Trojan.DownLoader43.40706

Technical Information

Modifies file system

Creates the following files

%TEMP%\is-oqd24.tmp\<File name>.tmp
%ProgramFiles%\dignissimos\nihil\is-9ob0h.tmp
%ProgramFiles%\dignissimos\nihil\is-sfol5.tmp
%ProgramFiles%\dignissimos\nihil\is-og2ho.tmp
%ProgramFiles%\dignissimos\nihil\is-srh5a.tmp
%ProgramFiles%\dignissimos\nihil\is-tjejm.tmp
%ProgramFiles%\dignissimos\nihil\is-nts1j.tmp
%ProgramFiles%\dignissimos\nihil\is-23cn7.tmp
%ProgramFiles%\dignissimos\nihil\is-000jq.tmp
%ProgramFiles%\dignissimos\nihil\is-ncghi.tmp
%ProgramFiles%\dignissimos\nihil\is-rafcv.tmp
%ProgramFiles%\dignissimos\nihil\is-ba163.tmp
%ProgramFiles%\dignissimos\nihil\is-lur7c.tmp
%ProgramFiles%\dignissimos\is-2vb0g.tmp
%ProgramFiles%\dignissimos\is-fisoi.tmp
%ProgramFiles%\dignissimos\is-31puk.tmp
%ProgramFiles%\dignissimos\is-vi4j9.tmp
%ProgramFiles%\dignissimos\is-0dgal.tmp
%ProgramFiles%\dignissimos\is-jnvpj.tmp
%ProgramFiles%\dignissimos\is-98e51.tmp
%ProgramFiles%\dignissimos\is-p9iup.tmp
%ProgramFiles%\dignissimos\is-v8suc.tmp
%TEMP%\is-jjfpb.tmp\_isetup\_iscrypt.dll
%TEMP%\is-jjfpb.tmp\_isetup\_shfoldr.dll
%ProgramFiles%\dignissimos\nihil\is-co1sl.tmp
%ProgramFiles%\dignissimos\unins000.dat

Moves the following files

from %ProgramFiles%\dignissimos\is-v8suc.tmp to %ProgramFiles%\dignissimos\unins000.exe
from %ProgramFiles%\dignissimos\nihil\is-sfol5.tmp to %ProgramFiles%\dignissimos\nihil\rem.txt
from %ProgramFiles%\dignissimos\nihil\is-og2ho.tmp to %ProgramFiles%\dignissimos\nihil\reiciendis.txt
from %ProgramFiles%\dignissimos\nihil\is-srh5a.tmp to %ProgramFiles%\dignissimos\nihil\quibusdam.txt
from %ProgramFiles%\dignissimos\nihil\is-tjejm.tmp to %ProgramFiles%\dignissimos\nihil\officia.txt
from %ProgramFiles%\dignissimos\nihil\is-nts1j.tmp to %ProgramFiles%\dignissimos\nihil\nam.txt
from %ProgramFiles%\dignissimos\nihil\is-23cn7.tmp to %ProgramFiles%\dignissimos\nihil\modi.txt
from %ProgramFiles%\dignissimos\nihil\is-000jq.tmp to %ProgramFiles%\dignissimos\nihil\in.txt
from %ProgramFiles%\dignissimos\nihil\is-ncghi.tmp to %ProgramFiles%\dignissimos\nihil\excepturi.txt
from %ProgramFiles%\dignissimos\nihil\is-rafcv.tmp to %ProgramFiles%\dignissimos\nihil\eos.txt
from %ProgramFiles%\dignissimos\nihil\is-ba163.tmp to %ProgramFiles%\dignissimos\nihil\dolorem.txt
from %ProgramFiles%\dignissimos\nihil\is-lur7c.tmp to %ProgramFiles%\dignissimos\nihil\consequatur.txt
from %ProgramFiles%\dignissimos\is-2vb0g.tmp to %ProgramFiles%\dignissimos\sint.txt
from %ProgramFiles%\dignissimos\is-fisoi.tmp to %ProgramFiles%\dignissimos\repellendus.txt
from %ProgramFiles%\dignissimos\is-31puk.tmp to %ProgramFiles%\dignissimos\quo.exe
from %ProgramFiles%\dignissimos\is-vi4j9.tmp to %ProgramFiles%\dignissimos\porro.txt
from %ProgramFiles%\dignissimos\is-0dgal.tmp to %ProgramFiles%\dignissimos\odio.txt
from %ProgramFiles%\dignissimos\is-jnvpj.tmp to %ProgramFiles%\dignissimos\iure.txt
from %ProgramFiles%\dignissimos\is-98e51.tmp to %ProgramFiles%\dignissimos\et.txt
from %ProgramFiles%\dignissimos\is-p9iup.tmp to %ProgramFiles%\dignissimos\consectetur.txt
from %ProgramFiles%\dignissimos\nihil\is-9ob0h.tmp to %ProgramFiles%\dignissimos\nihil\rerum.txt
from %ProgramFiles%\dignissimos\nihil\is-co1sl.tmp to %ProgramFiles%\dignissimos\nihil\ut.txt

Network activity

Connects to

'jo###fornk.live':80

TCP

HTTP POST requests

http://jo###fornk.live/v3/api

UDP

DNS ASK jo###fornk.live

Miscellaneous

Searches for the following windows

ClassName: '02D1EA77-DE48-4520-84B0-313872C78A57' WindowName: ''

Creates and executes the following

'%TEMP%\is-oqd24.tmp\<File name>.tmp' /SL5="$110206,3763224,140800,<Full path to file>"
'%ProgramFiles%\dignissimos\quo.exe' 0051896dfa203c280ff309c202ad1d99