Trojan.PWS.Siggen2.38315

Техническая информация

Вредоносные функции

Ищет ветки реестра, отвечающие за хранение паролей сторонними программами

[<HKCU>\Software\Martin Prikryl\WinSCP 2\Sessions]

Читает файлы, отвечающие за хранение паролей сторонними программами

%LOCALAPPDATA%\google\chrome\user data\default\cookies
%LOCALAPPDATA%\google\chrome\user data\default\login data
%LOCALAPPDATA%\google\chrome\user data\default\web data
%APPDATA%\opera software\opera stable\login data
%HOMEPATH%\desktop\508softwareandos.doc
%HOMEPATH%\desktop\adhd_and_obesity.docx
%HOMEPATH%\desktop\applicantform_en.doc
%HOMEPATH%\desktop\hadac_newsletter_july_2010_final.docx
%HOMEPATH%\desktop\hanni_umami_chapter.doc
%HOMEPATH%\desktop\issi2013_template_for_posters.docx
%HOMEPATH%\desktop\lisp_success.doc
%HOMEPATH%\desktop\nwfieldnotes1966.docx
%HOMEPATH%\desktop\thlps_keeper_mayer_1965.docx

Ищет следующие окна с целью

обнаружения утилит для анализа:

ClassName: 'OLLYDBG', WindowName: ''
ClassName: 'GBDYLLO', WindowName: ''
ClassName: 'pediy06', WindowName: ''
ClassName: 'FilemonClass', WindowName: ''
ClassName: '', WindowName: 'File Monitor - Sysinternals: www.sysinternals.com'
ClassName: 'PROCMON_WINDOW_CLASS', WindowName: ''
ClassName: '', WindowName: 'Process Monitor - Sysinternals: www.sysinternals.com'
ClassName: 'RegmonClass', WindowName: ''
ClassName: '', WindowName: 'Registry Monitor - Sysinternals: www.sysinternals.com'

Изменения в файловой системе

Создает следующие файлы

%APPDATA%\ptstq8s5q2w6x6s5q2w6x6\steam\config.vdf
%APPDATA%\ptstq8s5q2w6x6s5q2w6x6\information.txt
%APPDATA%\ptstq8s5q2w6x6s5q2w6x6\screenshot.jpeg
%APPDATA%\ptstq8s5q2w6x6s5q2w6x6\files.zip
%APPDATA%\ptstq8s5q2w6x6s5q2w6x6\files\thlps_keeper_mayer_1965.docx
%APPDATA%\ptstq8s5q2w6x6s5q2w6x6\files\nwfieldnotes1966.docx
%APPDATA%\ptstq8s5q2w6x6s5q2w6x6\files\lisp_success.doc
%APPDATA%\ptstq8s5q2w6x6s5q2w6x6\files\issi2013_template_for_posters.docx
%APPDATA%\ptstq8s5q2w6x6s5q2w6x6\files\hanni_umami_chapter.doc
%APPDATA%\ptstq8s5q2w6x6s5q2w6x6\files\hadac_newsletter_july_2010_final.docx
%APPDATA%\ptstq8s5q2w6x6s5q2w6x6\files\applicantform_en.doc
%APPDATA%\ptstq8s5q2w6x6s5q2w6x6\files\adhd_and_obesity.docx
%APPDATA%\ptstq8s5q2w6x6s5q2w6x6\files\508softwareandos.doc
%APPDATA%\ptstq8s5q2w6x6s5q2w6x6\other\actions.txt
%APPDATA%\ptstq8s5q2w6x6s5q2w6x6\history\edge.txt
%PROGRAMDATA%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\2f1a6504-0641-44cf-8bb5-3612d865f2e5.vsch
%PROGRAMDATA%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\3ccd5499-87a8-4b10-a215-608888dd3b55.vsch
%PROGRAMDATA%\microsoft\vault\ac658cb4-9126-49bd-b877-31eedab3f204\policy.vpol
%APPDATA%\ptstq8s5q2w6x6s5q2w6x6\history\opera.txt
%APPDATA%\ptstq8s5q2w6x6s5q2w6x6\cookies\opera_2.log
%APPDATA%\ptstq8s5q2w6x6s5q2w6x6\history\mozilla.txt
%APPDATA%\ptstq8s5q2w6x6s5q2w6x6\cookies\mozilla_1.log
%APPDATA%\ptstq8s5q2w6x6s5q2w6x6\cookies\chrome_0.log
%TEMP%\xzqpiiidwxiu.rqh
%APPDATA%\ptstq8s5q2w6x6s5q2w6x6\telegram\map0
%APPDATA%\ptstq8s5q2w6x6s5q2w6x6\telegram\d877f783d5d3ef8c1
%APPDATA%\ptstq8s5q2w6x6s5q2w6x6\steam\dialogconfig.vdf
%LOCALAPPDATA%\microsoft\vault\4bf4c442-9b8a-41a0-b380-dd4a704ddb28\policy.vpol
%APPDATA%\zparq8s5q2w6x6s5q2w6x6.zip