Trojan.DownLoader33.55890

Technical Information

Modifies file system

Creates the following files

%TEMP%\0011eee1.log
%TEMP%\inh117~1\images\quick_specs.png
%TEMP%\inh117~1\images\quick_specs_m.png
%TEMP%\inh117~1\images\quick_specs_s.png
%TEMP%\inh117~1\images\resume_button.png
%TEMP%\inh117~1\images\sponsored.png
%TEMP%\inh117~1\locale\en.locale
%TEMP%\inh117~1\locale\es.locale
%TEMP%\inh117~1\locale\pt.locale
%TEMP%\0011f886.log
%TEMP%\0011f896.log
%TEMP%\inh117526547448\bootstrap_8916.html
%TEMP%\in0aff~1\14c7e5~1.tmp
%TEMP%\in0aff~1\2320e2~1.par
%TEMP%\in0aff~1\2320e2~1.tmp
%TEMP%\in0aff~1\270f9f~1.par
%TEMP%\in0aff~1\270f9f~1.tmp
%TEMP%\in0aff~1\14c7e5~1.par
%TEMP%\in0aff35b9\270f9fd9_stp\osutils.vbs
%TEMP%\in0aff35b9\270f9fd9_stp\run.vbs
%TEMP%\in0aff35b9\2320e25d_stp\we23.html
%TEMP%\in0aff35b9\2320e25d_stp\wp24.html
%TEMP%\inh117~1\images\progressbar.png
%TEMP%\00124eb4.log
%TEMP%\inh117~1\images\progress.png
%TEMP%\inh117~1\images\loader.gif
%TEMP%\inh117~1\css\ie6_main.css
%TEMP%\inh117~1\css\main.css
%TEMP%\inh117~1\css\sdk-ui\browse.css
%TEMP%\inh117~1\css\sdk-ui\button.css
%TEMP%\inh117~1\css\sdk-ui\checkbox.css
%TEMP%\inh117~1\css\sdk-ui\images\button-bg.png
%TEMP%\inh117~1\css\sdk-ui\images\progress-bg-corner.png
%TEMP%\inh117~1\css\sdk-ui\images\progress-bg.png
%TEMP%\inh117~1\css\sdk-ui\images\progress-bg2.png
%TEMP%\inh117~1\css\sdk-ui\progress-bar.css
%TEMP%\inh117~1\csshover3.htc
%TEMP%\inh117~1\images\bg1.png
%TEMP%\inh117~1\images\bg2.png
%TEMP%\inh117~1\images\bg_m.png
%TEMP%\inh117~1\images\close.png
%TEMP%\inh117~1\images\close_hover.png
%TEMP%\inh117~1\images\color_button.png
%TEMP%\inh117~1\images\color_button_hover.png
%TEMP%\inh117~1\images\grey_button.png
%TEMP%\inh117~1\images\grey_button_hover.png
%TEMP%\inh117~1\images\icon_generic.png
%TEMP%\inh117~1\images\pause_button.png
%TEMP%\in0aff35b9\14c7e596_stp\icut.dat

Deletes the following files

%TEMP%\0011eee1.log
%TEMP%\0011f886.log
%TEMP%\0011f896.log
%TEMP%\inh117526547448\bootstrap_8916.html
%TEMP%\00124eb4.log

Moves the following files

from %TEMP%\in0aff35b9\2320e25d_stp\we23.html to %TEMP%\bf_yl\we23.html
from %TEMP%\in0aff35b9\2320e25d_stp\wp24.html to %TEMP%\bf_yl\wp24.html

Network activity

TCP

HTTP GET requests

http://co##rom.com/screenshots_small/psx/FIFA%20Soccer%202005.jpg
http://cd###.#omococolor.com/img/Fonawemi/logoNewText39.png
http://cd###.#omococolor.com/img/Fonawemi/logoNew39.png
http://im#.##mococolor.com/img/FF_logo_new.png
http://im#.##mococolor.com/img/IE_logo_new.png
http://cd###.#omococolor.com/ofr/Solululadul/icut_v2_2
http://cd###.#omococolor.com/ofr/Solululadul/osutils
http://cd###.#omococolor.com/ofr/Niniwic/YL/Niniwic_Tefenece_12Apr16
http://cd###.#omococolor.com/img/Fonawemi/logoNewTextWhite39.png
http://cd###.#omococolor.com/img/Tavasat/15Feb17/v2/EN.png
http://cd###.#omococolor.com/img/Jimomoromoj/Jimomoromoj_logo_080320.png
http://cd###.#omococolor.com/img/Sibarasawi/bg_comp.png
http://cd###.#omococolor.com/img/Sibarasawi/logo_comp.png
http://cd###.#omococolor.com/img/Vavavag/V2/NL.png
http://cd###.#omococolor.com/img/Tefenece/Tefenece_logo_black.png
http://oc##.thawte.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQwF4prw9S7mCbCEHD%2Fyl6nWPkczAQUe1tFz6%2FOy3r9MZIaarbzRutXSFACEEeXTXhzpbyrDS%2BzcBkvzl4%3D