Trojan.DownLoader38.3535

Technical Information

Modifies file system

Creates the following files

%TEMP%\is-751b4.tmp\<File name>.tmp
%ProgramFiles(x86)%\vero\sed\is-0b181.tmp
%ProgramFiles(x86)%\vero\qui\is-17es9.tmp
%ProgramFiles(x86)%\vero\qui\is-d198p.tmp
%ProgramFiles(x86)%\vero\qui\is-od4sa.tmp
%ProgramFiles(x86)%\vero\qui\is-e8m7f.tmp
%ProgramFiles(x86)%\vero\qui\is-ig24o.tmp
%ProgramFiles(x86)%\vero\omnis\is-u2u72.tmp
%ProgramFiles(x86)%\vero\omnis\is-7ap9c.tmp
%ProgramFiles(x86)%\vero\omnis\is-563um.tmp
%ProgramFiles(x86)%\vero\non\is-pfal6.tmp
%ProgramFiles(x86)%\vero\non\is-ubo3o.tmp
%ProgramFiles(x86)%\vero\non\is-0mhcg.tmp
%ProgramFiles(x86)%\vero\asperiores\is-rrf3t.tmp
%ProgramFiles(x86)%\vero\asperiores\is-fhqur.tmp
%ProgramFiles(x86)%\vero\asperiores\is-jivf3.tmp
%ProgramFiles(x86)%\vero\asperiores\is-7cd8v.tmp
%ProgramFiles(x86)%\vero\asperiores\is-5dshd.tmp
%ProgramFiles(x86)%\vero\asperiores\is-alv6u.tmp
%ProgramFiles(x86)%\vero\is-dp1ta.tmp
%ProgramFiles(x86)%\vero\is-a67m1.tmp
%ProgramFiles(x86)%\vero\is-pe35d.tmp
%ProgramFiles(x86)%\vero\is-g576o.tmp
%TEMP%\is-nck6l.tmp\_isetup\_iscrypt.dll
%TEMP%\is-nck6l.tmp\_isetup\_shfoldr.dll
%TEMP%\is-nck6l.tmp\_isetup\_setup64.tmp
%ProgramFiles(x86)%\vero\sed\is-36km3.tmp
%ProgramFiles(x86)%\vero\unins000.dat

Moves the following files

from %ProgramFiles(x86)%\vero\is-g576o.tmp to %ProgramFiles(x86)%\vero\unins000.exe
from %ProgramFiles(x86)%\vero\qui\is-17es9.tmp to %ProgramFiles(x86)%\vero\qui\sit.pif
from %ProgramFiles(x86)%\vero\qui\is-d198p.tmp to %ProgramFiles(x86)%\vero\qui\non.wps
from %ProgramFiles(x86)%\vero\qui\is-od4sa.tmp to %ProgramFiles(x86)%\vero\qui\facere.sdf
from %ProgramFiles(x86)%\vero\qui\is-e8m7f.tmp to %ProgramFiles(x86)%\vero\qui\explicabo.mp3
from %ProgramFiles(x86)%\vero\qui\is-ig24o.tmp to %ProgramFiles(x86)%\vero\qui\a.asf
from %ProgramFiles(x86)%\vero\omnis\is-u2u72.tmp to %ProgramFiles(x86)%\vero\omnis\molestias.png
from %ProgramFiles(x86)%\vero\omnis\is-7ap9c.tmp to %ProgramFiles(x86)%\vero\omnis\est.pps
from %ProgramFiles(x86)%\vero\omnis\is-563um.tmp to %ProgramFiles(x86)%\vero\omnis\consequatur.txt
from %ProgramFiles(x86)%\vero\non\is-pfal6.tmp to %ProgramFiles(x86)%\vero\non\quaerat.mp4
from %ProgramFiles(x86)%\vero\sed\is-0b181.tmp to %ProgramFiles(x86)%\vero\sed\fugiat.png
from %ProgramFiles(x86)%\vero\non\is-ubo3o.tmp to %ProgramFiles(x86)%\vero\non\est.avi
from %ProgramFiles(x86)%\vero\asperiores\is-rrf3t.tmp to %ProgramFiles(x86)%\vero\asperiores\sqlite3.dll
from %ProgramFiles(x86)%\vero\asperiores\is-fhqur.tmp to %ProgramFiles(x86)%\vero\asperiores\ut.mp4
from %ProgramFiles(x86)%\vero\asperiores\is-jivf3.tmp to %ProgramFiles(x86)%\vero\asperiores\qui.ha
from %ProgramFiles(x86)%\vero\asperiores\is-7cd8v.tmp to %ProgramFiles(x86)%\vero\asperiores\labore.hta
from %ProgramFiles(x86)%\vero\asperiores\is-5dshd.tmp to %ProgramFiles(x86)%\vero\asperiores\deleniti.exe
from %ProgramFiles(x86)%\vero\asperiores\is-alv6u.tmp to %ProgramFiles(x86)%\vero\asperiores\amet.pps
from %ProgramFiles(x86)%\vero\is-dp1ta.tmp to %ProgramFiles(x86)%\vero\totam.wav
from %ProgramFiles(x86)%\vero\is-a67m1.tmp to %ProgramFiles(x86)%\vero\sapiente.wav
from %ProgramFiles(x86)%\vero\is-pe35d.tmp to %ProgramFiles(x86)%\vero\dolor.msi
from %ProgramFiles(x86)%\vero\non\is-0mhcg.tmp to %ProgramFiles(x86)%\vero\non\ducimus.bin
from %ProgramFiles(x86)%\vero\sed\is-36km3.tmp to %ProgramFiles(x86)%\vero\sed\minus.htm

Network activity

TCP

HTTP POST requests

http://cl###etapi.com/v2/events

UDP

DNS ASK cl###etapi.com

Miscellaneous

Searches for the following windows

ClassName: '962F28A8-6AB7-401B-BF07-5A0013DD3E49' WindowName: ''

Creates and executes the following

'%TEMP%\is-751b4.tmp\<File name>.tmp' /SL5="$12022E,3400323,114176,<Full path to file>"
'%ProgramFiles(x86)%\vero\asperiores\deleniti.exe' 1b6d2d5c30bd9b355ad424fa58847da9