Trojan.PWS.Siggen2.3815

Техническая информация

Вредоносные функции:

Ищет ветки реестра, отвечающие за хранение паролей сторонними программами:

[<HKCU>\SOFTWARE\FileZilla Client]

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\RarSFX0\%AppData%\Microsoft\Windows\Cookies\index.dat
%TEMP%\RarSFX0\%drive_c%\Program Files\CCleaner\Lang\lang-3098.dll
%TEMP%\RarSFX0\%drive_c%\Program Files\CCleaner\Lang\lang-2074.dll
%TEMP%\RarSFX0\%drive_c%\Program Files\CCleaner\Lang\lang-2070.dll
%TEMP%\RarSFX0\%drive_c%\Program Files\CCleaner\Lang\lang-2052.dll
%TEMP%\RarSFX0\%drive_c%\Program Files\CCleaner\Lang\lang-1110.dll
%TEMP%\RarSFX0\%drive_c%\Program Files\CCleaner\Lang\lang-1087.dll
%TEMP%\RarSFX0\%drive_c%\Program Files\CCleaner\Lang\lang-9999.dll
%TEMP%\RarSFX0\%drive_c%\Program Files\CCleaner\Lang\lang-5146.dll
%TEMP%\RarSFX0\%drive_c%\Program Files\CCleaner\Lang\lang-1068.dll
%TEMP%\RarSFX0\%drive_c%\Program Files\CCleaner\Lang\lang-1067.dll
%TEMP%\RarSFX0\%drive_c%\Program Files\CCleaner\Lang\lang-1066.dll
%TEMP%\RarSFX0\%drive_c%\Program Files\CCleaner\Lang\lang-1065.dll
%TEMP%\RarSFX0\%drive_c%\Program Files\CCleaner\Lang\lang-1063.dll
%TEMP%\RarSFX0\%drive_c%\Program Files\CCleaner\Lang\lang-1061.dll
%TEMP%\RarSFX0\%drive_c%\Program Files\CCleaner\Lang\lang-1079.dll
%TEMP%\RarSFX0\%drive_c%\Program Files\CCleaner\Lang\lang-1035.dll
%TEMP%\RarSFX0\%drive_c%\Program Files\CCleaner\uninst.exe
%TEMP%\RarSFX0\HKEY_LOCAL_MACHINE.txt
%TEMP%\RarSFX0\HKEY_CURRENT_USER.txt
%TEMP%\RarSFX0\build.bat
%TEMP%\RarSFX0\%SystemSystem%\LogFiles\WUDF\WUDFTrace.etl
%TEMP%\RarSFX0\%WINDIR%\AppCompat\Programs\RecentFileCache.bcf
%TEMP%\RarSFX0\%Personal%\##Attributes.ini
%TEMP%\RarSFX0\%Local AppData%Low\Microsoft\Internet Explorer\DOMStore\index.dat
%TEMP%\RarSFX0\%Local AppData%\Temp\RarSFX1\iconsext.exe
%TEMP%\RarSFX0\%Local AppData%\Temp\RarSFX1\iconsext.chm
%TEMP%\RarSFX0\%Local AppData%\Temp\RarSFX1\iconsext.cfg
%TEMP%\RarSFX0\%Local AppData%\Temp\RarSFX1\##Attributes.ini
%TEMP%\RarSFX0\%Local AppData%\Temp\Low\##Attributes.ini
%TEMP%\RarSFX0\%Local AppData%\Microsoft\Internet Explorer\DOMStore\index.dat
%TEMP%\RarSFX0\%Local AppData%\ATI\ACE\Profiles.xml
%TEMP%\RarSFX0\%drive_c%\Users\All Users\Microsoft\Search\Data\Applications\Windows\GatherLogs\SystemIndex\SystemIndex.42.gthr
%TEMP%\RarSFX0\%drive_c%\Program Files\CCleaner\Lang\lang-1060.dll
%TEMP%\RarSFX0\%drive_c%\Program Files\CCleaner\Lang\lang-1071.dll
%TEMP%\RarSFX0\%drive_c%\Program Files\CCleaner\Lang\lang-1059.dll
%TEMP%\RarSFX0\%drive_c%\Program Files\CCleaner\Lang\lang-1058.dll
%TEMP%\RarSFX0\%drive_c%\Program Files\CCleaner\Lang\lang-1055.dll
%TEMP%\RarSFX0\%drive_c%\Program Files\CCleaner\Lang\##Attributes.ini
%TEMP%\RarSFX0\%drive_c%\Program Files\CCleaner\Lang\lang-1030.dll
%TEMP%\RarSFX0\%drive_c%\Program Files\CCleaner\Lang\lang-1029.dll
%TEMP%\RarSFX0\%drive_c%\Program Files\CCleaner\Lang\lang-1028.dll
%TEMP%\RarSFX0\%drive_c%\Program Files\CCleaner\Lang\lang-1027.dll
%TEMP%\RarSFX0\%drive_c%\Program Files\CCleaner\Lang\lang-1026.dll
%TEMP%\RarSFX0\%drive_c%\Program Files\CCleaner\Lang\lang-1025.dll
%TEMP%\RarSFX0\%drive_c%\Program Files\CCleaner\CCleaner64.exe
%TEMP%\RarSFX0\%drive_c%\Program Files\CCleaner\Lang\lang-1032.dll
%TEMP%\RarSFX0\%drive_c%\Program Files\CCleaner\CCleaner.exe
%TEMP%\RarSFX0\%drive_c%\Program Files\CCleaner\##Attributes.ini
%TEMP%\RarSFX0\%Desktop%\##Attributes.ini
%TEMP%\RarSFX0\%Common AppData%\Microsoft\Search\Data\Applications\Windows\GatherLogs\SystemIndex\SystemIndex.42.gthr
%TEMP%\RarSFX0\%Common AppData%\ATI\ACE\Profiles.xml
%TEMP%\RarSFX0\%AppData%\Microsoft\Windows\Cookies\Low\index.dat
%TEMP%\RarSFX0\HKEY_USERS.txt
%TEMP%\RarSFX0\%drive_c%\Users\All Users\ATI\ACE\Profiles.xml
%TEMP%\RarSFX0\%drive_c%\Program Files\CCleaner\Lang\lang-1034.dll
%TEMP%\RarSFX0\%drive_c%\Program Files\CCleaner\Lang\lang-1037.dll
%TEMP%\RarSFX0\%drive_c%\Program Files\CCleaner\Lang\lang-1031.dll
%TEMP%\RarSFX0\%drive_c%\Program Files\CCleaner\Lang\lang-1053.dll
%TEMP%\RarSFX0\%drive_c%\Program Files\CCleaner\Lang\lang-1052.dll
%TEMP%\RarSFX0\%drive_c%\Program Files\CCleaner\Lang\lang-1051.dll
%TEMP%\RarSFX0\%drive_c%\Program Files\CCleaner\Lang\lang-1050.dll
%TEMP%\RarSFX0\%drive_c%\Program Files\CCleaner\Lang\lang-1049.dll
%TEMP%\RarSFX0\%drive_c%\Program Files\CCleaner\Lang\lang-1048.dll
%TEMP%\RarSFX0\%drive_c%\Program Files\CCleaner\Lang\lang-1046.dll
%TEMP%\RarSFX0\%drive_c%\Program Files\CCleaner\Lang\lang-1045.dll
%TEMP%\RarSFX0\%drive_c%\Program Files\CCleaner\Lang\lang-1044.dll
%TEMP%\RarSFX0\%drive_c%\Program Files\CCleaner\Lang\lang-1043.dll
%TEMP%\RarSFX0\%drive_c%\Program Files\CCleaner\Lang\lang-1042.dll
%TEMP%\RarSFX0\%drive_c%\Program Files\CCleaner\Lang\lang-1041.dll
%TEMP%\RarSFX0\%drive_c%\Program Files\CCleaner\Lang\lang-1040.dll
%TEMP%\RarSFX0\%drive_c%\Program Files\CCleaner\Lang\lang-1038.dll
%TEMP%\RarSFX0\%drive_c%\Program Files\CCleaner\Lang\lang-1036.dll
%TEMP%\RarSFX0\Package.ini

Присваивает атрибут 'скрытый' для следующих файлов:

%TEMP%\RarSFX0\%AppData%\Microsoft\Windows\Cookies\index.dat
%TEMP%\RarSFX0\%AppData%\Microsoft\Windows\Cookies\Low\index.dat
%TEMP%\RarSFX0\%Local AppData%\Microsoft\Internet Explorer\DOMStore\index.dat
%TEMP%\RarSFX0\%Local AppData%Low\Microsoft\Internet Explorer\DOMStore\index.dat
%TEMP%\RarSFX0\%WINDIR%\AppCompat\Programs\RecentFileCache.bcf

Другое:

Ищет следующие окна: