Trojan.Siggen.65123

Техническая информация

Для обеспечения автозапуска и распространения:

Модифицирует следующие ключи реестра:

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] 'engel' = '%APPDATA%\updates\updates.exe'

Создает или изменяет следующие файлы:

%HOMEPATH%\Start Menu\Programs\Startup\updates.exe

Вредоносные функции:

Для обхода брандмауэра удаляет или модифицирует следующие ключи реестра:

[<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'EnableFirewall' = '00000000'

Запускает на исполнение:

<SYSTEM32>\netsh.exe advfirewall firewall add rule name="<Имя вируса>" dir=in action=allow program="<Полный путь к вирусу>"

Изменяет следующие настройки браузера Windows Internet Explorer:

[<HKCU>\Software\Microsoft\Windows\CurrentVersion\Policies\Associations] 'LowRiskFileTypes' = '.exe'

Изменения в файловой системе:

Создает следующие файлы:

%APPDATA%\engel\updates.exe

Сетевая активность:

Подключается к:

'2.###.50.173':3128
'92.##.95.215':3128
'19#.#4.209.230':3128
'85.##5.83.227':3128
'20#.#2.189.14':3128
'95.#9.4.116':3128
'79.##9.16.217':3128
'92.##.250.198':3128
'20#.#10.185.87':3128
'46.##5.103.66':3128
'20#.#3.162.99':3128
'87.##7.35.76':3128
'11#.#06.122.167':3128
'31.#9.27.37':3128
'11#.#49.99.195':3128
'19#.#49.23.233':3128
'41.#9.7.53':3128
'18#.#27.42.22':3128
'19#.#42.10.21':3128
'98.##7.156.86':3128
'20#.#19.4.10':3128
'17#.#27.67.17':3128
'71.##.180.88':3128
'89.##5.244.229':3128
'18#.#19.223.149':3128
'17#.#00.136.231':3128
'20#.#05.34.98':3128
'19#.#3.172.7':3128
'18#.#20.181.158':3128
'2.###.44.196':3128
'79.##6.50.112':3128
'46.##.147.202':3128
'20#.#7.15.133':3128
'41.##1.47.42':3128
'80.#0.168.1':3128
'64.##0.246.5':3128
'19#.#0.77.169':3128
'71.##8.141.141':3128
'18#.#8.39.102':3128
'41.##0.200.219':3128
'41.##.17.192':3128
'98.##3.35.199':3128
'89.#8.6.113':3128
'77.#45.6.90':3128
'80.##.196.104':3128
'18#.#0.144.202':3128
'14#.#1.133.158':3128
'46.##.195.95':3128
'19#.#05.147.8':3128
'41.##.118.174':3128
'46.#8.132.8':3128
'19#.#99.13.7':3128
'18#.#96.111.61':3128
'2.###.252.199':3128
'11#.#42.101.101':3128
'18#.#3.54.111':3128
'83.#.53.203':3128
'19#.#13.15.230':3128
'91.##5.9.231':3128
'46.##5.102.118':3128
'41.##3.57.74':3128
'81.#0.0.17':3128
'70.##0.64.179':3128
'17#.#16.25.33':3128
'19#.#20.162.3':3128
'84.##0.213.252':3128
'12#.#05.136.103':3128
'95.#7.12.91':3128
'95.#5.36.51':3128
'18#.#6.1.107':3128
'86.##6.40.27':3128
'91.##5.141.145':3128
'24.##0.247.38':3128
'41.##1.43.37':3128
'17#.#23.191.233':3128
'66.##0.204.39':3128
'20#.#64.5.144':3128
'84.##8.242.247':3128
'18#.#5.186.139':3128
'2.###.51.161':3128
'19#.#3.163.105':3128
'78.##4.130.76':3128
'77.##5.6.231':3128
'41.##7.100.100':3128
'20#.#04.66.213':3128
'17#.#75.198.23':3128
'14.##.52.141':3128
'11#.#20.209.219':3128
'2.###.242.197':3128
'41.##5.21.229':3128
'20#.#8.112.165':3128
'19#.#8.255.167':3128
'17#.#25.154.36':3128
'21#.#9.35.15':3128
'79.##7.47.194':3128
'19#.#.86.231':3128
'12#.#21.246.89':3128
'74.#15.3.63':3128
'37.##.89.229':3128
'86.##.120.163':3128
'77.#45.6.14':3128
'77.#45.6.24':3128
'20#.#65.18.56':3128
'2.###.242.45':3128
'80.##.196.114':3128
'20#.#10.220.224':3128
'18#.#16.160.2':3128
'11#.#84.123.12':3128
'46.##5.108.254':3128
'14#.#85.30.114':3128
'18#.#94.141.104':3128
'19#.#6.32.34':3128
'37.##.108.219':3128
'19#.#9.192.244':3128
'84.##0.212.134':3128
'84.##0.209.139':3128
'78.##.149.250':3128
'19#.#7.231.139':3128
'81.#0.0.18':3128
'75.#4.6.220':3128
'82.##5.11.142':3128
'16#.#67.212.235':3128
'14.##.66.233':3128
'19#.#99.20.84':3128
'17#.#23.156.114':3128
'12#.#09.182.182':3128
'19#.#9.190.227':3128
'17#.#1.7.112':3128
'17#.#48.128.156':3128
'71.##.106.234':3128
'14#.#31.100.50':3128
'18#.#7.188.240':3128
'31.#9.9.119':3128
'46.##.26.159':3128
'89.##3.98.138':3128
'19#.#42.167.235':3128
'18#.#66.29.159':3128
'2.###.245.145':3128
'18#.#6.164.175':3128
'18#.#27.29.53':3128
'95.##.228.37':3128
'20#.#91.247.37':3128
'91.##.146.41':3128
'85.##0.98.101':3128
'19#.#02.112.106':3128
'80.##.168.14':3128
'87.##.198.162':3128
'31.#.238.176':3128
'18#.#25.107.14':3128
'18#.#7.189.244':3128
'14.#6.14.84':3128
'19#.#13.199.20':3128
'24.#.209.53':3128
'2.##3.41.39':3128
'14.#6.95.32':3128
'24.##7.164.141':3128
'11#.#35.71.156':3128
'84.##8.143.240':3128
'19#.#45.114.5':3128
'19#.#77.80.183':3128
'19#.#2.137.78':3128
'98.##6.110.103':3128
'18#.#3.17.71':3128
'74.#15.3.67':3128
'17#.#27.105.199':3128
'19#.#79.34.96':3128
'19#.#9.16.252':3128
'75.##.118.62':3128
'81.##.23.180':3128
'37.##.85.238':3128
'81.##.108.246':3128
'11#.#9.60.175':3128
'8.##.48.21':3128
'93.##5.70.28':3128
'61.#.33.12':3128
'67.##0.51.16':3128
'17#.#9.144.137':3128
'20#.#64.117.5':3128
'19#.#6.196.3':3128
'19#.#0.93.82':3128
'19#.#42.242.185':3128
'18#.#7.203.185':3128
'19#.#.97.196':3128
'95.##.238.175':3128
'93.##6.41.38':3128
'2.##3.66.56':3128
'80.##6.0.109':3128
'19#.#3.163.26':3128
'66.##4.111.198':3128
'41.##3.57.73':3128
'89.##.176.51':3128
'80.##.168.20':3128
'98.##.152.196':3128
'19#.#05.21.150':3128
'19#.#6.101.76':3128
'19#.#52.82.7':3128
'41.##.249.104':3128
'77.##5.6.251':3128
'13#.#05.165.232':3128
'11#.43.53.6':3128
'41.##8.214.147':3128
'19#.#21.184.54':3128
'18#.#0.52.64':3128
'18#.#0.200.114':3128
'80.##.168.16':3128
'92.##.187.242':3128
'95.##.141.33':3128
'18#.#92.223.152':3128
'87.##1.19.76':3128
'19#.#05.19.235':3128
'20#.#44.158.182':3128
'17#.#96.216.199':3128
'11#.#09.246.77':3128
'12#.#9.93.86':3128
'10#.#39.44.172':3128
'13#.#05.164.36':3128
'17#.#0.224.118':3128
'19#.#13.165.31':3128
'19#.#13.194.128':3128
'17#.#1.195.15':3128
'12#.#9.77.157':3128
'61.##5.165.16':3128
'89.##.45.224':3128
'14.#9.4.200':3128
'20#.#64.75.145':3128
'79.##7.47.197':3128
'41.##1.183.180':3128
'18#.#0.5.109':3128
'12#.#9.20.108':3128
'78.#3.47.42':3128
'20#.#66.192.146':3128
'37.#9.66.72':3128
'11#.#39.101.66':3128
'12#.#5.248.82':3128
'14.#9.76.57':3128
'18#.#6.165.79':3128
'2.###.245.14':3128
'79.##7.47.200':3128
'95.##.180.151':3128
'41.##3.82.250':3128
'89.##6.237.248':3128
'93.##6.154.250':3128
'2.###.127.115':3128
'41.##2.124.217':3128
'80.##1.38.165':3128
'11#.#10.54.6':3128
'87.##.199.246':3128
'12#.#69.142.139':3128
'77.##2.230.85':3128
'18#.#84.94.3':3128
'46.##0.110.27':3128
'19#.#77.252.32':3128
'98.##6.159.183':3128
'78.##8.173.145':3128
'18#.#27.163.237':3128
'46.#.245.38':3128
'18#.#52.168.116':3128
'85.##.150.246':3128
'80.##1.40.108':3128
'19#.#3.158.170':3128
'20#.#10.190.85':3128
'19#.#3.231.234':3128
'17#.#66.128.213':3128
'19#.#03.167.5':3128
'17#.#3.72.152':3128
'18#.#96.140.12':3128
'19#.#5.160.204':3128
'12#.#23.167.78':3128
'2.###.119.227':3128
'91.##.251.199':3128
'13#.#45.74.58':3128
'18#.#0.121.197':3128
'67.##1.41.155':3128
'82.##2.65.253':3128
'20#.#67.25.76':3128
'18#.#0.99.52':3128
'17#.#23.248.213':3128
'82.##.218.17':3128
'20#.#4.201.240':3128
'13#.#45.203.17':3128
'13#.#69.142.85':3128
'41.##3.228.17':3128
'20#.#32.15.72':3128
'17#.#22.170.125':3128
'68.##6.140.232':3128
'11#.#60.52.79':3128
'11#.43.47.4':3128
'37.##.67.142':3128
'18#.#96.148.179':3128
'19#.#3.231.210':3128
'20#.#3.186.177':3128
'18#.#8.240.63':3128
'19#.#1.173.15':3128
'41.##1.247.93':3128
'17#.#9.61.122':3128
'19#.#13.233.222':3128
'20#.#55.37.136':3128
'31.##3.85.76':3128
'19#.#64.232.64':3128
'80.##.108.138':3128
'21#.#98.41.225':3128
'87.##7.56.78':3128
'82.##0.168.67':3128
'80.##1.94.60':3128
'77.##.143.191':3128
'78.#9.45.79':3128
'18#.#2.213.213':3128

Другое:

Ищет следующие окна:

ClassName: 'Indicator' WindowName: ''

Технологии

Термины

Обучение и просвещение

Мифы

Техническая информация

Рекомендации по лечению

Демо бесплатно на 14 дней