Trojan.Siggen9.18107

Техническая информация

Вредоносные функции

Ищет следующие окна с целью

обнаружения утилит для анализа:

ClassName: 'OLLYDBG', WindowName: ''
ClassName: 'GBDYLLO', WindowName: ''
ClassName: 'pediy06', WindowName: ''
ClassName: 'FilemonClass', WindowName: ''
ClassName: '', WindowName: 'File Monitor - Sysinternals: www.sysinternals.com'
ClassName: 'PROCMON_WINDOW_CLASS', WindowName: ''
ClassName: '', WindowName: 'Process Monitor - Sysinternals: www.sysinternals.com'
ClassName: 'RegmonClass', WindowName: ''
ClassName: '', WindowName: 'Registry Monitor - Sysinternals: www.sysinternals.com'

Изменения в файловой системе

Создает следующие файлы

<Текущая директория>\2bf729e8.exe
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\info_48[2]
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\caasbycl\background_gradient[1]
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\0u8lpyu9\httperrorpagesscripts[1]
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\re1n75kr\errorpagetemplate[1]
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\caasbycl\down[1]
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\0u8lpyu9\bullet[1]
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\info_48[1]
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\background_gradient[2]
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\caasbycl\httperrorpagesscripts[1]
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\0u8lpyu9\errorpagestrings[1]
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\caasbycl\errorpagetemplate[1]
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\re1n75kr\dnserrordiagoff_weboc[1]
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\caasbycl\dnserrordiagoff_weboc[1]
%PROGRAMDATA%\rtmeslt
<Текущая директория>\796ba353.exe
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\bullet[1]
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\0u8lpyu9\down[1]

Удаляет следующие файлы

%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\caasbycl\dnserrordiagoff_weboc[1]
%WINDIR%\prefetch\agglfgapphistory.db
%WINDIR%\prefetch\agglglobalhistory.db
%WINDIR%\prefetch\aggluad_p_s-1-5-21-1960123792-2022915161-3775307078-1001.db
%WINDIR%\prefetch\aggluad_s-1-5-21-1960123792-2022915161-3775307078-1001.db
%WINDIR%\prefetch\agrobust.db
%WINDIR%\prefetch\arh.exe-f07e6c2c.pf
%WINDIR%\prefetch\aspnet_regiis.exe-b76f1ad7.pf
%WINDIR%\prefetch\audiodg.exe-bdfd3029.pf
%WINDIR%\prefetch\bcssync.exe-3f6c64a2.pf
%WINDIR%\prefetch\cmd.exe-4a81b364.pf
%WINDIR%\prefetch\conhost.exe-1f3e9d7e.pf
%WINDIR%\prefetch\control.exe-817f8f1d.pf
%WINDIR%\prefetch\dbgclr.exe-ad18e06e.pf
%WINDIR%\prefetch\defrag.exe-588f90ad.pf
%WINDIR%\prefetch\dexplore.exe-1749d792.pf
%WINDIR%\prefetch\dllhost.exe-5e46fa0d.pf
%WINDIR%\prefetch\dllhost.exe-766398d2.pf
%WINDIR%\prefetch\agglfaulthistory.db
%WINDIR%\prefetch\dllhost.exe-7faa2e4c.pf
%WINDIR%\prefetch\agcx_sc4.db
%WINDIR%\prefetch\addinutil.exe-fef23417.pf
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\caasbycl\errorpagetemplate[1]
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\0u8lpyu9\errorpagestrings[1]
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\caasbycl\httperrorpagesscripts[1]
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\background_gradient[2]
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\info_48[1]
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\0u8lpyu9\bullet[1]
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\caasbycl\down[1]
<DRIVERS>\etc\hosts
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\bullet[1]
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\re1n75kr\errorpagetemplate[1]
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\0u8lpyu9\httperrorpagesscripts[1]
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\re1n75kr\dnserrordiagoff_weboc[1]
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\0u8lpyu9\down[1]
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\bzjx5bke\info_48[2]
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\caasbycl\background_gradient[1]
%WINDIR%\prefetch\1.exe-bf9d2cef.pf
%WINDIR%\prefetch\acrord32.exe-acf2947d.pf
%WINDIR%\prefetch\agapplaunch.db
%WINDIR%\prefetch\dllhost.exe-861f96f8.pf

Подменяет следующие файлы

%LOCALAPPDATA%\Microsoft\Windows\<INETFILES>\Content.IE5\CAASBYCL\errorPageStrings[1]

Самоудаляется.

Сетевая активность

TCP

Запросы HTTP GET

http://pu##.#ackrules.com/PVLOL_QTE/AUTH/ver1.php?2B#############################################################################################################################################...

'go#####agmanager.com':443

'wh##.amung.us':443

UDP

DNS ASK pu##.#ackrules.com
DNS ASK go#####agmanager.com
DNS ASK wh##.amung.us

Другое

Ищет следующие окна

ClassName: '18467-41' WindowName: ''
ClassName: 'File Monitor - Sysinternals: www.sysinternals.com' WindowName: ''
ClassName: 'Process Monitor - Sysinternals: www.sysinternals.com' WindowName: ''
ClassName: 'Registry Monitor - Sysinternals: www.sysinternals.com' WindowName: ''
ClassName: 'MS_AutodialMonitor' WindowName: ''
ClassName: 'MS_WebCheckMonitor' WindowName: ''

Создает и запускает на исполнение