Trojan.PWS.Siggen2.35747

Техническая информация

Вредоносные функции

Ищет ветки реестра, отвечающие за хранение паролей сторонними программами

[<HKLM>\SOFTWARE\Wow6432Node\ORL\WinVNC3]
[<HKLM>\SOFTWARE\Wow6432Node\JoWooD\InstalledGames\IG2]
[<HKLM>\SOFTWARE\Wow6432Node\3d0\Status Legends of Might and Magic]
[<HKLM>\SOFTWARE\Wow6432Node\Electronic Arts\Medal of Honor Airborne]
[<HKLM>\SOFTWARE\Wow6432Node\EnTech\PowerStrip]
[<HKLM>\SOFTWARE\Wow6432Node\KONAMI\PES2008]
[<HKLM>\SOFTWARE\Wow6432Node\Red Storm Entertainment\RAVENSHIELD]
[<HKLM>\SOFTWARE\Wow6432Node\Ubisoft\SILENT HUNTER III\Keys]
[<HKLM>\SOFTWARE\Wow6432Node\GSC Game World\STALKER-SHOC]
[<HKLM>\SOFTWARE\Wow6432Node\LucasArts\Star Wars Battlefront II\1.0]
[<HKLM>\SOFTWARE\Wow6432Node\LucasArts\Star Wars Battlefront II\1.1]
[<HKLM>\SOFTWARE\Wow6432Node\Ubisoft\Splinter Cell Pandora Tomorrow]
[<HKLM>\SOFTWARE\Wow6432Node\THQ\Gas Powered Games\Supreme Commander]
[<HKCU>\Software\Valve\Half-Life\Settings]
[<HKCU>\Software\Microsoft\IdentityCRL]
[<HKCU>\Software\America Online\AOL Instant Messenger (TM)\CurrentVersion\Users]
[<HKCU>\Software\America Online\AIM6\Passwords]
[<HKCU>\Software\AIM\AIMPRO]
[<HKCU>\Software\Yahoo\Pager]
[<HKLM>\Software\Wow6432Node\Mirabilis\ICQ\NewOwners]
[<HKLM>\SOFTWARE\Wow6432Node\IGI 2 Retail\CDKey]
[<HKCU>\Software\Mirabilis\ICQ\NewOwners]
[<HKLM>\SOFTWARE\Wow6432Node\Illusion Softworks\Hidden & Dangerous 2]
[<HKLM>\SOFTWARE\Wow6432Node\THQ\Frontlines: Fuel of War]
[<HKLM>\Software\Wow6432Node\Miranda]
[<HKCU>\Software\Microsoft\MSNMessenger]
[<HKLM>\Software\Wow6432Node\Eugen Systems\ActOfWar]
[<HKLM>\Software\Wow6432Node\Sunflowers\Anno 1701]
[<HKLM>\Software\Wow6432Node\Activision\Call of Duty]
[<HKLM>\SOFTWARE\Wow6432Node\Activision\Call of Duty 2]
[<HKLM>\SOFTWARE\Wow6432Node\Activision\Call of Duty 4]
[<HKLM>\SOFTWARE\Wow6432Node\Techland\Chrome]
[<HKLM>\SOFTWARE\Wow6432Node\Westwood\Red Alert 2]
[<HKLM>\SOFTWARE\Wow6432Node\Westwood\Red Alert]
[<HKLM>\SOFTWARE\Wow6432Node\Westwood\Tiberian Sun]
[<HKLM>\SOFTWARE\Wow6432Node\THQ\Company of Heroes]
[<HKLM>\SOFTWARE\Wow6432Node\Valve\Counter-Strike\Settings]
[<HKLM>\SOFTWARE\Wow6432Node\Valve\Day of Defeat\Settings]
[<HKLM>\SOFTWARE\Wow6432Node\Sierra\Empire Earth II]
[<HKLM>\SOFTWARE\Wow6432Node\Sierra\CDKey]
[<HKLM>\SOFTWARE\Wow6432Node\CRYTEK\FARCRY\UBI.COM]
[<HKLM>\SOFTWARE\Wow6432Node\CRYTEK\FARCRY2\UBI.COM]
[<HKLM>\SOFTWARE\Wow6432Node\THQ\Frontlines: Fuel of War Beta]
[<HKLM>\SOFTWARE\Wow6432Node\Valve\Half-Life\Settings]
[<HKCU>\Software\Google\Google Talk\Accounts]

Читает файлы, отвечающие за хранение паролей сторонними программами

%APPDATA%\mozilla\firefox\profiles.ini

Изменения в файловой системе

Создает следующие файлы

%APPDATA%\microsoft\crypto\rsa\s-1-5-21-1960123792-2022915161-3775307078-1001\f1e7628d29a0f06d73d450e081e47a12_36d1130a-ac2e-44f7-9dc1-e424fbcbe0ee
%WINDIR%\syswow64\recoveryfiles\recoverei.exe
%WINDIR%\syswow64\recoveryfiles\recovermes.exe
%WINDIR%\syswow64\recoveryfiles\vncrecover.exe
%WINDIR%\syswow64\recoveryfiles\mlrecover.exe
%WINDIR%\syswow64\recoveryfiles\weprecover.exe
%WINDIR%\syswow64\recoveryfiles\appinstalled.txt
%WINDIR%\syswow64\recoveryfiles\sysinformations.txt
%WINDIR%\syswow64\recoveryfiles\gamescdkey.txt
%WINDIR%\syswow64\recoveryfiles\msn-receivedfiles.txt
%WINDIR%\syswow64\recoveryfiles\ffpass-key3.txt
%WINDIR%\syswow64\recoveryfiles\ffpass-cert8.txt
<Текущая директория>\delme.bat

Присваивает атрибут 'скрытый' для следующих файлов

%WINDIR%\syswow64\recoveryfiles\recoverei.exe
%WINDIR%\syswow64\recoveryfiles\recovermes.exe
%WINDIR%\syswow64\recoveryfiles\vncrecover.exe
%WINDIR%\syswow64\recoveryfiles\weprecover.exe
%WINDIR%\syswow64\recoveryfiles\ffpass-key3.txt
%WINDIR%\syswow64\recoveryfiles\ffpass-cert8.txt
%WINDIR%\syswow64\recoveryfiles\msn-receivedfiles.txt
%WINDIR%\syswow64\recoveryfiles\appinstalled.txt
%WINDIR%\syswow64\recoveryfiles\sysinformations.txt
%WINDIR%\syswow64\recoveryfiles\gamescdkey.txt

Удаляет следующие файлы

%WINDIR%\syswow64\recoveryfiles\recoverei.exe
%WINDIR%\syswow64\recoveryfiles\recovermes.exe
%WINDIR%\syswow64\recoveryfiles\vncrecover.exe
%WINDIR%\syswow64\recoveryfiles\mlrecover.exe
%WINDIR%\syswow64\recoveryfiles\weprecover.exe

Самоудаляется.

Другое

Создает и запускает на исполнение

'%WINDIR%\syswow64\recoveryfiles\recoverei.exe' /stext <SYSTEM32>\RecoveryFiles\IErecover.txt
'%WINDIR%\syswow64\recoveryfiles\recovermes.exe' /stext <SYSTEM32>\RecoveryFiles\IMsRecover.txt
'%WINDIR%\syswow64\recoveryfiles\vncrecover.exe' /stext <SYSTEM32>\RecoveryFiles\VncRecover.txt
'%WINDIR%\syswow64\recoveryfiles\weprecover.exe' <SYSTEM32>\RecoveryFiles\WepRecover.txt
'%WINDIR%\syswow64\recoveryfiles\recoverei.exe' /stext <SYSTEM32>\RecoveryFiles\IErecover.txt' (со скрытым окном)
'%WINDIR%\syswow64\recoveryfiles\recovermes.exe' /stext <SYSTEM32>\RecoveryFiles\IMsRecover.txt' (со скрытым окном)
'%WINDIR%\syswow64\recoveryfiles\vncrecover.exe' /stext <SYSTEM32>\RecoveryFiles\VncRecover.txt' (со скрытым окном)
'%WINDIR%\syswow64\recoveryfiles\weprecover.exe' <SYSTEM32>\RecoveryFiles\WepRecover.txt' (со скрытым окном)
'%WINDIR%\syswow64\cmd.exe' /c ""<Текущая директория>\delme.bat" "' (со скрытым окном)

Запускает на исполнение