full path to file>"
'%ProgramFiles(x86)%\complex\jetbee\jetbee.exe' bab8ce8a594fe0f248b2bb1447121ed7