Trojan.PWS.Siggen.25596

Техническая информация

Вредоносные функции:

Запускает на исполнение:

%WINDIR%\Microsoft.NET\Framework\v2.0.50727\vbc.exe

Ищет ветки реестра, отвечающие за хранение паролей сторонними программами:

[<HKCU>\Software\Paltalk]
[<HKCU>\Software\Google\Google Talk\Accounts]

Ищет следующие окна с целью

обнаружения утилит для анализа:

ClassName: 'PROCMON_WINDOW_CLASS' WindowName: ''

обнаружения различных программ и игр:

ClassName: 'gdkWindowToplevel' WindowName: ''

Изменения в файловой системе:

Создает следующие файлы:

%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\ULU3YH2D\FLAG-OF-PAKISTAN-KARACHI-14TH-AUGUST[1].jpg
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\0D6B6PI5\Pakistan-Army3[1].jpg
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\0D6B6PI5\14-August-Pakistan-Independence-Day-Greetings-013[1].jpg
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\0D6B6PI5\CAG5AN81
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\ULU3YH2D\pakistan-cricket-team-wallpaper-5[1].jpg
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\0D6B6PI5\AfghanmilitantsbidtoenterNWAfoiled_28840[1].jpg
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\ULU3YH2D\islamPrayer_web1[1].jpg
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\siachen20000[1].jpg
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\ULU3YH2D\0_65_pakistan1_320[1].jpg
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\SL6TKFAX\good-picture-of-kashmiris-with-pakistani-flag[1].jpg
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\ULU3YH2D\image[1].axd
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\SL6TKFAX\pic01[1].jpg
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\0D6B6PI5\2egcsis[1].jpg
%APPDATA%\14august.html
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\2yuy8go[1].png
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\pakistan_14_august_2010_by_mu6[1].jpg
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\14-August-2011-Pakistan-independance-Day-Yaum-i-Azadi-5[1].jpg
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\69I9OPW5\14_August_independence_day_of_Pakistan_14228[1].jpg
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\SL6TKFAX\14_August_2010_Independence_Day_Of_Pakistan_31393[1].jpg
%HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\SL6TKFAX\Go-Green[1].jpg

Сетевая активность:

Подключается к:

'pa######andpakistanis.com':80
'4.##.#logspot.com':80
'2.##.#logspot.com':80
'1.##.#logspot.com':80
'www.fo##ews.com':80
'na###n.com.pk':80
'www.wo######uritynetwork.com':80
'3.##.#logspot.com':80
'www.oo###ies.org':80
'www.go###e.com.pk':80
'i2#.#inypic.com':80
'www.be####weblogs.com':80
'localhost':1036
'i5#.#inypic.com':80
'th######.files.wordpress.com':80
'fc##.#eviantart.net':80
'www.pa##mag.com':80
'te###.com.pk':80
'wa####pers99.com':80

TCP:

Запросы HTTP GET:

pa######andpakistanis.com/wp-content/uploads/2011/06/FLAG-OF-PAKISTAN-KARACHI-14TH-AUGUST.jpg
4.##.#logspot.com/-4ks-gEgtuhM/TfuPFzu4TdI/AAAAAAAAAFc/xWoqAccLa2I/s1600/Pakistan-Army3.jpg
2.##.#logspot.com/-AukPU5IrA6s/TZAC0a7KCbI/AAAAAAAAAyA/CI06FmC7E2A/s1600/pakistan-cricket-team-wallpaper-5.jpg
1.##.#logspot.com/-MiFIH9NtP1o/TkNuFttsjwI/AAAAAAAACTg/bzlsPzxR_VI/s400/14-August-Pakistan-Independence-Day-Greetings-013.jpg
www.fo##ews.com/images/533752/0_65_pakistan1_320.jpg
na###n.com.pk/uploads/news_image/large/AfghanmilitantsbidtoenterNWAfoiled_28840.jpg
www.wo######uritynetwork.com/ArticleImages/islamPrayer_web1.jpg
3.##.#logspot.com/_HKrxDdTVLT0/TUldBhMdJNI/AAAAAAAABWY/6mYN5UmJdz8/s1600/good-picture-of-kashmiris-with-pakistani-flag.jpg
www.oo###ies.org/pakistanarmy_pk/images/siachen20000.jpg
www.be####weblogs.com/image.axd?pi######################################################################################
th######.files.wordpress.com/2010/08/pic01.jpg
i5#.#inypic.com/2yuy8go.png
i2#.#inypic.com/2egcsis.jpg
te###.com.pk/blog/wp-content/uploads/2009/08/Go-Green.jpg
fc##.#eviantart.net/fs70/f/2010/225/7/5/pakistan_14_august_2010_by_mu6.jpg
www.pa##mag.com/files/2011/08/14-August-2011-Pakistan-independance-Day-Yaum-i-Azadi-5.jpg
wa####pers99.com/14_August_2010_Independence_Day_Of_Pakistan--w1400x1050--0--0--images/wallpaper/1400x1050/14_August_2010_Independence_Day_Of_Pakistan_31393.jpg
wa####pers99.com/14_August_independence_day_of_Pakistan--w1024x768--0--0--images/wallpaper/1024x768/14_August_independence_day_of_Pakistan_14228.jpg