Trojan.Siggen9.49844

Техническая информация

Изменения в файловой системе

Создает следующие файлы

%TEMP%\nslacec.tmp
%TEMP%\drivergenius#\data\rcmsoft.dat
%TEMP%\drivergenius#\data\dgkit.dat
%TEMP%\drivergenius#\cfg\vulcfg.ini
%TEMP%\drivergenius#\cfg\kpcfg.ini
%TEMP%\drivergenius#\cfg\kcmpp.ini
%TEMP%\drivergenius#\cfg\kcinfo.ini
%TEMP%\drivergenius#\cfg\kccfg.ini
%TEMP%\drivergenius#\cfg\hotfix.ini
%TEMP%\drivergenius#\cfg\dgscript.ini
%TEMP%\drivergenius#\cfg\dgpop.ini
%TEMP%\drivergenius#\bin\diskspd32.exe
%TEMP%\drivergenius#\zlib.dll
%TEMP%\drivergenius#\tinyxml.dll
%TEMP%\drivergenius#\sysopt.exe
%TEMP%\drivergenius#\sqlite3.dll
%TEMP%\drivergenius#\patchcore.dll
%TEMP%\drivergenius#\pnpsup.dll
%TEMP%\drivergenius#\data\repair_tools.dat
%TEMP%\drivergenius#\xlmodule\xldl.dll
%LOCALAPPDATA%\microsoft\windows\wer\reportqueue\noncritical_x64_4017a4527469f9d5b499a101a973ca853f881d9_0af5e7ad\report.wer
%TEMP%\drivergenius#\cfg\hdinfo.ini
%TEMP%\drivergenius#\cfg\u.ini
%TEMP%\drivergenius#\cfg\dectcomp.dat
%TEMP%\nspc279.tmp\system.dll
%TEMP%\drivergenius#\xlmodule\download\zlib1.dll
%TEMP%\drivergenius#\xlmodule\download\xlzlib1.dll
%TEMP%\drivergenius#\xlmodule\download\msvcr71.dll
%TEMP%\drivergenius#\hwm.dll
%TEMP%\drivergenius#\xlmodule\download\msvcp71.dll
%TEMP%\drivergenius#\xlmodule\download\minizip.dll
%TEMP%\drivergenius#\xlmodule\download\minithunderplatform.exe
%TEMP%\drivergenius#\xlmodule\download\id.dat
%TEMP%\drivergenius#\xlmodule\download\download_engine.dll
%TEMP%\drivergenius#\xlmodule\download\dl_peer_id.dll
%TEMP%\drivergenius#\xlmodule\download\atl71.dll
%TEMP%\drivergenius#\nethelper.exe
%TEMP%\drivergenius#\mydrivers64.sys
%TEMP%\drivergenius#\mydrivers.sys
%TEMP%\drivergenius#\dglse.dll
%TEMP%\drivergenius#\dghwtool.exe
%TEMP%\drivergenius#\dghmpg64.dll
%TEMP%\drivergenius#\dghmpg.dll
%TEMP%\drivergenius#\dghelper.exe
%TEMP%\drivergenius#\dghelper.dll
%TEMP%\drivergenius#\dgctrl.dll
%TEMP%\drivergenius#\dgcore.dll
%TEMP%\drivergenius#\dgcomponent.dll
%TEMP%\drivergenius#\dgbase.dll
%TEMP%\drivergenius#\dgbackup.exe
%TEMP%\drivergenius#\config.ini
%TEMP%\drivergenius#\cactus.dll
%TEMP%\drivergenius#\7z.dll
%TEMP%\drivergenius#\dgservice.exe
%TEMP%\drivergenius#\dgsoundtool.exe
%TEMP%\drivergenius#\dgres.dll
%TEMP%\drivergenius#\dguimn.dll
%TEMP%\drivergenius#\mydrivers.dll
%TEMP%\drivergenius#\dguimn64.dll
%TEMP%\drivergenius#\msvcr80.dll
%TEMP%\drivergenius#\msvcp80.dll
%TEMP%\drivergenius#\microsoft.vc80.mfc.manifest
%TEMP%\drivergenius#\microsoft.vc80.crt.manifest
%TEMP%\drivergenius#\libprinter.dll
%TEMP%\drivergenius#\liblua.dll
%TEMP%\drivergenius#\xlmodule\download\xlbughandler.dll
%TEMP%\drivergenius#\data\unishwinfo.dat
%TEMP%\drivergenius#\hddscanner.exe
%TEMP%\drivergenius#\duilib.dll
%TEMP%\drivergenius#\drvinst64.exe
%TEMP%\drivergenius#\drvinst32.exe
%TEMP%\drivergenius#\driverupdate.exe
%TEMP%\drivergenius#\drivergenius.exe
%TEMP%\drivergenius#\dgver.dll
%TEMP%\drivergenius#\libcurl.dll
%TEMP%\drivergenius#\cfg\hwdect1.dat

Сетевая активность

TCP

Запросы HTTP GET

http://li#######e2.drivergenius.com/do_not_delete/index.htm

Запросы HTTP POST

http://li#######e5.drivergenius.com/post10.aspx
http://li#######e5.drivergenius.com/postbrand2.aspx
http://li#######e5.drivergenius.com/postwmidevice.aspx
http://li#######e5.drivergenius.com/postcomponent1.aspx
http://li#######e6.drivergenius.com/errdrivers/hwinfo.ashx?uu###
http://li#######e8.drivergenius.com/postinfo3.aspx

UDP

DNS ASK li#######e2.drivergenius.com
DNS ASK li#######e5.drivergenius.com
DNS ASK li#######e6.drivergenius.com
DNS ASK li#######e8.drivergenius.com

Другое

Ищет следующие окна

ClassName: '' WindowName: '设备管理器'
ClassName: 'Progman' WindowName: 'Program Manager'
ClassName: 'SHELLDLL_DefView' WindowName: ''
ClassName: 'SysListView32' WindowName: 'FolderView'

Создает и запускает на исполнение

'%TEMP%\drivergenius#\drivergenius.exe'
'%TEMP%\drivergenius#\drvinst64.exe' /updatedevicedriver

Запускает на исполнение

'<SYSTEM32>\locator.exe'
'<SYSTEM32>\rundll32.exe' <SYSTEM32>\newdev.dll,pDiDeviceInstallNotification \\.\pipe\PNP_Device_Install_Pipe_1.{5c126f8a-00f2-4f01-a753-3ea0e719c6e9} "(null)"