Trojan.DownLoader45.25400

Technical Information

Modifies file system

Creates the following files

%TEMP%\is-ptuoa.tmp\is-5cd3f.tmp
%ProgramFiles(x86)%\fmo drive recovery\unins000.dat
%ProgramFiles(x86)%\fmo drive recovery\is-f8p3j.tmp
%ProgramFiles(x86)%\fmo drive recovery\is-nk5uc.tmp
%ProgramFiles(x86)%\fmo drive recovery\is-n7k3c.tmp
%ProgramFiles(x86)%\fmo drive recovery\is-inrfr.tmp
%ProgramFiles(x86)%\fmo drive recovery\is-vr03v.tmp
%ProgramFiles(x86)%\fmo drive recovery\is-qfaa8.tmp
%ProgramFiles(x86)%\fmo drive recovery\is-a68oo.tmp
%ProgramFiles(x86)%\fmo drive recovery\is-30vnt.tmp
%ProgramFiles(x86)%\fmo drive recovery\is-raitd.tmp
%ProgramFiles(x86)%\fmo drive recovery\is-2oiub.tmp
%ProgramFiles(x86)%\fmo drive recovery\is-3hmvp.tmp
%ProgramFiles(x86)%\fmo drive recovery\is-fln0a.tmp
%ProgramFiles(x86)%\fmo drive recovery\is-7bnq2.tmp
%ProgramFiles(x86)%\fmo drive recovery\frecover.exe
%ProgramFiles(x86)%\fmo drive recovery\is-fqvfs.tmp
%ProgramFiles(x86)%\fmo drive recovery\is-m4rga.tmp
%ProgramFiles(x86)%\fmo drive recovery\is-2sv89.tmp
%ProgramFiles(x86)%\fmo drive recovery\is-9cb84.tmp
%ProgramFiles(x86)%\fmo drive recovery\is-qfbno.tmp
%ProgramFiles(x86)%\fmo drive recovery\is-suk34.tmp
%ProgramFiles(x86)%\fmo drive recovery\is-l2lq8.tmp
%ProgramFiles(x86)%\fmo drive recovery\is-pvn4a.tmp
%ProgramFiles(x86)%\fmo drive recovery\is-uf7t6.tmp
%ProgramFiles(x86)%\fmo drive recovery\is-n3e80.tmp
%ProgramFiles(x86)%\fmo drive recovery\is-n3m67.tmp
%TEMP%\is-f4jln.tmp\_isetup\_iscrypt.dll
%TEMP%\is-f4jln.tmp\_isetup\_shfoldr.dll
%TEMP%\is-f4jln.tmp\_isetup\_setup64.tmp
%TEMP%\is-f4jln.tmp\_isetup\_regdll.tmp
%ProgramFiles(x86)%\fmo drive recovery\is-c39sm.tmp
%TEMP%\iobit.cab

Moves the following files

from %ProgramFiles(x86)%\fmo drive recovery\is-n3m67.tmp to %ProgramFiles(x86)%\fmo drive recovery\unins000.exe
from %ProgramFiles(x86)%\fmo drive recovery\is-n7k3c.tmp to %ProgramFiles(x86)%\fmo drive recovery\pt.lan
from %ProgramFiles(x86)%\fmo drive recovery\is-inrfr.tmp to %ProgramFiles(x86)%\fmo drive recovery\ar.lan
from %ProgramFiles(x86)%\fmo drive recovery\is-vr03v.tmp to %ProgramFiles(x86)%\fmo drive recovery\sk.lan
from %ProgramFiles(x86)%\fmo drive recovery\is-qfaa8.tmp to %ProgramFiles(x86)%\fmo drive recovery\pl.lan
from %ProgramFiles(x86)%\fmo drive recovery\is-a68oo.tmp to %ProgramFiles(x86)%\fmo drive recovery\fa.lan
from %ProgramFiles(x86)%\fmo drive recovery\is-30vnt.tmp to %ProgramFiles(x86)%\fmo drive recovery\cnt.lan
from %ProgramFiles(x86)%\fmo drive recovery\is-raitd.tmp to %ProgramFiles(x86)%\fmo drive recovery\cn.lan
from %ProgramFiles(x86)%\fmo drive recovery\is-2oiub.tmp to %ProgramFiles(x86)%\fmo drive recovery\it.lan
from %ProgramFiles(x86)%\fmo drive recovery\is-3hmvp.tmp to %ProgramFiles(x86)%\fmo drive recovery\fin.lan
from %ProgramFiles(x86)%\fmo drive recovery\is-fln0a.tmp to %ProgramFiles(x86)%\fmo drive recovery\bg.lan
from %ProgramFiles(x86)%\fmo drive recovery\is-nk5uc.tmp to %ProgramFiles(x86)%\fmo drive recovery\turbosearch.exe
from %ProgramFiles(x86)%\fmo drive recovery\is-7bnq2.tmp to %ProgramFiles(x86)%\fmo drive recovery\tr.lan
from %ProgramFiles(x86)%\fmo drive recovery\is-c39sm.tmp to %ProgramFiles(x86)%\fmo drive recovery\es.lan
from %ProgramFiles(x86)%\fmo drive recovery\is-m4rga.tmp to %ProgramFiles(x86)%\fmo drive recovery\ro.lan
from %ProgramFiles(x86)%\fmo drive recovery\is-2sv89.tmp to %ProgramFiles(x86)%\fmo drive recovery\hu.lan
from %ProgramFiles(x86)%\fmo drive recovery\is-9cb84.tmp to %ProgramFiles(x86)%\fmo drive recovery\ru.lan
from %ProgramFiles(x86)%\fmo drive recovery\is-qfbno.tmp to %ProgramFiles(x86)%\fmo drive recovery\de.lan
from %ProgramFiles(x86)%\fmo drive recovery\is-suk34.tmp to %ProgramFiles(x86)%\fmo drive recovery\fr.lan
from %ProgramFiles(x86)%\fmo drive recovery\is-l2lq8.tmp to %ProgramFiles(x86)%\fmo drive recovery\en.lan
from %ProgramFiles(x86)%\fmo drive recovery\is-pvn4a.tmp to %ProgramFiles(x86)%\fmo drive recovery\frecover.exe.manifest
from %ProgramFiles(x86)%\fmo drive recovery\is-uf7t6.tmp to %ProgramFiles(x86)%\fmo drive recovery\license.txt
from %ProgramFiles(x86)%\fmo drive recovery\is-n3e80.tmp to %ProgramFiles(x86)%\fmo drive recovery\readme.txt
from %ProgramFiles(x86)%\fmo drive recovery\is-fqvfs.tmp to %ProgramFiles(x86)%\fmo drive recovery\du.lan
from %ProgramFiles(x86)%\fmo drive recovery\is-f8p3j.tmp to %ProgramFiles(x86)%\fmo drive recovery\frecover.exe

Network activity

Connects to

'tu####lotneli.cf':80

TCP

HTTP GET requests

http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?56#######

HTTP POST requests

http://tu####lotneli.cf/new/net_api

UDP

DNS ASK tu####lotneli.cf

Miscellaneous

Searches for the following windows

ClassName: '' WindowName: 'FmobitsWindowClassFmo18'

Creates and executes the following

'%TEMP%\is-ptuoa.tmp\is-5cd3f.tmp' /SL4 $A0218 "<Full path to file>" 5114019 50176
'%ProgramFiles(x86)%\fmo drive recovery\frecover.exe'
'%ProgramFiles(x86)%\fmo drive recovery\frecover.exe' aba722aba7c6e030bccf436dd654b184

Executes the following