Trojan.DownLoader45.38400

Technical Information

Modifies file system

Creates the following files

%TEMP%\is-06jc5.tmp\<File name>.tmp
%ProgramFiles(x86)%\reg organizer\is-s2imq.tmp
%ProgramFiles(x86)%\reg organizer\languages\is-m3vf2.tmp
%ProgramFiles(x86)%\reg organizer\documentation\russian\is-91inc.tmp
%ProgramFiles(x86)%\reg organizer\is-dt193.tmp
%ProgramFiles(x86)%\reg organizer\is-k6cd9.tmp
%ProgramFiles(x86)%\reg organizer\is-ba705.tmp
%ProgramFiles(x86)%\reg organizer\documentation\english\is-7sohp.tmp
%ProgramFiles(x86)%\reg organizer\is-nd4iv.tmp
%ProgramFiles(x86)%\reg organizer\is-5f4hf.tmp
%ProgramFiles(x86)%\reg organizer\is-09tad.tmp
%ProgramFiles(x86)%\reg organizer\is-m2ie1.tmp
%ProgramFiles(x86)%\reg organizer\is-r7gjk.tmp
%ProgramFiles(x86)%\reg organizer\is-dcrgj.tmp
%ProgramFiles(x86)%\reg organizer\is-ji7a1.tmp
%ProgramFiles(x86)%\reg organizer\is-n7pbc.tmp
%ProgramFiles(x86)%\reg organizer\is-80lh9.tmp
%ProgramFiles(x86)%\reg organizer\is-91pbt.tmp
%ProgramFiles(x86)%\reg organizer\is-3l4v9.tmp
%ProgramFiles(x86)%\reg organizer\is-cgut1.tmp
%ProgramFiles(x86)%\reg organizer\is-clrm7.tmp
%ProgramFiles(x86)%\reg organizer\is-qqnon.tmp
%ProgramFiles(x86)%\reg organizer\is-fvjef.tmp
%ProgramFiles(x86)%\reg organizer\is-2n7a8.tmp
%TEMP%\is-h7lgl.tmp\_isetup\_iscrypt.dll
%TEMP%\is-h7lgl.tmp\_isetup\_shfoldr.dll
%TEMP%\is-h7lgl.tmp\_isetup\_setup64.tmp
%TEMP%\is-h7lgl.tmp\_isetup\_regdll.tmp
%ProgramFiles(x86)%\reg organizer\unins000.dat
%ProgramFiles(x86)%\reg organizer\regorganizeragent.exe

Moves the following files

from %ProgramFiles(x86)%\reg organizer\is-2n7a8.tmp to %ProgramFiles(x86)%\reg organizer\unins000.exe
from %ProgramFiles(x86)%\reg organizer\documentation\russian\is-91inc.tmp to %ProgramFiles(x86)%\reg organizer\documentation\russian\documentation.chm
from %ProgramFiles(x86)%\reg organizer\is-dt193.tmp to %ProgramFiles(x86)%\reg organizer\whatsnew-russian.txt
from %ProgramFiles(x86)%\reg organizer\is-k6cd9.tmp to %ProgramFiles(x86)%\reg organizer\readme-russian.txt
from %ProgramFiles(x86)%\reg organizer\is-ba705.tmp to %ProgramFiles(x86)%\reg organizer\license-russian.txt
from %ProgramFiles(x86)%\reg organizer\documentation\english\is-7sohp.tmp to %ProgramFiles(x86)%\reg organizer\documentation\english\documentation.chm
from %ProgramFiles(x86)%\reg organizer\is-nd4iv.tmp to %ProgramFiles(x86)%\reg organizer\whatsnew.txt
from %ProgramFiles(x86)%\reg organizer\is-5f4hf.tmp to %ProgramFiles(x86)%\reg organizer\readme.txt
from %ProgramFiles(x86)%\reg organizer\is-09tad.tmp to %ProgramFiles(x86)%\reg organizer\license.txt
from %ProgramFiles(x86)%\reg organizer\is-m2ie1.tmp to %ProgramFiles(x86)%\reg organizer\updaterdll.dll
from %ProgramFiles(x86)%\reg organizer\languages\is-m3vf2.tmp to %ProgramFiles(x86)%\reg organizer\languages\russian.sib
from %ProgramFiles(x86)%\reg organizer\is-r7gjk.tmp to %ProgramFiles(x86)%\reg organizer\updater.exe
from %ProgramFiles(x86)%\reg organizer\is-ji7a1.tmp to %ProgramFiles(x86)%\reg organizer\reg64call.exe
from %ProgramFiles(x86)%\reg organizer\is-n7pbc.tmp to %ProgramFiles(x86)%\reg organizer\optimizationanimation.avi
from %ProgramFiles(x86)%\reg organizer\is-80lh9.tmp to %ProgramFiles(x86)%\reg organizer\installertracingagent.dll
from %ProgramFiles(x86)%\reg organizer\is-91pbt.tmp to %ProgramFiles(x86)%\reg organizer\ignore_dc.first
from %ProgramFiles(x86)%\reg organizer\is-3l4v9.tmp to %ProgramFiles(x86)%\reg organizer\ignore_arc.first
from %ProgramFiles(x86)%\reg organizer\is-cgut1.tmp to %ProgramFiles(x86)%\reg organizer\filemasks.first
from %ProgramFiles(x86)%\reg organizer\is-clrm7.tmp to %ProgramFiles(x86)%\reg organizer\closeapplication.dll
from %ProgramFiles(x86)%\reg organizer\is-qqnon.tmp to %ProgramFiles(x86)%\reg organizer\cleanfolders.first
from %ProgramFiles(x86)%\reg organizer\is-fvjef.tmp to %ProgramFiles(x86)%\reg organizer\links.xml
from %ProgramFiles(x86)%\reg organizer\is-dcrgj.tmp to %ProgramFiles(x86)%\reg organizer\regorganizeragent.exe
from %ProgramFiles(x86)%\reg organizer\is-s2imq.tmp to %ProgramFiles(x86)%\reg organizer\turbosearch.exe

Network activity

Connects to

'ma####elminobhei.ml':80

TCP

HTTP POST requests

http://ma####elminobhei.ml/new/net_api

UDP

DNS ASK ma####elminobhei.ml

Miscellaneous

Searches for the following windows

ClassName: '{1ca8f2c8635d2a4609b34a17a3715da5}' WindowName: ''

Creates and executes the following

'%TEMP%\is-06jc5.tmp\<File name>.tmp' /SL5="$120226,5143361,211456,<Full path to file>"
'%ProgramFiles(x86)%\reg organizer\regorganizeragent.exe'
'%ProgramFiles(x86)%\reg organizer\regorganizeragent.exe' 64eb9c3ecc5fc473ceeb1c42f91c2ec2

Executes the following