Trojan.PWS.Siggen2.3818

Техническая информация

Вредоносные функции:

Ищет ветки реестра, отвечающие за хранение паролей сторонними программами:

[<HKCU>\SOFTWARE\Ghisler\Total Commander]
[<HKCU>\SOFTWARE\Ghisler\Windows Commander]

Изменения в файловой системе:

Создает следующие файлы:

%TEMP%\RarSFX0\FILE_ID.DIZ
%ProgramFiles%\totalcmd\TCUNIN64.EXE
%ProgramFiles%\totalcmd\TCMADM64.EXE
%ProgramFiles%\totalcmd\SFXHEAD.SFX
%ProgramFiles%\totalcmd\TC7Z64.DLL
%ProgramFiles%\totalcmd\TCLZMA64.DLL
%ProgramFiles%\totalcmd\TCUNZL64.DLL
%ProgramFiles%\totalcmd\WCMZIP64.DLL
%ProgramFiles%\totalcmd\WCMICONS.INC
%ProgramFiles%\totalcmd\WCMICON2.DLL
%ProgramFiles%\totalcmd\WCMICONS.DLL
%ProgramFiles%\totalcmd\UNRAR64.DLL
%ProgramFiles%\totalcmd\WCUNINST.WUL
%ProgramFiles%\totalcmd\NOCLOSE64.EXE
%ProgramFiles%\totalcmd\TCUNINST.WUL
%ProgramFiles%\totalcmd\TCUNIN64.WUL
%ProgramFiles%\totalcmd\VERTICAL.BAR
%ProgramFiles%\totalcmd\NO.BAR
%ProgramFiles%\totalcmd\DEFAULT.BAR
%ProgramFiles%\totalcmd\HISTORY.TXT
%ProgramFiles%\totalcmd\descript.ion
%ProgramFiles%\totalcmd\LANGUAGE\WCMD_RUS.INC
%ProgramFiles%\totalcmd\LANGUAGE\WCMD_RUS.MNU
%ProgramFiles%\totalcmd\LANGUAGE\WCMD_RUS.LNG
%ProgramFiles%\totalcmd\TOTALCMD.INC
%ProgramFiles%\totalcmd\LANGUAGE\WCMD_NOR.LNG
%ProgramFiles%\totalcmd\CGLPT64.SYS
%HOMEPATH%\Start Menu\Programs\Total Commander\Total Commander Help.lnk
%HOMEPATH%\Start Menu\Programs\Total Commander\Total Commander.lnk
%ProgramFiles%\totalcmd\TOTALCMD64.EXE.MANIFEST
%ProgramFiles%\totalcmd\TOTALCMD64.EXE
%ProgramFiles%\totalcmd\TCUNINST.EXE
%ProgramFiles%\totalcmd\TOTALCMD.EXE.MANIFEST
%ProgramFiles%\totalcmd\TOTALCMD.EXE
%ProgramFiles%\totalcmd\NOCLOSE.EXE
%ProgramFiles%\totalcmd\TCMADMIN.EXE
%ProgramFiles%\totalcmd\TCMDX64.EXE
%ProgramFiles%\totalcmd\SHARE_NT.EXE
%ProgramFiles%\totalcmd\LANGUAGE\WCMD_CHN.INC
%ProgramFiles%\totalcmd\TCMDX32.EXE
%ProgramFiles%\totalcmd\UNRAR9X.DLL
%ProgramFiles%\totalcmd\UNRAR.DLL
%ProgramFiles%\totalcmd\UNACEV2.DLL
%ProgramFiles%\totalcmd\CABRK.DLL
%ProgramFiles%\totalcmd\FRERES32.DLL
%ProgramFiles%\totalcmd\WCMZIP32.DLL
%ProgramFiles%\totalcmd\WC32TO16.EXE
%ProgramFiles%\totalcmd\TCMDLZMA.DLL
%ProgramFiles%\totalcmd\TCUNZLIB.DLL
%ProgramFiles%\totalcmd\CGLPTNT.SYS
%ProgramFiles%\totalcmd\CGLPT9X.VXD
%ProgramFiles%\totalcmd\TC7ZIPIF.DLL
%ProgramFiles%\totalcmd\TcUsbRun.exe
%ProgramFiles%\totalcmd\LANGUAGE\WCMD_CHN.MNU
%ProgramFiles%\totalcmd\LANGUAGE\WCMD_CHN.LNG
%ProgramFiles%\totalcmd\LANGUAGE\WCMD_KOR.INC
%ProgramFiles%\totalcmd\LANGUAGE\WCMD_CZ.LNG
%ProgramFiles%\totalcmd\LANGUAGE\WCMD_DUT.INC
%ProgramFiles%\totalcmd\LANGUAGE\WCMD_DUT.MNU
%ProgramFiles%\totalcmd\LANGUAGE\WCMD_DUT.LNG
%ProgramFiles%\totalcmd\LANGUAGE\WCMD_DEU.INC
%ProgramFiles%\totalcmd\LANGUAGE\WCMD_DEU.MNU
%ProgramFiles%\totalcmd\LANGUAGE\WCMD_DEU.LNG
%ProgramFiles%\totalcmd\LANGUAGE\WCMD_DAN.INC
%ProgramFiles%\totalcmd\LANGUAGE\WCMD_DAN.MNU
%ProgramFiles%\totalcmd\LANGUAGE\WCMD_DAN.LNG
%ProgramFiles%\totalcmd\LANGUAGE\WCMD_CZ.INC
%HOMEPATH%\Start Menu\Programs\Total Commander\Uninstall or Repair Total Commander.lnk
%ProgramFiles%\totalcmd\LANGUAGE\WCMD_ESP.LNG
%ProgramFiles%\totalcmd\TOTALCMD.CHM
%ProgramFiles%\totalcmd\SIZE!.TXT
%ProgramFiles%\totalcmd\KEYBOARD.TXT
%APPDATA%\GHISLER\wincmd.ini
%TEMP%\RarSFX0\TotalCommander.URL
%TEMP%\RarSFX0\README.TXT
%TEMP%\RarSFX0\LIESMICH.TXT
%TEMP%\RarSFX0\INSTALL.LNG
%TEMP%\RarSFX0\INSTALL.INF
%TEMP%\RarSFX0\INSTALL.EXE
%TEMP%\RarSFX0\INSTALL.CAB
%ProgramFiles%\totalcmd\LANGUAGE\WCMD_CZ.MNU
%ProgramFiles%\totalcmd\TC7Z.DLL
%ProgramFiles%\totalcmd\LANGUAGE\WCMD_ESP.MNU
%ProgramFiles%\totalcmd\LANGUAGE\WCMD_FRA.MNU
%ProgramFiles%\totalcmd\LANGUAGE\WCMD_ESP.INC
%ProgramFiles%\totalcmd\LANGUAGE\WCMD_KOR.MNU
%ProgramFiles%\totalcmd\LANGUAGE\WCMD_KOR.LNG
%ProgramFiles%\totalcmd\LANGUAGE\WCMD_SWE.MNU
%ProgramFiles%\totalcmd\LANGUAGE\WCMD_SWE.LNG
%ProgramFiles%\totalcmd\LANGUAGE\WCMD_SVN.INC
%ProgramFiles%\totalcmd\LANGUAGE\WCMD_SVN.MNU
%ProgramFiles%\totalcmd\LANGUAGE\WCMD_SVN.LNG
%ProgramFiles%\totalcmd\LANGUAGE\WCMD_SK.MNU
%ProgramFiles%\totalcmd\LANGUAGE\WCMD_SK.LNG
%ProgramFiles%\totalcmd\LANGUAGE\WCMD_POL.MNU
%ProgramFiles%\totalcmd\LANGUAGE\WCMD_FRA.LNG
%ProgramFiles%\totalcmd\LANGUAGE\WCMD_POL.LNG
%ProgramFiles%\totalcmd\LANGUAGE\WCMD_ENG.MNU
%ProgramFiles%\totalcmd\LANGUAGE\WCMD_ITA.INC
%ProgramFiles%\totalcmd\LANGUAGE\WCMD_ITA.MNU
%ProgramFiles%\totalcmd\LANGUAGE\WCMD_ITA.LNG
%ProgramFiles%\totalcmd\LANGUAGE\WCMD_ROM.INC
%ProgramFiles%\totalcmd\LANGUAGE\WCMD_ROM.MNU
%ProgramFiles%\totalcmd\LANGUAGE\WCMD_ROM.LNG
%ProgramFiles%\totalcmd\LANGUAGE\WCMD_HUN.INC
%ProgramFiles%\totalcmd\LANGUAGE\WCMD_HUN.MNU
%ProgramFiles%\totalcmd\LANGUAGE\WCMD_HUN.LNG
%ProgramFiles%\totalcmd\LANGUAGE\WCMD_FRA.INC
%ProgramFiles%\totalcmd\LANGUAGE\WCMD_NOR.MNU
%HOMEPATH%\Desktop\Total Commander.lnk