Trojan.PWS.Siggen2.34518

Техническая информация

Вредоносные функции

Ищет ветки реестра, отвечающие за хранение паролей сторонними программами

[<HKCU>\Software\Martin Prikryl\WinSCP 2\Sessions]

Читает файлы, отвечающие за хранение паролей сторонними программами

<LS_APPDATA>\google\chrome\user data\default\cookies
<LS_APPDATA>\google\chrome\user data\default\login data
<LS_APPDATA>\google\chrome\user data\default\web data
%APPDATA%\opera software\opera stable\login data
%HOMEPATH%\desktop\508softwareandos.doc
%HOMEPATH%\desktop\adhd_and_obesity.docx
%HOMEPATH%\desktop\applicantform_en.doc
%HOMEPATH%\desktop\fi51.doc
%HOMEPATH%\desktop\file_p_00000000_1371597592.docx
%HOMEPATH%\desktop\glidescope_review_rev_010.docx
%HOMEPATH%\desktop\issi2013_template_for_posters.docx
%HOMEPATH%\desktop\uep_form_786_bulletin_1726i602.doc
%HOMEPATH%\desktop\weeklysheet1215.doc

Изменения в файловой системе

Создает следующие файлы

%TEMP%\nt.exe
%APPDATA%\ptstq3r3v8y3y3r3v8y3y3\information.txt
%APPDATA%\ptstq3r3v8y3y3r3v8y3y3\screenshot.jpeg
%APPDATA%\ptstq3r3v8y3y3r3v8y3y3\files.zip
%APPDATA%\ptstq3r3v8y3y3r3v8y3y3\files\weeklysheet1215.doc
%APPDATA%\ptstq3r3v8y3y3r3v8y3y3\files\uep_form_786_bulletin_1726i602.doc
%APPDATA%\ptstq3r3v8y3y3r3v8y3y3\files\issi2013_template_for_posters.docx
%APPDATA%\ptstq3r3v8y3y3r3v8y3y3\files\glidescope_review_rev_010.docx
%APPDATA%\ptstq3r3v8y3y3r3v8y3y3\files\file_p_00000000_1371597592.docx
%APPDATA%\ptstq3r3v8y3y3r3v8y3y3\files\fi51.doc
%APPDATA%\ptstq3r3v8y3y3r3v8y3y3\files\applicantform_en.doc
%APPDATA%\ptstq3r3v8y3y3r3v8y3y3\files\adhd_and_obesity.docx
%APPDATA%\ptstq3r3v8y3y3r3v8y3y3\files\508softwareandos.doc
%APPDATA%\ptstq3r3v8y3y3r3v8y3y3\history\edge.txt
%APPDATA%\ptstq3r3v8y3y3r3v8y3y3\other\actions.txt
<LS_APPDATA>\microsoft\vault\4bf4c442-9b8a-41a0-b380-dd4a704ddb28\policy.vpol
%PROGRAMDATA%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\3ccd5499-87a8-4b10-a215-608888dd3b55.vsch
%PROGRAMDATA%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\policy.vpol
%APPDATA%\ptstq3r3v8y3y3r3v8y3y3\history\opera.txt
%APPDATA%\ptstq3r3v8y3y3r3v8y3y3\cookies\opera_2.log
%APPDATA%\ptstq3r3v8y3y3r3v8y3y3\history\mozilla.txt
%APPDATA%\ptstq3r3v8y3y3r3v8y3y3\cookies\mozilla_1.log
%APPDATA%\ptstq3r3v8y3y3r3v8y3y3\cookies\chrome_0.log
%TEMP%\rdjruvpxlxmd.swx
%APPDATA%\ptstq3r3v8y3y3r3v8y3y3\telegram\map0
%APPDATA%\ptstq3r3v8y3y3r3v8y3y3\telegram\d877f783d5d3ef8c1
%APPDATA%\ptstq3r3v8y3y3r3v8y3y3\steam\dialogconfig.vdf
%APPDATA%\ptstq3r3v8y3y3r3v8y3y3\steam\config.vdf
%TEMP%\liteinjector.exe
%PROGRAMDATA%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\2f1a6504-0641-44cf-8bb5-3612d865f2e5.vsch
%APPDATA%\zparq3r3v8y3y3r3v8y3y3.zip